chore: bump erlef/setup-beam from 1.24.0 to 1.24.1#63
Conversation
dependabot
Bot
added
dependencies
6a41ed6 to
0303cf1
Compare
|
Blocked. We need to request an approval for the version. |
|
@kou, is there any way to configure dependabot updates to respect the ASF allowlist? This PR silently breaks the Erlang and Documentation CIs. |
Regarding an approval, see also erlef/setup-beam#456 and apache/infrastructure-actions#751. |
It seems that they are for 1.24.0 not 1.24.1. |
The point I was trying to make was that it may take a while before a new version is approved until the ASF's verification concerns are addressed, so we may be stuck on |
|
Have you opened a PR for 1.24.1 to https://github.com/apache/infrastructure-actions ? |
From what I understand, the decision in apache/infrastructure-actions#751 was that |
|
Ah, I understand. What can we do to solve erlef/setup-beam#456 ? |
|
Nothing much. I suspect that solving that issue will require upstream changes in how languages like Elixir or Erlang/OTP itself publish and sign releases. We'll probably have to wait it out before we can upgrade. |
## What issue does this PR close? Closes #70. Dependabot updates do not respect the ASF allowlist. Thus, some dependabot PRs can silently break workflows as seen in #63. ## What's changed A workflow to perform to ASF allowlist checks on changes to `.github` has been added. Any breakages introduced by dependabot updates (or any other changes) will be highlighted. Copied verbatim from https://github.com/apache/arrow-adbc/blob/main/.github/workflows/asf-allowlist-check.yml.
244c047 to
a69f786
Compare
Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.24.0 to 1.24.1. - [Release notes](https://github.com/erlef/setup-beam/releases) - [Commits](erlef/setup-beam@fc68ffb...54075bc) --- updated-dependencies: - dependency-name: erlef/setup-beam dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
a69f786 to
3b95e42
Compare
|
1.24.1 is allowed: apache/infrastructure-actions#981 |
2 participants
Bumps erlef/setup-beam from 1.24.0 to 1.24.1.
Release notes
Sourced from erlef/setup-beam's releases.
Commits
54075bcAutomation: update setup-beam version output to ea45c80ea45c80Remove lodash Dependency (#457)b4b8d85Automation: update setup-beam version output to 20df79420df794Bump globals from 17.4.0 to 17.7.0 (#452)9d5c5caAutomation: update setup-beam version output to ad42943ad42943Bump prettier from 3.8.1 to 3.9.1 (#454)135c095Automation: update setup-beam version output to a04cfbba04cfbbBump eslint from 10.1.0 to 10.6.0 (#453)cd1472fAutomation: update setup-beam version output to c80fdc9c80fdc9Bump actions/checkout from 6.0.2 to 7.0.0 (#467)