circleci-bundle-update-pr 5.2.7 → 5.2.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 6616aceee3c2677357b9bbdf2a83984c983ea3766eef0167363bf10703fae848
4
- data.tar.gz: 6b30ab0102ae68c3fb1d111da3d592d4dc1c18f81474aaa38d7b143b147da6c3
3
+ metadata.gz: 95268d03936c93f4677fd5d8c29a577f5e79bfb583d8ee16a8e35476ad49fef7
4
+ data.tar.gz: 07f88ec490bc614f8039f5f4659b0d64679edc7064fa84a86f4ac4c2afa3a84a
5
5
  SHA512:
6
- metadata.gz: 126577e963889f5286554c8a320685d21ab540f511cc5dfc590214a58c6bc7b62534d3ee561043067749ae2e1df0528ad32658644a3910ef032e50a827e9594d
7
- data.tar.gz: 52a60ba6d5148bf177623d2198b3469d7396c8c323417e0745f7e0ac78790de0456a667eb4a9c39b5a152a35d08c3b9fa06b0971dac6440c747eb973a162c7bf
6
+ metadata.gz: 2e4d77c59301a882f0afdaef9bbbe1b95a84096ab20a958b82e5fe59770a8255c5bd98b281945f01759bf924e4ef5ef382b26370fe8430e262c74ed61535a106
7
+ data.tar.gz: f52f1e6c651acb681810eec167ec7ab9c1e04cddf15482f70b4129075553e9a483f6b42e5110cbbc36692888bae81e1c24ef0337c63ba64507863078702d5900
@@ -28,7 +28,7 @@ jobs:
28
28
  - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
29
29
  id: app-token
30
30
  with:
31
- app-id: ${{ vars.CI_APP_ID }}
31
+ client-id: ${{ vars.CI_CLIENT_ID }}
32
32
  private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
33
33
  permission-contents: write
34
34
  permission-pull-requests: write
@@ -37,11 +37,11 @@ jobs:
37
37
  persist-credentials: false
38
38
  token: ${{ steps.app-token.outputs.token }}
39
39
  # Required to run `bundle lock` via postVersionCommand in .tagpr
40
- - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
40
+ - uses: ruby/setup-ruby@762794c140bbeda0f1224786aa33b4b46783a6c1 # v1.326.0
41
41
  with:
42
42
  ruby-version: ruby
43
43
  - id: run-tagpr
44
- uses: Songmu/tagpr@242e22916eb775d6e359959fe3ba5c497de4a01a # v1.20.2
44
+ uses: Songmu/tagpr@2afc990a4a5a9a340665cc1a484c2102f7de332f # v1.21.0
45
45
  env:
46
46
  GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
47
47
  outputs:
@@ -61,13 +61,14 @@ jobs:
61
61
  with:
62
62
  persist-credentials: false
63
63
  ref: ${{ needs.tagpr.outputs.tagpr-tag }}
64
- - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
64
+ - uses: ruby/setup-ruby@762794c140bbeda0f1224786aa33b4b46783a6c1 # v1.326.0
65
65
  with:
66
66
  ruby-version: ruby
67
- # The release job is the only one that writes a bundler cache on GitHub
68
- # Actions -- the test matrix lives on CircleCI -- so there is no cache
69
- # entry an attacker could poison.
70
- bundler-cache: true # zizmor: ignore[cache-poisoning]
67
+ # `status` is not a trusted trigger, so this run only gets a read-only cache
68
+ # token and `bundler-cache: true` fails to save. Nothing writes a bundler
69
+ # cache here anyway -- the test matrix lives on CircleCI -- so just install.
70
+ # https://github.blog/changelog/2026-06-26-read-only-actions-cache-for-untrusted-triggers/
71
+ - run: bundle install --jobs 4
71
72
  # Runs `bundle exec rake release` internally
72
73
  - uses: rubygems/release-gem@7f9650160c1a4e7989fdc9855807bdbd421d8b6b # v1.4.1
73
74
 
data/.tagpr CHANGED
@@ -4,7 +4,7 @@
4
4
  vPrefix = true
5
5
  releaseBranch = main
6
6
  versionFile = lib/circleci/bundle/update/pr/version.rb
7
- release = draft
7
+ release = true
8
8
  # Rewriting versionFile alone leaves the PATH section of Gemfile.lock stale,
9
9
  # which makes `rake release` in the release job fail at release:guard_clean.
10
10
  postVersionCommand = bundle lock
data/CHANGELOG.md CHANGED
@@ -1,5 +1,15 @@
1
1
  # Changelog
2
2
 
3
+ ## [v5.2.8](https://github.com/masutaka/circleci-bundle-update-pr/compare/v5.2.7...v5.2.8) - 2026-10-03
4
+
5
+ ### Maintenance :technologist:
6
+ - Fix two rough edges in the tagpr release flow by @masutaka in https://github.com/masutaka/circleci-bundle-update-pr/pull/275
7
+ - bundle update at 2026-09-01 19:11:22 JST by @masutaka in https://github.com/masutaka/circleci-bundle-update-pr/pull/272
8
+ - chore: Remove actionlint config superseded by masutaka/actions by @masutaka in https://github.com/masutaka/circleci-bundle-update-pr/pull/277
9
+ - chore: Replace deprecated app-id input of create-github-app-token with client-id by @masutaka in https://github.com/masutaka/circleci-bundle-update-pr/pull/278
10
+ - chore(deps): Bump ruby/setup-ruby from 1.321.0 to 1.326.0 by @dependabot[bot] in https://github.com/masutaka/circleci-bundle-update-pr/pull/281
11
+ - chore(deps): Bump Songmu/tagpr from 1.20.2 to 1.21.0 by @dependabot[bot] in https://github.com/masutaka/circleci-bundle-update-pr/pull/280
12
+
3
13
  ## [v5.2.7](https://github.com/masutaka/circleci-bundle-update-pr/compare/v5.2.6...v5.2.7) - 2026-09-01
4
14
 
5
15
  ### Maintenance :technologist:
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- circleci-bundle-update-pr (5.2.7)
4
+ circleci-bundle-update-pr (5.2.8)
5
5
  compare_linker (>= 1.4.10)
6
6
  octokit
7
7
 
@@ -60,8 +60,8 @@ GEM
60
60
  diff-lcs (>= 1.2.0, < 2.0)
61
61
  rspec-support (~> 3.13.0)
62
62
  rspec-support (3.13.7)
63
- rubocop (1.88.2)
64
- json (~> 2.3)
63
+ rubocop (1.90.0)
64
+ json (>= 2.3)
65
65
  language_server-protocol (~> 3.17.0.2)
66
66
  lint_roller (~> 1.1.0)
67
67
  parallel (>= 1.10)
@@ -4,7 +4,7 @@ module Circleci
4
4
  module Bundle
5
5
  module Update
6
6
  module Pr
7
- VERSION = '5.2.7'
7
+ VERSION = '5.2.8'
8
8
  end
9
9
  end
10
10
  end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: circleci-bundle-update-pr
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.2.7
4
+ version: 5.2.8
5
5
  platform: ruby
6
6
  authors:
7
7
  - Takashi Masuda
@@ -131,7 +131,6 @@ extra_rdoc_files: []
131
131
  files:
132
132
  - ".circleci/config.yml"
133
133
  - ".github/CODEOWNERS"
134
- - ".github/actionlint.yaml"
135
134
  - ".github/dependabot.yml"
136
135
  - ".github/ghalint.yml"
137
136
  - ".github/release.yml"
@@ -179,7 +178,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
179
178
  - !ruby/object:Gem::Version
180
179
  version: '0'
181
180
  requirements: []
182
- rubygems_version: 4.0.16
181
+ rubygems_version: 4.0.20
183
182
  specification_version: 4
184
183
  summary: Provide continues bundle update using CircleCI
185
184
  test_files: []
@@ -1,8 +0,0 @@
1
- # actionlint - https://github.com/rhysd/actionlint/blob/main/docs/config.md
2
-
3
- paths:
4
- .github/workflows/release.yml:
5
- ignore:
6
- # concurrency.queue is a valid key added in 2026-05, but actionlint 1.7.12 does not know it yet.
7
- # https://github.blog/changelog/2026-05-07-github-actions-concurrency-groups-now-allow-larger-queues/
8
- - 'unexpected key "queue" for "concurrency" section'