chore(ci): bump dorny/paths-filter from 3 to 4#64
Conversation
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3 to 4. - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@v3...v4) --- updated-dependencies: - dependency-name: dorny/paths-filter dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
dependabot[bot] has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.
📝 WalkthroughWalkthroughThe CI workflow updates the ChangesCI Workflow Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 23: Replace the mutable action reference dorny/paths-filter@v4 with a
pinned commit SHA: locate the uses: dorny/paths-filter@v4 line in the GitHub
Actions workflow and update it to uses: dorny/paths-filter@<full-commit-sha>
(obtain the exact SHA from the action's GitHub repo commit history or the
specific release commit) so the workflow references an immutable commit instead
of the retargetable `@v4` tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f889ae48-038e-4e5e-8123-4ce2229e6883
📒 Files selected for processing (1)
.github/workflows/ci.yml
| - name: Filter paths | ||
| id: filter | ||
| uses: dorny/paths-filter@v3 | ||
| uses: dorny/paths-filter@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Confirm exact uses line in the workflow and surrounding context
echo "== ci.yml around Line 23 =="
nl -ba .github/workflows/ci.yml | sed -n '15,40p'
echo
echo "== All references to dorny/paths-filter in repo =="
rg -n "dorny/paths-filter" -S . || true
echo
echo "== Check for any uses: ...@<40+ hex> patterns (pinned by SHA) in ci.yml =="
rg -n "uses:\s*.+@([0-9a-f]{40,64})" .github/workflows/ci.yml || trueRepository: AIX-Format/PiWorker-OS
Length of output: 155
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== ci.yml around Line 23 =="
awk 'NR>=15 && NR<=40 {printf "%d:%s\n", NR, $0}' .github/workflows/ci.yml
echo
echo "== All references to dorny/paths-filter in repo =="
rg -n "dorny/paths-filter" -S . || true
echo
echo "== Check for any uses: ...@<40+ hex> patterns in workflow(s) =="
rg -n "uses:\s*[^@]+@[0-9a-f]{40,64}" .github/workflows/ci.yml .github/workflows || trueRepository: AIX-Format/PiWorker-OS
Length of output: 930
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== All references to dorny/paths-filter (including hidden dirs) =="
rg --hidden -n "dorny/paths-filter" . || true
echo
echo "== Any SHA-pinned dorny/paths-filter usages? =="
rg --hidden -n "dorny/paths-filter@([0-9a-f]{40,64})" .github/workflows . || true
echo
echo "== Any uses: ...@<40+ hex> patterns in workflows? =="
rg --hidden -n "uses:\s*[^@]+@[0-9a-f]{40,64}" .github/workflows . || trueRepository: AIX-Format/PiWorker-OS
Length of output: 302
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== uses: entries in .github/workflows/ci.yml =="
rg --hidden -n "^\s*uses:" .github/workflows/ci.ymlRepository: AIX-Format/PiWorker-OS
Length of output: 515
Pin dorny/paths-filter to a commit SHA, not the mutable @v4 tag.
Line 23 uses dorny/paths-filter@v4, which is retargetable; pin to an exact commit SHA for supply-chain hardening.
Suggested hardening change
- uses: dorny/paths-filter@v4
+ uses: dorny/paths-filter@<full_length_commit_sha_for_v4>🧰 Tools
🪛 zizmor (1.25.2)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 23, Replace the mutable action reference
dorny/paths-filter@v4 with a pinned commit SHA: locate the uses:
dorny/paths-filter@v4 line in the GitHub Actions workflow and update it to uses:
dorny/paths-filter@<full-commit-sha> (obtain the exact SHA from the action's
GitHub repo commit history or the specific release commit) so the workflow
references an immutable commit instead of the retargetable `@v4` tag.
Bumps dorny/paths-filter from 3 to 4.
Release notes
Sourced from dorny/paths-filter's releases.
Changelog
Sourced from dorny/paths-filter's changelog.
... (truncated)
Commits
fbd0ab8feat: add merge_group event supportefb1da7feat: add dist/ freshness check to PR workflowd8f7b06Merge pull request #302 from dorny/issue-299addbc14Update README for v49d7afb8Update CHANGELOG for v4.0.0782470cMerge branch 'releases/v3'ce10459Merge pull request #294 from saschabratton/master5f40380feat: update action runtime to node24Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit