Skip to content

Restore Dependabot updates for pypa/gh-action-pypi-publish #1132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
potiuk merged 1 commit into from
Aug 1, 2026
Merged

Restore Dependabot updates for pypa/gh-action-pypi-publish #1132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 23 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,19 +355,23 @@ This repository uses a [Dependabot cooldown period](https://docs.github.com/en/c
If you need to add a specific version of an already approved action (especially an older one):

1. **Fork** this repository
2. **Add** a new version entry to an existing action in `actions.yml` with the following format:
2. **Add** a new version entry to an existing action in `actions.yml`. Choose its metadata based on
why the version is needed.

For the newest version:

```yaml
existing/action:
'<exact-commit-sha>':
keep: true
tag: vX.Y.Z
```

if this is the newest version of the action (make sure to remove the `keep: true` from the
previously newest version and add `expires_at: <date>` to it, if you want to set an expiration date for it),
The current version must have neither `keep` nor `expires_at`, so that it is included in the
composite action watched by Dependabot. Each action must have at most one such version. When adding
a new current version manually, add `expires_at: <date>` to the previous current version to give
projects time to migrate.

or
For an older version that is needed temporarily:

```yaml
existing/action:
Expand All @@ -376,7 +380,20 @@ existing/action:
tag: vX.Y.Z
```

If you add older version of the action and want to set an expiration date for it.
Use `keep: true` only as an exceptional alternative when an older version must remain available
indefinitely:

```yaml
existing/action:
'<exact-commit-sha>':
# Explain why this version must remain available indefinitely.
keep: true
tag: vX.Y.Z
```

A reference with `keep: true` is retained indefinitely and is not watched for updates by
Dependabot. To keep the action updated, it must also have a separate current version with neither
`keep` nor `expires_at`. Never set both `keep` and `expires_at` on the same reference.


3. **Create a PR** against the `main` branch
Expand Down
1 change: 0 additions & 1 deletion actions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -851,7 +851,6 @@ pypa/gh-action-pip-audit:
tag: v1.1.0
pypa/gh-action-pypi-publish:
ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e:
keep: true
tag: v1.13.0
pyTooling/Actions:
'*':
Expand Down