ci: Update merge conflict labeler #28023
Conversation
This should fix the warning about deprecated nodejs.
|
Note also that this won't have any effect here because it runs on the |
| @@ -17,7 +17,7 @@ jobs: | |||
| runs-on: ubuntu-latest | |||
| steps: | |||
| - name: Check if PRs have merge conflicts | |||
| uses: eps1lon/actions-label-merge-conflict@releases/2.x | |||
| uses: eps1lon/actions-label-merge-conflict@e62d7a53ff8be8b97684bffb6cfbbf3fc1115e2e # v3.0.0 | |||
There was a problem hiding this comment.
I assume using the hash for paranoia reasons?
There was a problem hiding this comment.
Yes, @matthewfeickert did this elsewhere for us in #26025.
There was a problem hiding this comment.
There's no real downside to using the hash, but for the record I generally only care about using it when it comes to supply chain security. I'll defer to you all on if https://github.com/eps1lon/actions-label-merge-conflict is critical enough to your infrastructure that it needs hashes or not (they will get autoupdated by Dependabot either way).
There was a problem hiding this comment.
It's not super privileged, but it does have PR write permissions.
…023-on-v3.9.x Backport PR #28023 on branch v3.9.x (ci: Update merge conflict labeler)
PR summary
This should fix the warning about deprecated nodejs.
Also, changing from the branch name to a tagged commit should be more stable, and I think will fix dependabot to start auto-updating this one.
PR checklist