Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(github-action)!: Update lycheeverse/lychee-action action to v2.1.0 #389

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Oct 12, 2024

This PR contains the following updates:

Package Type Update Change
lycheeverse/lychee-action action major v1.10.0 -> v2.1.0

Release Notes

lycheeverse/lychee-action (lycheeverse/lychee-action)

v2.1.0: Version 2.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: lycheeverse/lychee-action@v2...v2.1.0

v2.0.2: Version 2.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: lycheeverse/lychee-action@v2...v2.0.2

v2.0.1: Version 2.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: lycheeverse/lychee-action@v2...v2.0.1

v2.0.0: Version 2.0.0

Compare Source

Breaking Changes

Note: This release improves the action's robustness by changing default behaviors. Changes are only required if you want to opt out of the new failure conditions. Most users won't need to modify their existing configurations.

Fail pipeline on error by default

We've changed the default behavior: pipelines will now fail on broken links automatically. This addresses user feedback that not failing on broken links was unexpected (see issue #​71).

What you need to do:

  • Update to version 2 of this action to apply this change.
  • Users of the lychee-action@master branch don't need to make any changes, as fail: true has been the default there for a while.
  • If you prefer the old behavior, explicitly set fail to false when updating:
- name: Link Checker
  id: lychee
  uses: lycheeverse/lychee-action@v2
  with:
    fail: false  # Don't fail action on broken links
Fail pipeline if no links were found

Similar to the above change, we now fail the pipeline if no links are found during a run. This helps warn users about potential configuration issues.

What you need to do:

  • If you expect links to be found in your pipeline run, you don't need to do anything.
  • If you expect no links in your pipeline run, you can opt out like this:
- name: Link Checker
  id: lychee
  uses: lycheeverse/lychee-action@v2
  with:
    failIfEmpty: false  # Don't fail action if no links were found

For a more detailed description of the technical aspects behind these changes, please see the full changelog below.

What's Changed

New Contributors

Full Changelog: lycheeverse/lychee-action@v1...v1.11.0


Configuration

📅 Schedule: Branch creation - "on saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@jsaveker
Copy link
Owner

Here is an automated review from ChatGPT of this pull request.

There were no direct security issues that could be identified from this specific git diff. This change simply updates the version of a GitHub Action (lycheeverse/lychee-action) from v1.10.0 to v2.0.1.

However, it's essential to consider the following best practices when making such updates to mitigate potential security risks:

  1. Review Changelog: Before updating any dependencies, especially actions used in CI/CD pipelines, review the changelog or release notes of the new version to ensure there are no breaking changes or newly introduced features that may alter the security posture of your workflow.

  2. Check the Source: Verify the source of the new version (2bb232618be239862e31382c5c0eaeba12e5e966) to ensure it's from the same, trusted maintainer or organization, and not from a fork that could potentially introduce malicious code.

  3. Least Privilege: The workflow uses a GITHUB_TOKEN which is automatically generated by GitHub for each run. Ensure that the token permissions are set to the minimum required for the task at hand to avoid excessive privileges that could be abused if the action or the repository is compromised.

  4. Regularly Update Actions: Continuous updating of actions like these is good practice to ensure that you benefit from the latest features, bug fixes, and security patches. Always ensure that updates are tested in a controlled environment before being merged into your main branch to minimize potential disruptions.

Given the context provided, there is no need for a specific fix related to the changes in the git diff. However, adhering to the best practices mentioned above will help maintain the security and reliability of your CI/CD pipeline.

@renovate renovate bot changed the title feat(github-action)!: Update lycheeverse/lychee-action action to v2.0.1 feat(github-action)!: Update lycheeverse/lychee-action action to v2.0.2 Oct 14, 2024
@renovate renovate bot force-pushed the renovate/lycheeverse-lychee-action-2.x branch from 13407c7 to 6e76c4b Compare October 14, 2024 10:36
@renovate renovate bot changed the title feat(github-action)!: Update lycheeverse/lychee-action action to v2.0.2 feat(github-action)!: Update lycheeverse/lychee-action action to v2.1.0 Nov 7, 2024
@renovate renovate bot force-pushed the renovate/lycheeverse-lychee-action-2.x branch from 6e76c4b to 375bdc8 Compare November 7, 2024 16:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant