chore(deps): bump r-lib/actions/setup-pandoc from 2.12.1 to 2.13.0 - #89
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [r-lib/actions/setup-pandoc](https://github.com/r-lib/actions) from 2.12.1 to 2.13.0. - [Release notes](https://github.com/r-lib/actions/releases) - [Changelog](https://github.com/r-lib/actions/blob/v2-branch/NEWS.md) - [Commits](r-lib/actions@d3c5be5...465b7d8) --- updated-dependencies: - dependency-name: r-lib/actions/setup-pandoc dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
|
|
||
| - uses: r-lib/actions/setup-pandoc@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 | ||
| - uses: r-lib/actions/setup-pandoc@465b7d8e732ca3921382b1674c59bada9cbf3399 # v2 |
There was a problem hiding this comment.
📝 Info: Executable action payload is unchanged
The action metadata and executable bundle are byte-identical at both commits. This workflow’s Pandoc setup behavior remains unchanged.
Was this helpful? React with 👍 or 👎 to provide feedback.
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
The PR updates the pinned SHA for r-lib/actions/setup-pandoc from d3c5be51b12e724e68f33216ca3c148b66d5f0b6 to 465b7d8e732ca3921382b1674c59bada9cbf3399, corresponding to the v2 tag bump from 2.12.1 to 2.13.0. The prior review thread confirms the action metadata and executable bundle are byte-identical at both commits, so no behavioral change is introduced. The workflow remains valid YAML, permissions are unchanged (contents: read), and all other steps are untouched.
Reviewed changed lines
.github/workflows/R-CMD-check.yaml:37 (RIGHT): The setup-pandoc SHA is updated from d3c5be51b12e724e68f33216ca3c148b66d5f0b6 to 465b7d8e732ca3921382b1674c59bada9cbf3399. The new SHA resolves to the upstream r-lib/actions v2.13.0 tag, and prior review confirms byte-identical action metadata and executable bundle, so no functional change occurs.
Adversarial validation
.github/workflows/R-CMD-check.yaml:37 (RIGHT)falsified: The updated SHA might not resolve to the intended upstream tag or could introduce a supply-chain or behavioral change. — The SHA 465b7d8e732ca3921382b1674c59bada9cbf3399 corresponds to the v2.13.0 tag commit, and prior review threads state the action metadata and executable bundle are byte-identical at both commits..github/workflows/R-CMD-check.yaml:37 (RIGHT)falsified: The version bump could break compatibility with downstream steps that rely on setup-pandoc outputs or specific behavior. — setup-pandoc is invoked without inputs, its outputs are not consumed by downstream steps, and setup-r, setup-r-dependencies, and check-r-package remain pinned to compatible v2-era SHAs.- Residual risk: Negligible: the changed SHA resolves to the upstream v2.13.0 tag and the executable payload is byte-identical to the prior pinned commit.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
806ca9a67258244cf63c5668eaa5c1ad87ded8cc - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
seonghobae
added
maintenance
priority: medium
ChatGPT Codex Connector
|
Admission-state correction for exact head Finding: 1 substantive review thread remains unresolved despite current-head GREEN workflows and Noema approval. This PR remains Open and is moved to Draft/Proposed. Commits, reviews, threads, and valid delta are preserved. Return it to Ready only after causal repair and fresh exact-head evidence. No bypass, synthetic status/approval, manual rerun, Force Push, review dismissal, or Close is used. |
1 participant
Bumps r-lib/actions/setup-pandoc from 2.12.1 to 2.13.0.
Changelog
Sourced from r-lib/actions/setup-pandoc's changelog.
... (truncated)
Commits
465b7d8NEWS for 2.13.0 (#1105)d06a540[setup-r] retry transient r-hub.io request failures (#1088)ed9aa85fix(setup-r): export correct RTOOLS HOME env vars on Windows ARM64 and x64 (#...c86f32csetup-r-dependencies: set JAVA_HOME on Windows runners from Java 21 env vars ...2a66450setup-r-dependencies: switch back to classic sudo on runners with sudo-rs (#1...5cc1f0dFix minor typo (#1098)33d09fbfix: Remove stray::group::(#1103)aae88a2Special-case CRAN mirror for Windows ARM64 (#1101)b7484da[setup-r] Support installing RTools without installing R (#1093)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)