Skip to content

ci: fix dependabot PR failures & update workflow #1683

Open
antaripdebgupta wants to merge 2 commits intoruxailab:developfrom
antaripdebgupta:fix-issue-1681
Open

ci: fix dependabot PR failures & update workflow #1683
antaripdebgupta wants to merge 2 commits intoruxailab:developfrom
antaripdebgupta:fix-issue-1681

Conversation

@antaripdebgupta
Copy link
Contributor

@antaripdebgupta antaripdebgupta commented Feb 13, 2026

Changes

Bug Fix:

  • Replace full codebase testing with simple npm ci check for Dependabot PRs
  • Prevents blocking security updates due to unrelated code issues

Update Workflow:

  • Update actions: checkout@v3→v4, setup-python@v4→v5
  • Add explicit permissions blocks
  • Add timeout protection to audit step
  • Remove deprecated licenses (CC-BY, Python-2.0) from allowlist

Fixes: #1681

Testing

  • Workflows validated with action-validator
citest

@sonarqubecloud
Copy link

@github-actions github-actions bot added stale and removed stale labels Feb 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CI: broken dependency checks & update actions/permissions

1 participant