Skip to content

Bump the actions-minor-and-patch group with 2 updates - #25

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/github_actions/actions-minor-and-patch-31c83d96ec
Oct 19, 2026
Merged

Bump the actions-minor-and-patch group with 2 updates#25
github-actions[bot] merged 1 commit into
mainfrom
dependabot/github_actions/actions-minor-and-patch-31c83d96ec

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions-minor-and-patch group with 2 updates: gojiplus/adjacent and astral-sh/setup-uv.

Updates gojiplus/adjacent from 2.0 to 2.1

Release notes

Sourced from gojiplus/adjacent's releases.

v2.1: Locked dependencies and isolated action setup

Adjacent v2.1 installs runtime dependencies from uv.lock and keeps action setup independent of the caller's uv configuration.

  • Install action dependencies from uv.lock with uv. Development and CI use the same lockfile, and Dependabot keeps it current.
  • Update Black to 26.10.0, isort to 9.0.2, and charset-normalizer to 3.5.2.
  • Use setup-uv v10.3.0 in the action and CI.
  • Resolve uv configuration from the action's directory so a caller's uv version requirement cannot break dependency installation.
  • Run CI once per pull-request commit while retaining checks on merges to main.
  • Exercise the composite action in CI with a live, read-only GitHub API smoke test and verify its outputs and dry-run behavior.
  • Install actionlint directly in hosted CI to avoid Docker Hub availability failures. Local CI continues to use standard Docker images.

The action inputs, outputs, and recommendation behavior are unchanged from v2.0. Pin workflows to gojiplus/adjacent@v2.1 to use this release.

Validation: 78 tests passed on Python 3.13 and 3.14 in local Docker runs; formatting, import sorting, linting, and workflow checks passed. Independent GPT-6 Astra review verified the caller-isolation repair with a failing regression before the fix and a passing regression afterward, with no unresolved findings. CI also exercises the composite action against the GitHub API without writing the README.

Release commit: 374383b176c74992693f775482df95a1122cc010.

Includes PRs #6 and #7 and the CI trigger change in #4.

Full comparison

Changelog

Sourced from gojiplus/adjacent's changelog.

Changelog

v2.1

  • Install action dependencies from uv.lock with uv. Development and CI use the same lockfile, and Dependabot keeps it current.
  • Update Black to 26.10.0, isort to 9.0.2, and charset-normalizer to 3.5.2.
  • Use setup-uv v10.3.0 in the action and CI.
  • Resolve uv configuration from the action's directory so a caller's uv version requirement cannot break dependency installation.
  • Run CI once per pull-request commit while retaining checks on merges to main.
  • Exercise the composite action in CI with a live, read-only GitHub API smoke test and verify its outputs and dry-run behavior.
  • Install actionlint directly in hosted CI to avoid Docker Hub availability failures. Local CI continues to use standard Docker images.

The action inputs, outputs, and recommendation behavior are unchanged from v2.0. Pin workflows to gojiplus/adjacent@v2.1 to use this release.

v2.0

Adjacent now updates only an explicitly marked README section and ranks related repositories using scores computed on a shared text corpus.

Breaking changes

  • Require one adjacent:start and one adjacent:end HTML comment around the generated section. Heading-based replacement has been removed.
  • Exclude private, disabled, archived, forked, and template repositories by default. Archives, forks, and templates have individual opt-ins.
  • Use raw topic and README scores instead of normalizing each component by the best candidate. Recommendations can change or become fewer.
  • Keep explicit topics and readme modes within their requested signal. Only combined mode redistributes weight when the target lacks a signal.
  • Replace stale recommendations with an empty-result message after a successful search with no matches.
  • Run the action on Python 3.13. Development checks cover Python 3.13 and 3.14.

Improvements

  • Preserve surrounding README bytes and newline style; write changes atomically and skip unchanged content.
  • Add API timeouts, bounded retries, rate-limit handling, organization discovery, pagination validation, and input validation. Failed discovery leaves the README untouched.
  • Add readme_path, min_score, include_forks, include_archived, include_templates, and dry_run inputs.
  • Expose changed and recommendation_count outputs and a job summary with component scores and shared topics.
  • Remove generated recommendation blocks, badges, and code from text scoring, and resolve tied scores by repository name.
  • Add regression tests, formatting and lint checks, Docker validation, and dependency updates.

See the README for marker setup, migration instructions, and workflow examples.

Commits
  • 374383b Merge pull request #7 from gojiplus/uv-pyproject
  • dd21cd7 Isolate action setup from caller uv configuration
  • 552f7e5 Check caller isolation and avoid Docker Hub in hosted lint CI
  • 0184131 Verify the composite action with a read-only CI smoke test
  • 8d9b849 Merge dependency updates into uv release candidate
  • d145f7c Merge pull request #6 from gojiplus/dependabot/pip/dependencies-0cec3be792
  • 3c8a049 Prepare v2.1 with current setup-uv and release notes
  • 52f2bbb Move dependencies to pyproject.toml and uv.lock
  • e1648c4 Bump the dependencies group across 1 directory with 2 updates
  • ed4f859 Run CI once per pull-request commit (#4)
  • See full diff in compare view

Updates astral-sh/setup-uv from 10.2.0 to 10.3.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.0 🌈 Add Python architecture selection

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the actions-minor-and-patch group with 2 updates
2eee134 
Bumps the actions-minor-and-patch group with 2 updates: [gojiplus/adjacent](https://github.com/gojiplus/adjacent) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `gojiplus/adjacent` from 2.0 to 2.1
- [Release notes](https://github.com/gojiplus/adjacent/releases)
- [Changelog](https://github.com/gojiplus/adjacent/blob/main/CHANGELOG.md)
- [Commits](gojiplus/adjacent@a2f97a5...374383b)

Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@c18668a...1c37ad0)

---
updated-dependencies:
- dependency-name: gojiplus/adjacent
  dependency-version: '2.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-and-patch
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 19, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) October 19, 2026 22:15
@github-actions
github-actions Bot merged commit e64a400 into main Oct 19, 2026
11 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-minor-and-patch-31c83d96ec branch October 19, 2026 22:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants