mirror of
https://github.com/astral-sh/setup-uv.git
synced 2026-03-10 08:42:21 +00:00
2ff70eebcc
## Summary - keep the Dependabot build workflow single-job, but harden it a bit - replace `git-auto-commit-action` with explicit `git` commands and step-scoped push auth - add concurrency, a timeout, stricter Dependabot gating, and a guard for moved PR heads ## Why The workflow currently fails in the commit step because `actions/checkout` uses `persist-credentials: false`, but `git-auto-commit-action` later tries to push via `origin` without any credentials: ``` fatal: could not read Username for 'https://github.com': No such device or address ``` This change fixes that failure while keeping credentials scoped to the push step instead of persisting them for the whole job. ## Details - require `github.event.pull_request.user.login == 'dependabot[bot]'` - also require the PR head repo to match `github.repository` - also require the head ref to start with `dependabot/` - check out the exact PR head SHA - run `npm ci --ignore-scripts` - disable git hooks before commit - skip the dist commit if the PR head moved during the run ## Validation - `actionlint .github/workflows/dependabot-build.yml`