From 8dbca26aded89494cf44408cf19f26bb18ceff0a Mon Sep 17 00:00:00 2001 From: Jordan Krage Date: Tue, 16 Jun 2026 05:53:28 -0500 Subject: [PATCH 1/5] workflows: add dependabump --- .github/workflows/dependabump.yml | 125 ++++++++++++++++++++++++++ workflows/dependabump/README.md | 30 +++++++ workflows/dependabump/dependabump.yml | 121 +++++++++++++++++++++++++ workflows/dependabump/package.json | 11 +++ 4 files changed, 287 insertions(+) create mode 100644 .github/workflows/dependabump.yml create mode 100644 workflows/dependabump/README.md create mode 100644 workflows/dependabump/dependabump.yml create mode 100644 workflows/dependabump/package.json diff --git a/.github/workflows/dependabump.yml b/.github/workflows/dependabump.yml new file mode 100644 index 000000000..8f0a661af --- /dev/null +++ b/.github/workflows/dependabump.yml @@ -0,0 +1,125 @@ +# GENERATED FILE - DO NOT EDIT DIRECTLY. +# Source: workflows/dependabump/dependabump.yml +# Edit the source under workflows/, then regenerate. + +name: dependabump + +on: + workflow_call: + secrets: + SLACK_TOKEN: + required: true + SLACK_CHANNEL_ID: + required: true + inputs: + severity: + required: false + type: string + default: 'critical,high' + post-bump-command: + required: false + type: string + +permissions: { } + +jobs: + dependabump: + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + actions: read + security-events: read + vulnerability-alerts: read + env: + GH_TOKEN: ${{ github.token }} + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Set up Go + uses: actions/setup-go@v7 + + - name: Install tools + id: install + env: + GOTOOLCHAIN: auto + run: | + go install github.com/jmank88/gomods@ec230e90e89d4310b21fdeeba0d1290a3821a901 && \ + go install github.com/smartcontractkit/chainlink-common/script/cmd/dependabot@70b55abaf6e19d887c219b497046838d6113f22c + continue-on-error: true + + - name: Bump Dependencies + id: bump + env: + GOTOOLCHAIN: auto + SEVERITY: ${{ inputs.severity }} + if: steps.install.outcome == 'success' + run: | + if ! printf '%s' "$SEVERITY" | grep -Eq '^[[:space:]]*(critical|high|medium|low)([[:space:]]*,[[:space:]]*(critical|high|medium|low))*[[:space:]]*$'; then + echo "Invalid severity input: $SEVERITY" >&2 + exit 1 + fi + SEVERITY="${SEVERITY//[[:space:]]/}" + gh api --paginate -H "Accept: application/vnd.github+json" --method GET \ + '/repos/smartcontractkit/chainlink-common/dependabot/alerts?state=open&ecosystem=Go&severity=$SEVERITY' \ + --jq '.[] | select(.security_vulnerability.first_patched_version != null) | .dependency.manifest_path |= rtrimstr("go.mod") | "./\(.dependency.manifest_path) \(.security_vulnerability.package.name) \(.security_vulnerability.first_patched_version.identifier)"' | \ + dependabot && gomods tidy + continue-on-error: true + + - name: Post-bump Command + id: post-bump + if: ${{ steps.bump.outcome == 'success' && inputs.post-bump-command != '' }} + env: + POST_BUMP_COMMAND: ${{ inputs.post-bump-command }} + run: eval "${POST_BUMP_COMMAND}" + continue-on-error: true + + - name: Notify Failure + if: ${{ steps.install.outcome == 'failure' || steps.bump.outcome == 'failure' || steps.post-bump.outcome == 'failure' }} + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SLACK_TOKEN }} + payload: | + channel: ${{ secrets.SLACK_CHANNEL_ID}} + text: "Failed to check for vulnerabilities in `${{ github.event.repository.name }}`: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>" + + - name: Exit on Failure + if: ${{ steps.install.outcome == 'failure' || steps.bump.outcome == 'failure' || steps.post-bump.outcome == 'failure' }} + run: exit 1 + + - name: Create Pull Request + id: pr + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: + branch: bot/dependabump + commit-message: "bump dependencies" + title: "dependabump" + body: "Upgrading vulnerable dependencies." + sign-commits: true + continue-on-error: true + + - name: Notify PR Failure + if: ${{ steps.pr.outcome == 'failure' }} + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SLACK_TOKEN }} + payload: | + channel: ${{ secrets.SLACK_CHANNEL_ID}} + text: "Vulnerabilities detected in `${{ github.event.repository.name }}`, but failed to create PR: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>" + + - name: Exit on PR Failure + if: ${{ steps.pr.outcome == 'failure' }} + run: exit 1 + + - name: Notify PR Created + if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated' + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SLACK_TOKEN }} + payload: | + channel: ${{ secrets.SLACK_CHANNEL_ID}} + text: "Vulnerabilities detected in `${{ github.event.repository.name }}` - upgrading dependencies: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run> - <${{ steps.pr.outputs.pull-request-url }}|PR> :review-time:" diff --git a/workflows/dependabump/README.md b/workflows/dependabump/README.md new file mode 100644 index 000000000..63cbbcee9 --- /dev/null +++ b/workflows/dependabump/README.md @@ -0,0 +1,30 @@ +# Dependabump + +This workflow inspects dependenabot vulnerabilities, and opens pull requests to update dependencies. + +## Recommended usage +Example workflow: +```yaml +name: dependabump + +on: + workflow_dispatch: + schedule: + - cron: '0 0 * * 1-5' # every week-day at midnight + +permissions: { } + +jobs: + dependabump: + permissions: + contents: write + pull-requests: write + actions: read + security-events: read + vulnerability-alerts: read + uses: smartcontractkit/.github/workflows/dependabump.yml@main + secrets: + SLACK_TOKEN: ${{ secrets.DEPENDABUMP_SLACK_API_KEY }} + SLACK_CHANNEL_ID: ${{ secrets.DEPENDABUMP_SLACK_CHANNEL_ID }} + +``` diff --git a/workflows/dependabump/dependabump.yml b/workflows/dependabump/dependabump.yml new file mode 100644 index 000000000..9292b55ab --- /dev/null +++ b/workflows/dependabump/dependabump.yml @@ -0,0 +1,121 @@ +name: dependabump + +on: + workflow_call: + secrets: + SLACK_TOKEN: + required: true + SLACK_CHANNEL_ID: + required: true + inputs: + severity: + required: false + type: string + default: 'critical,high' + post-bump-command: + required: false + type: string + +permissions: { } + +jobs: + dependabump: + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + actions: read + security-events: read + vulnerability-alerts: read + env: + GH_TOKEN: ${{ github.token }} + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Set up Go + uses: actions/setup-go@v7 + + - name: Install tools + id: install + env: + GOTOOLCHAIN: auto + run: | + go install github.com/jmank88/gomods@ec230e90e89d4310b21fdeeba0d1290a3821a901 && \ + go install github.com/smartcontractkit/chainlink-common/script/cmd/dependabot@70b55abaf6e19d887c219b497046838d6113f22c + continue-on-error: true + + - name: Bump Dependencies + id: bump + env: + GOTOOLCHAIN: auto + SEVERITY: ${{ inputs.severity }} + if: steps.install.outcome == 'success' + run: | + if ! printf '%s' "$SEVERITY" | grep -Eq '^[[:space:]]*(critical|high|medium|low)([[:space:]]*,[[:space:]]*(critical|high|medium|low))*[[:space:]]*$'; then + echo "Invalid severity input: $SEVERITY" >&2 + exit 1 + fi + SEVERITY="${SEVERITY//[[:space:]]/}" + gh api --paginate -H "Accept: application/vnd.github+json" --method GET \ + '/repos/smartcontractkit/chainlink-common/dependabot/alerts?state=open&ecosystem=Go&severity=$SEVERITY' \ + --jq '.[] | select(.security_vulnerability.first_patched_version != null) | .dependency.manifest_path |= rtrimstr("go.mod") | "./\(.dependency.manifest_path) \(.security_vulnerability.package.name) \(.security_vulnerability.first_patched_version.identifier)"' | \ + dependabot && gomods tidy + continue-on-error: true + + - name: Post-bump Command + id: post-bump + if: ${{ steps.bump.outcome == 'success' && inputs.post-bump-command != '' }} + env: + POST_BUMP_COMMAND: ${{ inputs.post-bump-command }} + run: eval "${POST_BUMP_COMMAND}" + continue-on-error: true + + - name: Notify Failure + if: ${{ steps.install.outcome == 'failure' || steps.bump.outcome == 'failure' || steps.post-bump.outcome == 'failure' }} + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SLACK_TOKEN }} + payload: | + channel: ${{ secrets.SLACK_CHANNEL_ID}} + text: "Failed to check for vulnerabilities in `${{ github.event.repository.name }}`: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>" + + - name: Exit on Failure + if: ${{ steps.install.outcome == 'failure' || steps.bump.outcome == 'failure' || steps.post-bump.outcome == 'failure' }} + run: exit 1 + + - name: Create Pull Request + id: pr + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: + branch: bot/dependabump + commit-message: "bump dependencies" + title: "dependabump" + body: "Upgrading vulnerable dependencies." + sign-commits: true + continue-on-error: true + + - name: Notify PR Failure + if: ${{ steps.pr.outcome == 'failure' }} + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SLACK_TOKEN }} + payload: | + channel: ${{ secrets.SLACK_CHANNEL_ID}} + text: "Vulnerabilities detected in `${{ github.event.repository.name }}`, but failed to create PR: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>" + + - name: Exit on PR Failure + if: ${{ steps.pr.outcome == 'failure' }} + run: exit 1 + + - name: Notify PR Created + if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated' + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SLACK_TOKEN }} + payload: | + channel: ${{ secrets.SLACK_CHANNEL_ID}} + text: "Vulnerabilities detected in `${{ github.event.repository.name }}` - upgrading dependencies: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run> - <${{ steps.pr.outputs.pull-request-url }}|PR> :review-time:" diff --git a/workflows/dependabump/package.json b/workflows/dependabump/package.json new file mode 100644 index 000000000..4485d346a --- /dev/null +++ b/workflows/dependabump/package.json @@ -0,0 +1,11 @@ +{ + "name": "dependabump", + "version": "0.0.0", + "description": "", + "private": true, + "scripts": {}, + "keywords": [], + "author": "@smartcontractkit", + "license": "MIT", + "packageManager": "pnpm@10.29.3" +} From 4c1fb8fb2d2c2886549a788fa7c0a969274419ef Mon Sep 17 00:00:00 2001 From: Jordan Krage Date: Thu, 23 Jul 2026 16:47:59 -0500 Subject: [PATCH 2/5] Update .github/workflows/dependabump.yml Co-authored-by: chainchad <96362174+chainchad@users.noreply.github.com> --- .github/workflows/dependabump.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabump.yml b/.github/workflows/dependabump.yml index 8f0a661af..5f6dc7f32 100644 --- a/.github/workflows/dependabump.yml +++ b/.github/workflows/dependabump.yml @@ -62,7 +62,7 @@ jobs: fi SEVERITY="${SEVERITY//[[:space:]]/}" gh api --paginate -H "Accept: application/vnd.github+json" --method GET \ - '/repos/smartcontractkit/chainlink-common/dependabot/alerts?state=open&ecosystem=Go&severity=$SEVERITY' \ + "/repos/${GITHUB_REPOSITORY}/dependabot/alerts?state=open&ecosystem=Go&severity=${SEVERITY}" \ --jq '.[] | select(.security_vulnerability.first_patched_version != null) | .dependency.manifest_path |= rtrimstr("go.mod") | "./\(.dependency.manifest_path) \(.security_vulnerability.package.name) \(.security_vulnerability.first_patched_version.identifier)"' | \ dependabot && gomods tidy continue-on-error: true From 6a12fcea7da2f501073c6599d9b9bdf83638945a Mon Sep 17 00:00:00 2001 From: Jordan Krage Date: Thu, 23 Jul 2026 16:48:22 -0500 Subject: [PATCH 3/5] Update .github/workflows/dependabump.yml Co-authored-by: chainchad <96362174+chainchad@users.noreply.github.com> --- .github/workflows/dependabump.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabump.yml b/.github/workflows/dependabump.yml index 5f6dc7f32..e34985667 100644 --- a/.github/workflows/dependabump.yml +++ b/.github/workflows/dependabump.yml @@ -35,7 +35,7 @@ jobs: GH_TOKEN: ${{ github.token }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Go uses: actions/setup-go@v7 From c21be3e44f44922e2ac6e1f6d289de407fbb0740 Mon Sep 17 00:00:00 2001 From: Jordan Krage Date: Thu, 23 Jul 2026 16:48:46 -0500 Subject: [PATCH 4/5] Update workflows/dependabump/dependabump.yml Co-authored-by: chainchad <96362174+chainchad@users.noreply.github.com> --- workflows/dependabump/dependabump.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/workflows/dependabump/dependabump.yml b/workflows/dependabump/dependabump.yml index 9292b55ab..0c0b7f87b 100644 --- a/workflows/dependabump/dependabump.yml +++ b/workflows/dependabump/dependabump.yml @@ -58,7 +58,7 @@ jobs: fi SEVERITY="${SEVERITY//[[:space:]]/}" gh api --paginate -H "Accept: application/vnd.github+json" --method GET \ - '/repos/smartcontractkit/chainlink-common/dependabot/alerts?state=open&ecosystem=Go&severity=$SEVERITY' \ + "/repos/${GITHUB_REPOSITORY}/dependabot/alerts?state=open&ecosystem=Go&severity=${SEVERITY}" \ --jq '.[] | select(.security_vulnerability.first_patched_version != null) | .dependency.manifest_path |= rtrimstr("go.mod") | "./\(.dependency.manifest_path) \(.security_vulnerability.package.name) \(.security_vulnerability.first_patched_version.identifier)"' | \ dependabot && gomods tidy continue-on-error: true From aed6c37e1615c858d9cd1e817337ae634237e2dd Mon Sep 17 00:00:00 2001 From: chainchad <96362174+chainchad@users.noreply.github.com> Date: Thu, 23 Jul 2026 20:49:19 -0400 Subject: [PATCH 5/5] Rename workflow to match convention and run formatter --- .changeset/curly-jays-care.md | 5 + .github/workflows/reusable-dependabump.yml | 125 ++++++++++++++++++ .../README.md | 12 +- .../package.json | 2 +- .../reusable-dependabump.yml} | 2 +- 5 files changed, 139 insertions(+), 7 deletions(-) create mode 100644 .changeset/curly-jays-care.md create mode 100644 .github/workflows/reusable-dependabump.yml rename workflows/{dependabump => reusable-dependabump}/README.md (73%) rename workflows/{dependabump => reusable-dependabump}/package.json (84%) rename workflows/{dependabump/dependabump.yml => reusable-dependabump/reusable-dependabump.yml} (99%) diff --git a/.changeset/curly-jays-care.md b/.changeset/curly-jays-care.md new file mode 100644 index 000000000..c69e356b8 --- /dev/null +++ b/.changeset/curly-jays-care.md @@ -0,0 +1,5 @@ +--- +"reusable-dependabump": minor +--- + +Create dependabump diff --git a/.github/workflows/reusable-dependabump.yml b/.github/workflows/reusable-dependabump.yml new file mode 100644 index 000000000..2608d49c0 --- /dev/null +++ b/.github/workflows/reusable-dependabump.yml @@ -0,0 +1,125 @@ +# GENERATED FILE - DO NOT EDIT DIRECTLY. +# Source: workflows/reusable-dependabump/reusable-dependabump.yml +# Edit the source under workflows/, then regenerate. + +name: dependabump + +on: + workflow_call: + secrets: + SLACK_TOKEN: + required: true + SLACK_CHANNEL_ID: + required: true + inputs: + severity: + required: false + type: string + default: 'critical,high' + post-bump-command: + required: false + type: string + +permissions: { } + +jobs: + dependabump: + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + actions: read + security-events: read + vulnerability-alerts: read + env: + GH_TOKEN: ${{ github.token }} + steps: + - name: Checkout + uses: actions/checkout@v7 + + - name: Set up Go + uses: actions/setup-go@v7 + + - name: Install tools + id: install + env: + GOTOOLCHAIN: auto + run: | + go install github.com/jmank88/gomods@ec230e90e89d4310b21fdeeba0d1290a3821a901 && \ + go install github.com/smartcontractkit/chainlink-common/script/cmd/dependabot@70b55abaf6e19d887c219b497046838d6113f22c + continue-on-error: true + + - name: Bump Dependencies + id: bump + env: + GOTOOLCHAIN: auto + SEVERITY: ${{ inputs.severity }} + if: steps.install.outcome == 'success' + run: | + if ! printf '%s' "$SEVERITY" | grep -Eq '^[[:space:]]*(critical|high|medium|low)([[:space:]]*,[[:space:]]*(critical|high|medium|low))*[[:space:]]*$'; then + echo "Invalid severity input: $SEVERITY" >&2 + exit 1 + fi + SEVERITY="${SEVERITY//[[:space:]]/}" + gh api --paginate -H "Accept: application/vnd.github+json" --method GET \ + "/repos/${GITHUB_REPOSITORY}/dependabot/alerts?state=open&ecosystem=Go&severity=${SEVERITY}" \ + --jq '.[] | select(.security_vulnerability.first_patched_version != null) | .dependency.manifest_path |= rtrimstr("go.mod") | "./\(.dependency.manifest_path) \(.security_vulnerability.package.name) \(.security_vulnerability.first_patched_version.identifier)"' | \ + dependabot && gomods tidy + continue-on-error: true + + - name: Post-bump Command + id: post-bump + if: ${{ steps.bump.outcome == 'success' && inputs.post-bump-command != '' }} + env: + POST_BUMP_COMMAND: ${{ inputs.post-bump-command }} + run: eval "${POST_BUMP_COMMAND}" + continue-on-error: true + + - name: Notify Failure + if: ${{ steps.install.outcome == 'failure' || steps.bump.outcome == 'failure' || steps.post-bump.outcome == 'failure' }} + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SLACK_TOKEN }} + payload: | + channel: ${{ secrets.SLACK_CHANNEL_ID}} + text: "Failed to check for vulnerabilities in `${{ github.event.repository.name }}`: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>" + + - name: Exit on Failure + if: ${{ steps.install.outcome == 'failure' || steps.bump.outcome == 'failure' || steps.post-bump.outcome == 'failure' }} + run: exit 1 + + - name: Create Pull Request + id: pr + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: + branch: bot/dependabump + commit-message: "bump dependencies" + title: "dependabump" + body: "Upgrading vulnerable dependencies." + sign-commits: true + continue-on-error: true + + - name: Notify PR Failure + if: ${{ steps.pr.outcome == 'failure' }} + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SLACK_TOKEN }} + payload: | + channel: ${{ secrets.SLACK_CHANNEL_ID}} + text: "Vulnerabilities detected in `${{ github.event.repository.name }}`, but failed to create PR: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>" + + - name: Exit on PR Failure + if: ${{ steps.pr.outcome == 'failure' }} + run: exit 1 + + - name: Notify PR Created + if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated' + uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + with: + method: chat.postMessage + token: ${{ secrets.SLACK_TOKEN }} + payload: | + channel: ${{ secrets.SLACK_CHANNEL_ID}} + text: "Vulnerabilities detected in `${{ github.event.repository.name }}` - upgrading dependencies: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run> - <${{ steps.pr.outputs.pull-request-url }}|PR> :review-time:" diff --git a/workflows/dependabump/README.md b/workflows/reusable-dependabump/README.md similarity index 73% rename from workflows/dependabump/README.md rename to workflows/reusable-dependabump/README.md index 63cbbcee9..8bd03ce76 100644 --- a/workflows/dependabump/README.md +++ b/workflows/reusable-dependabump/README.md @@ -1,18 +1,21 @@ # Dependabump -This workflow inspects dependenabot vulnerabilities, and opens pull requests to update dependencies. +This workflow inspects dependenabot vulnerabilities, and opens pull requests to +update dependencies. ## Recommended usage + Example workflow: + ```yaml name: dependabump on: workflow_dispatch: schedule: - - cron: '0 0 * * 1-5' # every week-day at midnight + - cron: "0 0 * * 1-5" # every week-day at midnight -permissions: { } +permissions: {} jobs: dependabump: @@ -22,9 +25,8 @@ jobs: actions: read security-events: read vulnerability-alerts: read - uses: smartcontractkit/.github/workflows/dependabump.yml@main + uses: smartcontractkit/.github/workflows/reusable-dependabump.yml@main secrets: SLACK_TOKEN: ${{ secrets.DEPENDABUMP_SLACK_API_KEY }} SLACK_CHANNEL_ID: ${{ secrets.DEPENDABUMP_SLACK_CHANNEL_ID }} - ``` diff --git a/workflows/dependabump/package.json b/workflows/reusable-dependabump/package.json similarity index 84% rename from workflows/dependabump/package.json rename to workflows/reusable-dependabump/package.json index 4485d346a..c58c77bec 100644 --- a/workflows/dependabump/package.json +++ b/workflows/reusable-dependabump/package.json @@ -1,5 +1,5 @@ { - "name": "dependabump", + "name": "reusable-dependabump", "version": "0.0.0", "description": "", "private": true, diff --git a/workflows/dependabump/dependabump.yml b/workflows/reusable-dependabump/reusable-dependabump.yml similarity index 99% rename from workflows/dependabump/dependabump.yml rename to workflows/reusable-dependabump/reusable-dependabump.yml index 0c0b7f87b..3a4c6582a 100644 --- a/workflows/dependabump/dependabump.yml +++ b/workflows/reusable-dependabump/reusable-dependabump.yml @@ -31,7 +31,7 @@ jobs: GH_TOKEN: ${{ github.token }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Go uses: actions/setup-go@v7