Repository navigation
meta: Dependabot fails attempting update of gr2m/create-or-update-pull-request-action action #62990
Description
Activity
I can offer to submit a PR to update the action version gr2m/create-or-update-pull-request-action in each of the workflows that use it.
I'm not sure though that this would be helpful, since the actions are set up to run in the parent repo, not in a fork, so I can't easily test them.
I can offer to submit a PR to update the action version gr2m/create-or-update-pull-request-action in each of the workflows that use it.
I can see nothing between the current SHA and v1.10.1 that should be breaking, so I'd say go for it.
Reacted by Mike McCreadyI can see nothing between the current SHA and v1.10.1 that should be breaking, so I'd say go for it.
I have gone for it with PR #63065 knowing that I can't test these workflows in a fork. If that's an issue, then a user with write access could clone the branch and test it in the parent repo.
- added a commit that references this issue
on May 4, 2026 - added 2 commits that reference this issue
on May 5, 2026 - added a commit that references this issue
on Jul 29, 2026 - added a commit that references this issue
on Sep 3, 2026
Situation
Dependabot logs https://github.com/nodejs/node/actions/runs/24660702701/job/72105638122 show a failure attempting to update the GitHub Action gr2m/create-or-update-pull-request-action
Assessment
A similar issue was described and resolved in nodejs/corepack#815
Multiple GitHub Actions workflows, for example:
node/.github/workflows/timezone-update.yml
Line 54 in b6b6e96
use commit gr2m/create-or-update-pull-request-action@77596e3 from Nov 24, 2022
The parent of the above commit is gr2m/create-or-update-pull-request-action@df20b2c which is tagged with v1.9.2
Dependabot would appear to be unable to find out which major.minor.patch the commit gr2m/create-or-update-pull-request-action@77596e3 belongs to, since the commit is not equivalent to any tag and presumably is unable to use update logic that depends on this.
Suggestion
Manually update all instances of:
to a valid SHA gr2m/create-or-update-pull-request-action@b65137c (
b65137ca591da0b9f43bad7b24df13050ea45d1b) corresponding to the action's latest version tag gr2m/create-or-update-pull-request-action@v1.10.1, released Nov 14, 2024This should enable Dependabot to take over future updates.
Other
Note that the latest version gr2m/create-or-update-pull-request-action@v1.10.1 is based on
node20which causes deprecation warnings in GitHub Actions.I already submitted gr2m/create-or-update-pull-request-action#728 to request an update to
node24. It appears that the action repo is however not being actively maintained at this time.cc: @nodejs/actions