chore(deps): update ferrlabs/ferrflow action to v7 - #196
chore(deps): update ferrlabs/ferrflow action to v7#196ferrlabs-renovate[bot] wants to merge 1 commit into
Conversation
5062f20 to
8b429ff
Compare
![ferrfleet[bot]](https://avatars.githubusercontent.com/in/4354888?s=60&v=4){kind=small}
There was a problem hiding this comment.
FerrLabs/FerrFlow v5 → v6 (pin bump only, .github/workflows/ci.yml:59).
What changed upstream:
- v6.0.0: relicense MPL-2.0 → MIT (no code impact) + release archive is now verified against SHA256SUMS before extraction (security hardening, falls back to a warning if SHA256SUMS is absent).
- v6.1.0 (FerrLabs/FerrFlow#818, tagged
feat(bot)!upstream despite the plain "feat" in the changelog): defaultbot_endpointmoved from.../v1/ferrflow/tokento.../ferrflow/token. Per that PR, both paths keep responding through 2027-02-08, and the switch was gated on FerrFlow-Cloud#784 being deployed first — which it must be, since v6.1.0 already shipped. - v6.1.1: internal CI notification fix only.
What breaks here: nothing. This repo's release job (ci.yml:59-62) uses bot: true without overriding bot_endpoint, so it just inherits the new default — covered by the compat window above.
CI: Lint/Test/Conventional-commits/security scans are green. Release/Benchmark jobs show "skipped" here because they only run on push-to-main or workflow_dispatch, so this PR's CI never actually exercises the new bot token endpoint — that only gets exercised post-merge. Not a blocker, just noting it as the reason CI can't catch a regression here if the cloud-side deploy assumption above were wrong.
Nit: worth a manual check of the first post-merge release run to confirm the bot token exchange still succeeds, given CI here doesn't cover it.
2766028 to
3747ddc
Compare
ferrlabs-renovate
Bot
changed the title
4fa4cf1 to
e5836dc
Compare
There was a problem hiding this comment.
Follow-up: PR advanced from FerrFlow v6.1.1 (previously reviewed here) to v7.0.3.
What changed upstream (v6.2.0 → v7.0.3):
- v6.2.0: additive
workspace.releaseCommitBodyfeature — no impact. - v7.0.0 (breaking, FerrLabs/FerrFlow#824): commit classification is now configurable via
workspace.commitFormats; defaults got more permissive — branch-style titles likeFeat/,Fix:,Refactor/now trigger releases where the old hard-coded strict-lowercase matcher ignored them. - v7.0.1 (#844): fixes
Cargo.lockdrift duringupdateLockfiles(wrong crate name passed tocargo update -p,--offlinefailing on a cold registry cache) — Rust/Cargo-specific. - v7.0.2 (#847): internal FerrFlow CI permissions fix.
- v7.0.3 (#848): bot token exchange now retries on transient failures.
What breaks here: nothing. ferrflow.json sets no commitFormats override, but .github/workflows/pr-title.yml enforces conventional-commit PR titles (via FerrLabs/.github/reusable-pr-title.yml), and workspace.releaseCommitMode: "pr" means the commits that actually land on main are squash-merges of those already-conventional titles — there's no non-conventional history for the new permissive glob matching to newly catch. The v7.0.1 Cargo lockfile fix doesn't apply either: this repo versions a plain VERSION (txt) file, no Cargo.toml/Cargo.lock.
CI: all green (Lint, Test, security scans, zizmor).
My earlier Nit (verify the bot token exchange on the first post-merge release run) is unrelated to this update and still open — not repeating it here.
Uneventful major bump for this repo. Approving.
e5836dc to
275ddd8
Compare
There was a problem hiding this comment.
Follow-up: PR advanced from FerrFlow v7.0.3 (previously reviewed) to v7.0.5 (.github/workflows/ci.yml:59).
What changed upstream:
- v7.0.4 (#850): internal refactor, replaces a 7-field tag tuple with a named struct — no external behavior change.
- v7.0.5 (#854):
fix(bot): stop retrying token-exchange errors a retry cannot fix— refines the blind retry-on-transient-failure behavior added in v7.0.3 to skip retries for non-retryable errors.
What breaks here: nothing. Both are internal fixes to the same bot token-exchange path already covered in my last review; this repo doesn't configure retry behavior, so it just inherits the tighter logic.
CI: all green (Lint, Test, security scans, zizmor, PR title).
Uneventful patch bump. Approving.
275ddd8 to
ba91b12
Compare
This PR contains the following updates:
v5→v7Release Notes
FerrLabs/FerrFlow (FerrLabs/FerrFlow)
v7.0.5Compare Source
[7.0.5] - 2026-08-16
Bug Fixes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v7.0.4Compare Source
[7.0.4] - 2026-08-16
Refactoring
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v7.0.3Compare Source
[7.0.3] - 2026-08-15
Bug Fixes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v7.0.2Compare Source
[7.0.2] - 2026-08-15
Bug Fixes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v7.0.1Compare Source
[7.0.1] - 2026-08-15
Bug Fixes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v7.0.0Compare Source
[7.0.0] - 2026-08-10
Breaking Changes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v7Compare Source
v6.2.0Compare Source
[6.2.0] - 2026-08-09
Features
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.