potiuk opened a new pull request, #45:
URL: https://github.com/apache/airflow-site-archive/pull/45
Dependabot clones the whole repository before its file fetcher runs. At 826k
files and 47 GB that never finishes inside a Dependabot job, so the runs
time out
and pinned actions and pre-commit hooks fall behind — only one Dependabot PR
has
landed here since April, while `actions/checkout` went v6 → v7 and `zizmor`
went
1.24 → 1.29 unnoticed.
Nothing in `dependabot.yml` avoids that clone, so this replaces it with a
workflow
that only ever needs the configuration files.
* **`.github/workflows/update-pinned-deps.yml`** — weekly (and on demand),
once per
target branch (`main`, `staging`), on a sparse **blobless** checkout of
`.github`.
Seconds instead of a timeout.
* **`scripts/update_pinned_deps.py`** — resolves every SHA-pinned action and
pre-commit hook to the newest release outside a **7-day cooldown** (the
same
cooldown the Dependabot config used), rewrites the pins in place and
preserves
the `# vX.Y.Z` / `# frozen: vX.Y.Z` style. Branch pins such as `# main`
move
along their branch, also respecting the cooldown.
Notes:
* Releases are preferred over tags, so drafts, prereleases and moving major
tags
(`v7`) are never picked; repos without releases fall back to tags dated by
commit.
* Pull requests opened with `GITHUB_TOKEN` do not trigger other workflows,
so the
workflow runs `pre-commit` on the changed files itself before opening the
PR.
It runs on the changed files only — `--all-files` would walk all 826k
paths.
* Dependabot **security alerts are unaffected** — those do not come from
`dependabot.yml`.
* Verified by running the script against a copy of `main`'s configuration: it
produced byte-identical output to the hand-written #44, and a second pass
is a
no-op.
* If the `apache` org has "Allow GitHub Actions to create and approve pull
requests" disabled, the `gh pr create` step will fail loudly on the first
scheduled run — the update branch is still pushed, so the PR can be opened
by
hand and the setting flipped.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
