Skip to content

chore(deps): bump actions/cache from 5.0.4 to 5.0.5 in the github-actions group across 1 directory #1631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps): bump actions/cache from 5.0.4 to 5.0.5 in the github-actions group across 1 directory #1631

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:
version: "0.11.2"
python-version: "3.13"

@claude claude Bot Apr 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 The inline comment on line 47 still reads # v5.0.4 after the commit hash was updated to the v5.0.5 hash (27d5ce7f). Update the comment to # v5.0.5 to accurately reflect the pinned version.

Extended reasoning...

What the bug is: This PR bumps actions/cache from v5.0.4 to v5.0.5 by updating the pinned commit hash on line 47 of .github/workflows/ci.yml. However, the inline human-readable version comment on the same line was not updated and still reads # v5.0.4 instead of # v5.0.5.

The specific code path: The single changed line in this PR is:

- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.4 # zizmor: ignore[cache-poisoning]

The commit hash 27d5ce7f107fe9357f9df03efb73ab90386fccae corresponds to v5.0.5 (as stated in the PR title and description), but the comment still says v5.0.4.

Why existing code doesn't prevent it: Dependabot automatically updates the pinned commit hash but does not always update the adjacent human-readable version comment. There is no automated check that validates the comment matches the actual version of the pinned commit.

Impact: The workflow functions correctly because GitHub Actions resolves the action by the commit hash, not the comment. However, maintainers who read the file to determine which version is pinned will be misled into thinking v5.0.4 is in use when v5.0.5 is actually running.

How to fix it: Change the comment from # v5.0.4 to # v5.0.5 on line 47:

- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 # zizmor: ignore[cache-poisoning]

Step-by-step proof:

  1. The PR description states: "Updates actions/cache from 5.0.4 to 5.0.5"
  2. The commit 27d5ce7f107fe9357f9df03efb73ab90386fccae is the merge commit for actions/cache v5.0.5 (confirmed in the PR's commit list)
  3. The old hash 668228422ae6a00e4ad889ee87cd7109ec5666a7 was v5.0.4
  4. After the diff, line 47 now has the v5.0.5 hash but the # v5.0.4 comment was not updated
  5. Anyone reading .github/workflows/ci.yml and trusting the comment will incorrectly believe v5.0.4 is pinned

enable-cache: true # zizmor: ignore[cache-poisoning] CI-only, no artifacts published
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 # zizmor: ignore[cache-poisoning]
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.4 # zizmor: ignore[cache-poisoning]
name: Cache mypy cache
with:
path: ./.mypy_cache
Expand Down
Loading