chore(deps): bump actions/github-script from 7 to 8#27
Conversation
Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 8. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v7...v8) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| - name: Create deployment record | ||
| if: success() | ||
| uses: actions/github-script@v7 | ||
| uses: actions/github-script@v8 | ||
| with: | ||
| script: | | ||
| await github.rest.repos.createDeploymentStatus({ |
There was a problem hiding this comment.
Bug: The workflow incorrectly uses a hardcoded fallback deployment_id: 1 for creating a deployment status, because context.payload.deployment is unavailable, causing the step to fail.
Severity: HIGH
Suggested Fix
Instead of relying on context.payload.deployment, first create a deployment using github.rest.repos.createDeployment and store its ID. Then, use that stored ID in the subsequent createDeploymentStatus call to correctly report the deployment's status. This ensures the status update is linked to the actual deployment created by the workflow.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/ci-cd.yml#L146-L151
Potential issue: In the `ci-cd.yml` workflow, the "Create deployment record" step
attempts to create a deployment status using `github.rest.repos.createDeploymentStatus`.
The `deployment_id` is sourced from `context.payload.deployment?.id`, with a fallback to
`1`. However, this workflow is triggered by `push` and `pull_request` events, not
`deployment` events, so `context.payload.deployment` will always be `undefined`.
Consequently, the script will always attempt to update a deployment with the hardcoded
ID `1`. This will cause the API call to fail with a "Not Found" error, as no
corresponding deployment was created. This failure will incorrectly mark the entire
workflow as failed, even if the actual deployment was successful, causing confusion
about the deployment's true status.
Did we get this right? 👍 / 👎 to inform future reviews.
Bumps actions/github-script from 7 to 8.
Release notes
Sourced from actions/github-script's releases.
... (truncated)
Commits
ed59741Merge pull request #653 from actions/sneha-krip/readme-for-v82dc352eBold minimum Actions Runner version in README01e118cUpdate README for Node 24 runtime requirements8b222acApply suggestion from@salmanmkcadc0eeaREADME for updating actions/github-script from v7 to v820fe497Merge pull request #637 from actions/node24e7b7f22update licenses2c81ba0Update Node.js version support to 24.xDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)