ci(deps): bump 5 GitHub Actions to current SHAs (consolidates Dependabot #78–#82)#84
Merged
Merged
Conversation
Consolidates the five open Dependabot github-actions PRs onto current main. Each was opened ~5 weeks ago and shows stale failing CI from a since-fixed base-main issue (the target/duckdb-download cache handling, commit 458ec31); the bumps themselves are inert workflow-only changes and pass on the v0.9.0 main. SHAs are taken verbatim from the corresponding Dependabot PR diffs, with version comments updated to match. - github/codeql-action 4.35.4 -> 4.36.2 (supersedes #82) - actions/checkout 6.0.2 -> 6.0.3 (supersedes #81) - codecov/codecov-action 6.0.0 -> 7.0.0 (supersedes #80) - EmbarkStudios/cargo-deny-action 2.0.18 -> 2.0.20 (supersedes #79) - taiki-e/install-action 2.77.6 -> 2.81.11 (supersedes #78) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KtQVSn8MZwxq6vJkLoS83a
The Test (cross-platform), Benchmarks compile, and Coverage jobs link the
DuckDB library, and on cache-hit runs they failed with:
rust-lld: error: unable to find library -lduckdb
-L .../target/duckdb-download/<triple>/1.5.4
rust-cache restored the libduckdb-sys build-script fingerprint (so the
build script skips the download) while pruning the actual libduckdb under
target/duckdb-download — the exact stranding the cache-directories comment
warns about. Check/Clippy/Doc type-check without linking, so they were
unaffected; the plain Test job hit a good cache and passed. The poison is
per-job (likely a concurrency-cancelled run saving a partial cache).
Bump the rust-cache prefix-key v0-rust -> v1-rust so every job starts from
a cold key: the fresh libduckdb download repopulates target/duckdb-download
and the new caches are saved intact. Unrelated to the Actions-version bumps
in this PR — those are inert workflow-only changes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtQVSn8MZwxq6vJkLoS83a
This was referenced Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the five open Dependabot
github-actionsPRs (#78–#82) into a single change on currentmain. Each Dependabot PR was opened ~5 weeks ago and shows stale failing CI — but the failures are from the basemainat that time (a since-fixedtarget/duckdb-downloadcache issue, commit458ec31), not the action bumps: e.g. #82 only touchescodeql-actionyet itsTest/Benchmarksjobs failed, which that action can't affect. Rebased onto the v0.9.0main, these inert workflow-only SHA swaps pass.Doing this before the
v0.9.0release so the repo ships with all dependencies (Cargo and Actions) current and no open Dependabot PRs.Changes
github/codeql-actionactions/checkoutcodecov/codecov-actionEmbarkStudios/cargo-deny-actiontaiki-e/install-actionEach SHA is taken verbatim from the corresponding Dependabot PR diff, with the
# vX.Y.Zpin comment updated to match. 26checkoutoccurrences across 6 workflow files,codeql-action×3 (init/autobuild/analyze),install-action×2, the rest ×1. No other pins changed.Type of Change
Testing
Workflow-file-only change — no Rust source touched, so runtime behavior is identical to
main(already validated at v0.9.0). Verification done here:yaml.safe_load)v6.0.2/etc. references remaincodeql-action,checkout,cargo-deny-action,install-action;codecov-actionruns in the informational,continue-on-errorCoverage job)Documentation
Related Issues
Supersedes #78, #79, #80, #81, #82 — those Dependabot PRs will be closed once this merges.
Notes
codecov/codecov-actionis a major bump (6→7); it runs only in theCoveragejob, which iscontinue-on-error: trueand excluded from the requiredCI Gate, so it cannot block the merge even if the v7 interface shifted. After merge I'll close the five superseded Dependabot PRs with a pointer here.🤖 Generated with Claude Code
https://claude.ai/code/session_01KtQVSn8MZwxq6vJkLoS83a
Generated by Claude Code