Repository navigation
build(deps): bump docker/login-action from 4.6.0 to 4.7.0 - #14338
hivecommons-hive[bot] merged 2 commits into
Conversation
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.6.0 to 4.7.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@dbcb813...81c6f93) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Open PR overlap checkBase branch: Conflicts are checked with every PR merged onto the current tip of No conflicting open PRs or same-file overlaps were found. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubestellar-prow
Bot
added
the
dco-signoff: yes
kubestellar-prow
Bot
added
the
size/M
hivecommons-hive
Bot
added
dco
05b996b
ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blockedHive flagged this PR (author @dependabot[bot], head
Hive did not add the |
|
🐝 Hive Agent: — hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88 |
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
There was a problem hiding this comment.
Decision needed: @clubanderson should decide whether to merge this workflow-pin bump of docker/login-action to v4.7.0 (SHA 81c6f93d) once the unrelated gh=2.102.0 apt pin in src/Dockerfile is fixed on v5, or hold it.
Routing to a human because this edits six .github/workflows/* files; the change itself is a pure pin bump.
What changed (verified): every hunk in ci-runner-image.yml, docker.yml, pr-verifier.yml, promote-stable.yml, tagged-release.yml and v2-ci.yml is the same one-line replacement — docker/login-action@dbcb8138… # v4.6.0 → docker/login-action@81c6f93d… # v4.7.0. No step inputs, permissions, triggers or secrets references change. Author is dependabot[bot]. I did not independently resolve the new SHA against the upstream tag; please check that 81c6f93d4bc991e510b342a00b419b3bb4efc5c6 is the v4.7.0 tag before merging.
The red check is not this PR's fault. Build (PR gate, no push) (run 40261542816) fails inside the image build's apt step with E: Version '2.102.0' for 'gh' was not found — the GITHUB_CLI_VERSION pin in the Dockerfile is no longer served by the GitHub CLI apt repo. That step runs before any docker/login-action use and will fail identically on base v5; the Dockerfile pin needs its own fix (and that file is CODEOWNERS-gated). The cancelled "Sign-off survives the squash" runs are dependabot re-pushes, not failures.
— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88
|
@dependabot rebase #14341 (gh 2.103.2 pin) has merged to 🐝 Hive Agent: — hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88 |
|
Sorry, only users with push access can use that command. |
|
hive/awaiting-ci: the only red check ( 🐝 Hive Agent: — hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88 |
|
@dependabot rebase Build (PR gate, no push) failed only because the branch predates v5's bump of the ci-runners gh pin to 2.103.2 (2.102.0 is no longer served by the apt repo); the PR's own diff is fine. 🐝 Hive Agent: — hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88 |
|
Sorry, only users with push access can use that command. |
hivecommons-hive
Bot
added
stage/050-review-pending
d170b9f
ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blockedHive flagged this PR (author @dependabot[bot], head
Hive did not add the |
There was a problem hiding this comment.
Decision needed: @clubanderson should decide whether this workflow action bump (docker/login-action v4.6.0 → v4.7.0, 16 sites in .github/workflows) may land.
Routing to a human because this edits .github/workflows/* — a trust surface the hive does not sign off on its own. The change itself checks out:
.github/workflows/ci-runner-image.ymland.github/workflows/docker.yml: all 16docker/login-actioncall sites move fromdbcb8138…(# v4.6.0) to81c6f93d…(# v4.7.0). No other lines change;with:blocks,if:guards and registries are untouched.- I resolved
refs/tags/v4.7.0indocker/login-actionto commit81c6f93d4bc991e510b342a00b419b3bb4efc5c6, so the pinned SHA matches the tag in the comment — this is a genuine upstream release, not a stray commit. - The
action pins resolvecheck is green on this head, and thecopilot/dependencieslabels and dependabot author are consistent with the routine update cadence onv5.
Nothing here grants new permissions or changes what the login steps authenticate against. Looks correct to me; the decision to land a workflow change is yours.
— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88
There was a problem hiding this comment.
Decision needed: @clubanderson should confirm this workflow-only bump of docker/login-action to v4.7.0 (pin verified against upstream) can merge once CI finishes.
Conclusion: the change looks correct to me; routing to a maintainer only because it edits .github/workflows/*, which the hive treats as a trust surface it does not self-approve.
What I verified:
- The diff is 16 identical one-line swaps across
ci-runner-image.yml,docker.yml,pr-verifier.yml,promote-stable.yml,tagged-release.yml,v2-ci.yml:docker/login-action@dbcb8138… # v4.6.0→docker/login-action@81c6f93d… # v4.7.0. Nopermissions:,on:, secrets, or step inputs change. gh api repos/docker/login-action/git/ref/tags/v4.7.0resolves to commit81c6f93d4bc991e510b342a00b419b3bb4efc5c6— the pinned SHA matches the upstream tag exactly.- Checks: everything that has finished is green;
build (linux/arm64, …)andtideare still running at the time of this review. The earlierSign-off survives the squashrun shows CANCELLED, which looks like a superseded run rather than a failure — worth a glance before merge.
— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88
hivecommons-hive
Bot
added
stage/085-needs-decision
|
Needs a decision, not a merge:
Head: verdict requires_human @d170b9f, 55/56 checks green, 1 pending, DCO yes, soak 0s of 30m0s. What to do: approve this head ( How to release it:
Clear the cause and the hive re-evaluates on its next pass; the stage moves to |
|
Needs a decision, not a merge:
Head: verdict requires_human @d170b9f, 55/56 checks green, 1 pending, DCO yes, soak 0s of 30m0s. What to do: approve this head ( How to release it:
Clear the cause and the hive re-evaluates on its next pass; the stage moves to |
clubanderson
left a comment
clubanderson
left a comment
There was a problem hiding this comment.
Workflow-only docker/login-action 4.6.0→4.7.0, pin verified against upstream. Intended — merge when CI finishes.
|
/hive approve |
|
LGTM label has been added. DetailsGit tree hash: e9a229edde0e8af2f58da805ec439e040fe3f544 |
hivecommons-hive
Bot
added
stage/050-review-pending
|
Thank you for your contribution! Your PR has been merged. We'd love to hear how your experience was: share feedback |
hivecommons-hive
Bot
removed
role/trusted
Bumps docker/login-action from 4.6.0 to 4.7.0.
Release notes
Sourced from docker/login-action's releases.
Commits
81c6f93Merge pull request #1100 from docker/dependabot/npm_and_yarn/docker/actions-t...1b16c8dMerge pull request #1096 from docker/dependabot/npm_and_yarn/uuid-14.0.3ac86b5e[dependabot skip] chore: update generated content1476d84build(deps): bump@docker/actions-toolkitfrom 0.94.0 to 0.107.0503cee6Merge pull request #1095 from docker/dependabot/github_actions/actions/create...f093535Merge pull request #1099 from docker/dependabot/github_actions/codecov/codeco...d5ae7f1Merge pull request #1098 from docker/dependabot/github_actions/docker/bake-ac...6f97507Merge pull request #1097 from docker/dependabot/github_actions/docker/bake-ac...006d61fMerge pull request #1094 from docker/dependabot/github_actions/codeql-actions...93f5f52Merge pull request #1093 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)