Skip to content

ci: bump the actions-minor-patch group across 1 directory with 2 updates - #1521

Closed
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/actions-minor-patch-15b9956dc9
Closed

ci: bump the actions-minor-patch group across 1 directory with 2 updates#1521
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/github_actions/actions-minor-patch-15b9956dc9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions-minor-patch group with 2 updates in the / directory: dtolnay/rust-toolchain and pypa/gh-action-pypi-publish.

Updates dtolnay/rust-toolchain from 1.96.0 to 1.100.0

Commits

Updates pypa/gh-action-pypi-publish from 1.13.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • cef2210 Merge pull request #397 from whitequark/patch-1
  • b4595e2 Enable verbose and print-hash by default.
  • e2bab26 Merge pull request #395 from him2him2/docs/fix-typos-and-grammar
  • 7495c38 docs: fix typos and grammar in README and SECURITY
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 28, 2026
@github-actions github-actions Bot added the status: ci failing Required or reported CI checks are failing label Jun 28, 2026
JerrettDavis
JerrettDavis requested changes Jun 29, 2026
View reviewed changes

@JerrettDavis JerrettDavis left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting changes because this is not just the Dependabot commitlint failure: the CI build-wheel and build jobs also failed after the workflow action bumps. The diff itself is small, but we should not merge a workflow/toolchain update while the affected build path is red. Please either adjust the action versions to ones that keep the CI build path green or split the Rust toolchain and PyPI publish action bumps so the failing update is isolated.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-15b9956dc9 branch from 293e3ea to ec0eae8 Compare July 2, 2026 07:27
JerrettDavis
JerrettDavis requested changes Jul 2, 2026
View reviewed changes

@JerrettDavis JerrettDavis left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow action bump is still not merge-ready. The latest run still has a failing commitlint check for the Dependabot commit title, and the CI build-wheel and build jobs are also failing on this head.

Because this PR changes CI/release workflow actions, it needs the affected build path green before merging. Please either choose action versions that keep the CI build jobs passing, or split the Rust toolchain and PyPI publish action updates so the failing update is isolated.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-15b9956dc9 branch from ec0eae8 to 3d1565b Compare July 9, 2026 07:27
@github-actions github-actions Bot added status: ci failing Required or reported CI checks are failing and removed status: ci failing Required or reported CI checks are failing labels Jul 9, 2026
@JerrettDavis

JerrettDavis commented Jul 9, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-15b9956dc9 branch from 3d1565b to 395a6d5 Compare July 9, 2026 16:14
@JerrettDavis
JerrettDavis force-pushed the dependabot/github_actions/actions-minor-patch-15b9956dc9 branch from 395a6d5 to 56f3845 Compare July 9, 2026 18:08
@JerrettDavis JerrettDavis changed the title ci: bump the actions-minor-patch group across 1 directory with 2 updates ci(deps): bump PyPI publish action to v1.14.0 Jul 9, 2026
JerrettDavis
JerrettDavis approved these changes Jul 9, 2026
View reviewed changes

@JerrettDavis JerrettDavis left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed the refreshed diff after narrowing this PR to the valid pypa/gh-action-pypi-publish v1.14.0 update only. The invalid Rust toolchain pin was removed, and the amended commit message should satisfy commitlint.

Approving the workflow-only update; the fresh CI run is still queued on the new SHA.

@JerrettDavis JerrettDavis added status: ready for review Pull request body is complete and the author marked it ready for human review and removed status: ci failing Required or reported CI checks are failing labels Jul 9, 2026
@github-actions github-actions Bot added status: ci failing Required or reported CI checks are failing and removed status: ready for review Pull request body is complete and the author marked it ready for human review labels Jul 10, 2026
@JerrettDavis JerrettDavis added the status: needs author action Pull request body or readiness checklist still needs author updates label Jul 15, 2026
JerrettDavis
JerrettDavis requested changes Jul 15, 2026
View reviewed changes

@JerrettDavis JerrettDavis left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the rerun. I need to pull back my prior approval because the current head still leaves required CI red.

The remaining failure is test (4), and it fails before pytest starts while trying to download the headroom-wheel artifact:

Unable to download artifact(s): Artifact not found for name: headroom-wheel

That means the workflow graph/artifact naming is still incompatible with the updated publish-action path. Please adjust the workflow so the build-wheel artifact uploaded by this run is available under the headroom-wheel name before the test shards download it, then rerun the full workflow.

@JerrettDavis

JerrettDavis commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@JerrettDavis

JerrettDavis commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@JerrettDavis

JerrettDavis commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot
ci: bump the actions-minor-patch group across 1 directory with 2 updates
af1635c 
Bumps the actions-minor-patch group with 2 updates in the / directory: [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) and [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish).


Updates `dtolnay/rust-toolchain` from 1.96.0 to 1.100.0
- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)
- [Commits](dtolnay/rust-toolchain@1.96.0...1.100.0)

Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@v1.13.0...v1.14.2)

---
updated-dependencies:
- dependency-name: dtolnay/rust-toolchain
  dependency-version: 1.100.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-patch
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title ci(deps): bump PyPI publish action to v1.14.0 ci: bump the actions-minor-patch group across 1 directory with 2 updates Aug 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-minor-patch-15b9956dc9 branch from 56f3845 to af1635c Compare August 14, 2026 04:06
@github-actions github-actions Bot removed the status: ci failing Required or reported CI checks are failing label Aug 14, 2026
@codecov-commenter

codecov-commenter commented Aug 14, 2026

Copy link
Copy Markdown

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@dependabot @github

dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-minor-patch-15b9956dc9 branch August 21, 2026 02:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JerrettDavis JerrettDavis JerrettDavis approved these changes
@chopratejas chopratejas Awaiting requested review from chopratejas chopratejas is a code owner
@DevanshiVyas DevanshiVyas Awaiting requested review from DevanshiVyas DevanshiVyas is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code status: code changes requested status: needs author action Pull request body or readiness checklist still needs author updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@JerrettDavis @codecov-commenter