Skip to content

build(deps): bump release-drafter/release-drafter from 6.4.0 to 7.10.0 - #137

Merged
Carl723000 merged 2 commits into
mainfrom
dependabot/github_actions/release-drafter/release-drafter-7.10.0
Oct 17, 2026
Merged

Carl723000 merged 2 commits into
mainfrom
dependabot/github_actions/release-drafter/release-drafter-7.10.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026 •

Copy link
Copy Markdown
Contributor

中文审阅

升级固定 SHA 的 Release Drafter 到 7.10.0,并接入 v7 独立 autolabeler,保留 PR 分类与草稿生成能力。

  • PR 打开/重开/同步/编辑时只执行自动标签;草稿只在 main 推送或已合并关闭时更新。
  • 两个 action 都固定到已审阅的同一 commit,配置从可信 main 加载,不 checkout 或执行 PR 代码。
  • 标签任务仅 contents:read/pull-requests:write;草稿任务 contents:write/pull-requests:read,明确 publish: 'false'。
  • 新增事件矩阵、错误目标分支、未合并关闭、权限、配置来源和可变 action ref 的反例测试。
  • 聚焦 29/29,完整本地 Node 2,682 通过、2 既有跳过、0 失败。精确 head 的远端 CI 仍是合并门槛;没有执行真实发布。

Summary

Upgrade the immutable Release Drafter pin to v7.10.0 and retain labeling through its separate autolabeler action. Separate active main-target PR metadata events from main-push/merged-closure draft updates, use trusted-main configuration, narrow permissions, no checkout and explicit draft-only publication behavior.

Red/green routing and boundary checks pass (29 focused checks). Full local Node: 2,682 passed, 2 existing skips, 0 failed. Hosted final-head CI is separate; live publication was not exercised.

Autolabeler contract, drafter contract.


🤖 Generated by OpenAI Codex as an automated first pass — not a maintainer decision.

Bumps [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) from 6.4.0 to 7.10.0.
- [Release notes](https://github.com/release-drafter/release-drafter/releases)
- [Commits](release-drafter/release-drafter@6a93d82...978bb0b)

---
updated-dependencies:
- dependency-name: release-drafter/release-drafter
  dependency-version: 7.10.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency update major Major bump labels Oct 17, 2026
Split PR metadata labeling from main-branch draft updates, pin both actions
to the reviewed v7.10.0 commit and load configuration from main. Keep labeling
checkout-free with read-only contents and PR-label permissions; drafting is
limited to main pushes/merged closures and explicitly cannot publish.

Add routing, permission and mutation regressions for these boundaries.

Co-authored-by: OpenAI Codex <215057067+openai-codex[bot]@users.noreply.github.com>
@Carl723000 Carl723000 added ci CI / workflow change skip-changelog Exclude from auto-generated release notes and removed major Major bump labels Oct 17, 2026
@Carl723000
Carl723000 merged commit d4120e7 into main Oct 17, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/release-drafter/release-drafter-7.10.0 branch October 17, 2026 14:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci CI / workflow change dependencies Dependency update skip-changelog Exclude from auto-generated release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant