From 22f00c0a1196af791fab36687eb80f7480a1d319 Mon Sep 17 00:00:00 2001 From: Dmytro Shteflyuk Date: Sat, 1 Aug 2026 10:03:22 -0400 Subject: [PATCH] Restore pypi-publish Dependabot updates Remove the keep marker that excludes the current release from the Dependabot sentinel and clarify the version metadata lifecycle. Generated-by: OpenAI Codex (GPT-5.6) --- README.md | 29 +++++++++++++++++++++++------ actions.yml | 1 - 2 files changed, 23 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 4e795aaf..b03f70df 100644 --- a/README.md +++ b/README.md @@ -355,19 +355,23 @@ This repository uses a [Dependabot cooldown period](https://docs.github.com/en/c If you need to add a specific version of an already approved action (especially an older one): 1. **Fork** this repository -2. **Add** a new version entry to an existing action in `actions.yml` with the following format: +2. **Add** a new version entry to an existing action in `actions.yml`. Choose its metadata based on + why the version is needed. + +For the newest version: ```yaml existing/action: '': - keep: true tag: vX.Y.Z ``` -if this is the newest version of the action (make sure to remove the `keep: true` from the -previously newest version and add `expires_at: ` to it, if you want to set an expiration date for it), +The current version must have neither `keep` nor `expires_at`, so that it is included in the +composite action watched by Dependabot. Each action must have at most one such version. When adding +a new current version manually, add `expires_at: ` to the previous current version to give +projects time to migrate. -or +For an older version that is needed temporarily: ```yaml existing/action: @@ -376,7 +380,20 @@ existing/action: tag: vX.Y.Z ``` -If you add older version of the action and want to set an expiration date for it. +Use `keep: true` only as an exceptional alternative when an older version must remain available +indefinitely: + +```yaml +existing/action: + '': + # Explain why this version must remain available indefinitely. + keep: true + tag: vX.Y.Z +``` + +A reference with `keep: true` is retained indefinitely and is not watched for updates by +Dependabot. To keep the action updated, it must also have a separate current version with neither +`keep` nor `expires_at`. Never set both `keep` and `expires_at` on the same reference. 3. **Create a PR** against the `main` branch diff --git a/actions.yml b/actions.yml index 025c7e5c..9c34b44c 100644 --- a/actions.yml +++ b/actions.yml @@ -851,7 +851,6 @@ pypa/gh-action-pip-audit: tag: v1.1.0 pypa/gh-action-pypi-publish: ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e: - keep: true tag: v1.13.0 pyTooling/Actions: '*':