Bump trunk-io/trunk-action from 1.3.1 to 2.0.0 - #62
Conversation
dependabot
Bot
added
the
dependencies
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 | ||
| - name: Trunk Check | ||
| uses: trunk-io/trunk-action@04ba50e7658c81db7356da96657e6e77f220bfa3 # v1.3.1 | ||
| uses: trunk-io/trunk-action@e1234e67a86010d61ddac8d8ebf4b783e2ffd2fa # v2.0.0 |
There was a problem hiding this comment.
The bump self-verifies, since on: pull_request runs this branch's own workflow file and Trunk Check passed at v2.0.0. Pinned by SHA with the version comment moved, which matches the rest of the file.
One follow-on the diff creates: the release note says the major is a major precisely because "the check annotation service from Trunk is no longer offered", and the checks: write grant at line 15 of this file is justified by the comment # For trunk to post annotations. After this bump, that permission is for a capability the action no longer has. Worth dropping it in the same PR, so the file does not carry a write permission with a stale reason next to it. The job keeps contents: read and the top-level permissions: read-all stays as is.
Also note the branch is 22 commits behind main; harmless for a one-line workflow change, and dependabot will rebase on request.
Bumps [trunk-io/trunk-action](https://github.com/trunk-io/trunk-action) from 1.3.1 to 2.0.0. - [Release notes](https://github.com/trunk-io/trunk-action/releases) - [Commits](trunk-io/trunk-action@04ba50e...e1234e6) --- updated-dependencies: - dependency-name: trunk-io/trunk-action dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
077fd9b to
6fe1714
Compare
1 participant
Bumps trunk-io/trunk-action from 1.3.1 to 2.0.0.
Release notes
Sourced from trunk-io/trunk-action's releases.
Commits
e1234e6Harden composite action auth and stop persisting checkout credentials (#298)c146ebeRemove defunct CheckService annotation path (#297)