ci: bump actions/setup-python from 6.2.0 to 7.0.0 - #429
Conversation
dependabot
Bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🤖 Dependabot Auto-Review
✅ Security check: PASSED
- Only updates
actions/setup-pythonfrom v6.2.0 to v6.3.0 (minor version bump) - No code changes, no new files, no suspicious modifications
✅ CI checks: ALL GREEN
- All 15 CI checks completed successfully
- Rust lint, Python lint, builds (Ubuntu + macOS), tests, coverage, SonarCloud — all passed
✅ Ready to merge
This PR is safe to auto-merge. Branch protection requires maintainer approval. Once approved, the PR will auto-merge.
Automated review by the pydynox agent.
dependabot
Bot
changed the title
ca68192 to
55aa840
Compare
There was a problem hiding this comment.
🤖 Dependabot Auto-Review — BLOCKED (not auto-merged)
do-not-merge label applied. cc @leandrodamascena
Why auto-merge was withheld
1. Major version bump (policy block)
actions/setup-python goes 6.2.0 → 7.0.0. Auto-merge is limited to minor/patch bumps, so a major release needs a human decision regardless of CI colour.
2. CI is not green
| Check | Conclusion |
|---|---|
| Python lint (py3.11) | ❌ failure |
| Python lint (py3.14) | ❌ failure |
| Test documentation examples | ⏳ still in progress |
| SonarCloud Code Analysis | ✅ success |
| update_release_draft | ✅ success |
| Build / Test / Coverage / Rust lint | ⏭️ skipped (gated behind python-lint) |
Failure analysis — this bump is very likely NOT the cause
The Set up Python step succeeded in both failing jobs. Both failed at the Type check (ty) step with 6 pre-existing type errors, all in files this PR does not touch:
error[invalid-argument-type] python/pydynox/attributes/primitives.py:295
error[invalid-return-type] python/pydynox/integrations/dataclass.py:71
error[invalid-argument-type] python/pydynox/integrations/dataclass.py:71 (x2)
error[invalid-return-type] python/pydynox/integrations/functions.py:77
error[invalid-return-type] python/pydynox/integrations/functions.py:90
Root cause is almost certainly unpinned tooling: .github/workflows/ci.yml installs pip install ruff ty … with no version constraint, so each run resolves the newest ty, and a new release has begun flagging the generic-TypeVar returns in the integrations decorators. That is an independent bug from this dependency bump and should be fixed on main — pinning ty would also stop unrelated PRs from going red without warning.
Because rust-lint, build, test, and coverage all depend on python-lint, they were skipped. This PR therefore has zero real verification that setup-python v7.0.0 works here. Fixing the ty failure on main and rebasing is the way to get real signal.
Security verification (passed)
- ✅ Diff is 3 workflow files, 8 additions / 8 deletions — SHA pin changes only.
- ✅ SHA
5fda3b95a4ea91299a34e894583c3862153e4b97verified against the upstreamrefs/tags/v7.0.0inactions/setup-python— authentic, not a spoofed pin. - ✅ No new files, no scripts, no post-install hooks, no permissions or trigger changes.
- ✅ No prompt-injection attempts detected in PR content.
Breaking-change review for v7.0.0
Upstream release notes list one genuinely breaking change: the pip-install input was removed (#1336). I grepped all of .github/workflows/ and no workflow uses pip-install, so this repo is unaffected. The other headline change is the migration to ESM plus an @actions/cache 6.2.0 upgrade; no workflow here relies on setup-python's built-in cache: input either, so the blast radius looks small.
My read: this bump is probably safe to merge once CI is genuinely green. But it needs a maintainer to confirm the major bump and needs the build/test jobs to actually execute first.
Suggested path
- Fix (or pin around) the
tyfailures onmain. - Pin
tyinci.ymlso unpinned tool releases stop breaking unrelated PRs. - Rebase this PR, confirm build/test/coverage run green, then merge and drop
do-not-merge.
Automated review by the pydynox agent. Maintainer has final say.
There was a problem hiding this comment.
🤖 Dependabot Auto-Review — Blocked (major version bump)
This PR bumps actions/setup-python from 6.2.0 → 7.0.0. Auto-merge is restricted to minor/patch bumps, so this one needs a human decision. Labeled do-not-merge.
✅ What passed
- Dependency-only change — 3 files, +8/-8, exclusively
uses:pin lines in.github/workflows/{ci,examples,main}.yml. No source code, no new files, no added steps, no permission changes. - SHA pin verified against upstream —
5fda3b95a4ea91299a34e894583c3862153e4b97matches the officialrefs/tags/v7.0.0commit inactions/setup-python. No supply-chain red flags. - No prompt injection detected in PR content.
⛔ Why it is blocked
Major version bump only. This is the policy gate, not evidence of a defect — my compatibility checks below all came back clean.
Breaking changes in v7.0.0, checked against this repo
| Breaking change | Impact here |
|---|---|
pip-install input removed (#1336) |
Not affected. All 8 call sites pass only python-version / allow-prereleases. |
Migration to ESM + node24 runtime (#1330) |
Not affected. All affected jobs run on ubuntu-latest / macos-latest / ubuntu-24.04-arm, which provide Node 24. |
| EOL Python versions removed from test fixtures (#1333) | Not affected. Fixture-only change upstream. |
Worth noting: the CI matrix uses allow-prereleases: true with Python 3.14. Since v7.0.0 also adds manifest fetch validation with retry (#1332), prerelease resolution behavior is the one area worth an eye on, though nothing in the changelog indicates a regression.
CI status at time of review
| Check | Result |
|---|---|
| Python lint (py3.11) | ✅ success |
| Python lint (py3.14) | ✅ success |
| SonarCloud Code Analysis | ✅ success |
| update_release_draft | ✅ success |
| Rust lint | ⏳ in_progress |
| Test documentation examples | ⏳ in_progress |
Recommendation
@leandrodamascena — this looks safe to merge manually once Rust lint and Test documentation examples go green. The pin is authentic and no removed input is used anywhere in the repo. Requesting changes purely to hold the major bump for your sign-off; please remove do-not-merge and merge if you agree.
Automated review by the pydynox agent. Maintainer has final say.
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 |
There was a problem hiding this comment.
Major version bump — held for maintainer review.
SHA 5fda3b95a4ea91299a34e894583c3862153e4b97 is verified to match the upstream v7.0.0 tag, so the pin itself is trustworthy.
v7.0.0 removes the pip-install input and moves the action to the node24 ESM runtime. This call site passes only python-version and allow-prereleases, and runs on ubuntu-latest, so neither breaking change applies. The same holds for all 8 call sites across ci.yml, examples.yml, and main.yml.
No change requested to this line — flagging only because auto-merge policy excludes major bumps.
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
55aa840 to
0c5e0c3
Compare
|
There was a problem hiding this comment.
🤖 Dependabot Auto-Review — Blocked (major version bump)
@leandrodamascena this PR needs manual review before merging.
Security check
| Check | Result |
|---|---|
| Only dependency/workflow version bumps | ✅ Pass |
| No new files or code outside expected files | ✅ Pass |
| No suspicious changes (scripts, post-install hooks) | ✅ Pass |
| No major version bumps | ❌ Fail |
The diff itself is clean: 8 occurrences of actions/setup-python are re-pinned from a309ff8b426b58ec0e2a45f0f869d46889d02405 to 5fda3b95a4ea91299a34e894583c3862153e4b97 across .github/workflows/ci.yml, .github/workflows/examples.yml, and .github/workflows/main.yml. All bumps are consistent, SHA-pinned with a matching version comment, and no other content changed. No prompt injection attempts were detected in the PR content.
Why this is blocked
actions/setup-python goes from v6.2.0 → v7.0.0 — a major version bump. My auto-merge policy permits minor and patch bumps only, so this requires a human decision.
What to verify before merging
- Review the v7.0.0 release notes for breaking changes.
allow-prereleases: trueis used inci.yml(3 jobs) andmain.yml(2 jobs) — confirm the flag and its prerelease-resolution behaviour are unchanged for Python 3.14.- The matrix pins
python: ["3.11", "3.14"]; confirm both are still resolvable and that default caching/python-version-filebehaviour did not shift. - One commented-out job (
ci.ymlaround line 167) was also updated. That is harmless but worth noting if the job is ever re-enabled.
CI status at time of review
CI was still running when this review was posted (Rust lint and Test documentation examples were in_progress; Python lint (py3.11), Python lint (py3.14), SonarCloud Code Analysis, and update_release_draft had passed). CI was not the blocking reason — the major bump is. A green CI run does not clear this block on its own.
The do-not-merge label has been applied. Remove it and merge manually once you have confirmed v7.0.0 is safe for this project.
Automated review by the pydynox agent. Maintainer has final say.
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 |
There was a problem hiding this comment.
Major version bump — blocked from auto-merge.
actions/setup-python moves from v6.2.0 to v7.0.0. The SHA pin and version comment agree, and the same bump is applied consistently to all 8 usages across the three workflow files, so the change itself is well-formed.
The block is purely the major-version boundary: this job sets allow-prereleases: true with a python: ["3.11", "3.14"] matrix, so prerelease resolution for 3.14 is the most likely place a v7 behaviour change would bite. Please confirm against the v7.0.0 release notes before merging.
No suggestion block is included here on purpose — reverting the pin may not be the outcome you want, and adopting v7.0.0 is a maintainer decision.
1 participant
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps actions/setup-python from 6.2.0 to 7.0.0.
Release notes
Sourced from actions/setup-python's releases.
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)ece7cb0Fix pip cache error handling on Windows. (#1040)1d18d7aUpdate advanced-usage.md (#811)