From bdc4881180b26f1542cec3e1861de7da3a1fb0b2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 Jun 2026 03:32:35 +0000 Subject: [PATCH 1/2] chore(deps): bump the github-actions group with 2 updates Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [CodSpeedHQ/action](https://github.com/codspeedhq/action). Updates `actions/checkout` from 6.0.3 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6.0.3...v7) Updates `CodSpeedHQ/action` from 4.17.5 to 4.17.6 - [Release notes](https://github.com/codspeedhq/action/releases) - [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codspeedhq/action/compare/c145068895e045cc725ee76fcd2307624b65c3af...63f3e98b61959fe67f146a3ff022e4136fe9bb9c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: CodSpeedHQ/action dependency-version: 4.17.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/codspeed.yml | 4 ++-- .github/workflows/main.yml | 6 +++--- .github/workflows/publish-package.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml index 99ce56f9..cb84416c 100644 --- a/.github/workflows/codspeed.yml +++ b/.github/workflows/codspeed.yml @@ -29,7 +29,7 @@ jobs: name: Run benchmarks runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.13" @@ -38,7 +38,7 @@ jobs: run: pip install -e .[test] - name: Run benchmarks - uses: CodSpeedHQ/action@c145068895e045cc725ee76fcd2307624b65c3af # v4.17.5 + uses: CodSpeedHQ/action@63f3e98b61959fe67f146a3ff022e4136fe9bb9c # v4.17.6 with: token: ${{ secrets.CODSPEED_TOKEN }} run: pytest tests/ --codspeed diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 2122b251..9f631b4a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -20,7 +20,7 @@ jobs: build: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.x' @@ -64,7 +64,7 @@ jobs: os: ['windows-latest', 'ubuntu-24.04', 'macos-latest'] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v6.0.3 + - uses: actions/checkout@v7.0.0 - uses: actions/setup-python@v6.2.0 with: python-version: ${{ matrix.py }} @@ -88,7 +88,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v6.0.3 + - uses: actions/checkout@v7.0.0 - uses: actions/setup-python@v6.2.0 with: python-version: "3.10" diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml index 17fad27b..ad2c33b1 100644 --- a/.github/workflows/publish-package.yml +++ b/.github/workflows/publish-package.yml @@ -14,7 +14,7 @@ jobs: publish: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # use fetch --all for setuptools_scm to work with: fetch-depth: 0 From 8ab4b11e2cc1dc240ca93b0e2a6cd7a8b9806849 Mon Sep 17 00:00:00 2001 From: shenxianpeng Date: Mon, 22 Jun 2026 23:37:59 +0300 Subject: [PATCH 2/2] fix: skip Codecov upload on Dependabot-triggered workflows --- .github/workflows/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9f631b4a..2e9fe0be 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -48,7 +48,9 @@ jobs: - name: Collect Coverage run: nox -s coverage - - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 + - name: Upload coverage to Codecov + if: github.actor != 'dependabot[bot]' + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage.xml