Repository navigation
Per-workflow tags miss chore(deps) action updates #176
Description
What
Per-workflow release tags fall behind the umbrella tag. Dependency updates never reach them.
Renovate opens action-pin updates as chore(deps) commits. .releaserc.json sets chore to release: false. So these commits never create a per-workflow tag.
The umbrella tag still picks them up. Any later feat or fix release includes every commit before it. Per-workflow tags only move when a feat or fix touches that workflow.
Where
Today these -v0 tags run older action pins than v4:
| Workflow | -v0 points at |
Behind v4 on |
|---|---|---|
lambda-nodejs |
fb2e7bb5 (2026-07-17) |
actions/checkout v6 (v4 has v7), actions/setup-node v6 (v4 has v7), upload-artifact pin |
gitops-helm-diff |
fb2e7bb5 (2026-07-17) |
actions/checkout v6 (v4 has v7) |
docker-build |
33150382 |
checkout, setup-buildx-action, build-push-action, upload-artifact pins |
docker-push-ecr |
33150382 |
download-artifact, configure-aws-credentials, amazon-ecr-login pins |
tf-plan and tf-apply are not affected. They had a perf release on 2026-10-22.
Why it matters
The shared Renovate preset (tx-pts-dai/renovate-config) now moves callers from v4 to <workflow>-v0. Every caller migrated that way loses the action updates above. Security fixes in pinned actions would also never reach them.
Suggested fix
Make dependency updates releasable. Either:
- add a release rule for
chore(deps)(scopedeps) aspatch, or - have Renovate in this repo use
fix(deps)as the semantic commit type.
Then cut a patch release so the affected per-workflow tags catch up.
Activity