chore(deps): update pypa/gh-action-pypi-publish digest to cef2210 by renovate[bot] · Pull Request #363 · deepnote/deepnote

renovate · 2026-04-13T05:17:34Z

This PR contains the following updates:

Package	Type	Update	Change
pypa/gh-action-pypi-publish (changelog)	action	digest	`ed0c539` → `cef2210`

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- "before 9am on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-04-13T05:17:40Z

Walkthrough

Updated the pinned commit SHA for the pypa/gh-action-pypi-publish action in the CD workflow from ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e to cef221092ed1bacb1cc03d23a2d87d1d172e277b. The step name, inputs (packages-dir: dist), and surrounding workflow logic remain unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested reviewers

jamesbhobbs

Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title accurately describes the main change: updating a GitHub Action dependency digest.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Updates Docs	✅ Passed	PR updates an internal GitHub Action digest (ed0c539→cef2210) in CI/CD workflow—routine dependency maintenance, not a feature implementation requiring documentation.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-04-13T05:19:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.35%. Comparing base (adb1f6a) to head (8792d21).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #363   +/-   ##
=======================================
  Coverage   84.35%   84.35%           
=======================================
  Files         153      153           
  Lines        7996     7996           
  Branches     2163     2163           
=======================================
  Hits         6745     6745           
  Misses       1250     1250           
  Partials        1        1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cd-pypi-cli.yml:
- Line 46: The Setup Bun action step (uses:
oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6) is incorrectly
attempting to use a non-existent `cache` input; change the step to pass the
correct input by adding `with: no-cache: true` to the "Setup Bun" step so Bun
caching is disabled (use the `no-cache` input rather than `cache`).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a23aa126-1262-4adf-8a61-1c8e4f17c8f1

📥 Commits

Reviewing files that changed from the base of the PR and between ddef09f and d434058.

📒 Files selected for processing (1)

.github/workflows/cd-pypi-cli.yml

coderabbitai

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cd-pypi-cli.yml:
- Line 46: The Setup Bun action step (uses:
oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6) is incorrectly
attempting to use a non-existent `cache` input; change the step to pass the
correct input by adding `with: no-cache: true` to the "Setup Bun" step so Bun
caching is disabled (use the `no-cache` input rather than `cache`).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a23aa126-1262-4adf-8a61-1c8e4f17c8f1

📥 Commits

Reviewing files that changed from the base of the PR and between ddef09f and d434058.

📒 Files selected for processing (1)

.github/workflows/cd-pypi-cli.yml

🛑 Comments failed to post (1)

.github/workflows/cd-pypi-cli.yml (1)
46-46: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win
🧩 Analysis chain

🏁 Script executed:
#!/bin/bash
# Verify setup-bun supports cache input and its default in the pinned commit.
set -euo pipefail

curl -fsSL https://raw.githubusercontent.com/oven-sh/setup-bun/0c5077e51419868618aeaa5fe8019c62421857d6/action.yml \
  | sed -n '1,220p'

# Find all setup-bun uses and whether cache is explicitly configured.
rg -n -C3 'uses:\s*oven-sh/setup-bun@' .github/workflows
Repository: deepnote/deepnote

Length of output: 3070
Disable Bun caching at Line 46 using no-cache (not cache)

oven-sh/setup-bun@... (pinned v2) exposes no-cache (default: false); there is no cache input. Set with: no-cache: true on the Setup Bun step.
Suggested fix
      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          no-cache: true
🧰 Tools

🪛 zizmor (1.25.2)

[error] 46-46: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/cd-pypi-cli.yml at line 46, The Setup Bun action step
(uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6) is
incorrectly attempting to use a non-existent `cache` input; change the step to
pass the correct input by adding `with: no-cache: true` to the "Setup Bun" step
so Bun caching is disabled (use the `no-cache` input rather than `cache`).

renovate Bot added dependencies renovate labels Apr 13, 2026

coderabbitai Bot approved these changes Apr 13, 2026

View reviewed changes

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch 2 times, most recently from 676a24a to 8f64b4d Compare April 22, 2026 07:20

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch 2 times, most recently from cc9f68d to f9f6d24 Compare April 30, 2026 13:24

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch 3 times, most recently from 3f74138 to 5b53809 Compare May 14, 2026 07:18

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch 2 times, most recently from 99991d4 to decb330 Compare May 15, 2026 10:23

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch from decb330 to 1579836 Compare May 21, 2026 18:10

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch 9 times, most recently from dec790e to d434058 Compare June 4, 2026 12:05

coderabbitai Bot requested changes Jun 4, 2026

View reviewed changes

coderabbitai Bot reviewed Jun 4, 2026

View reviewed changes

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch from d434058 to ca71123 Compare June 4, 2026 13:05

coderabbitai Bot approved these changes Jun 4, 2026

View reviewed changes

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch 2 times, most recently from 8a30c0d to 257d345 Compare June 8, 2026 11:33

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch 4 times, most recently from 1fce866 to 49e605f Compare June 17, 2026 14:00

chore(deps): update pypa/gh-action-pypi-publish digest to cef2210

8792d21

renovate Bot force-pushed the renovate/pypa-gh-action-pypi-publish-digest branch from 49e605f to 8792d21 Compare June 18, 2026 09:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update pypa/gh-action-pypi-publish digest to cef2210#363

chore(deps): update pypa/gh-action-pypi-publish digest to cef2210#363
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypa-gh-action-pypi-publish-digest

renovate Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 13, 2026 •

edited

Loading

Walkthrough

Estimated code review effort

Suggested reviewers

Uh oh!

codecov Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Configuration

Uh oh!

coderabbitai Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

Suggested reviewers

Uh oh!

codecov Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 13, 2026 •

edited

Loading

coderabbitai Bot commented Apr 13, 2026 •

edited

Loading

codecov Bot commented Apr 13, 2026 •

edited

Loading