Subject: [pgjdbc/pgjdbc] PR #3963: chore: use full version tags in GitHub Actions comments

From: "vlsi (@vlsi)" <[email-masked]>
Date: Sat, 14 Mar 2026 19:18:14 +0000

Replace branch-style version comments (e.g. # v4) with full tag names (e.g. # v4.3.1) for all action references. Also add missing version comment for codecov/codecov-action and update provision-release-pgp-key to v1.0.0.

Currently renovate updates look like `chore(deps): update release-drafter/release-drafter digest to 6a93d82` which is not human-readable. If we use tag names like `v4.3.1`, then renovate would create PRs like `bump to v4.3.1` rather than `bump to 6a93d82`

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Sun, 15 Mar 2026 11:51:27 +0000

Having just gone through this with internal appsec, they are requesting using the SHA instead.

---

From: "vlsi (@vlsi)" <[email-masked]>
Date: Sun, 15 Mar 2026 11:59:33 +0000

Did they review the change?

---

From: "sehrope (@sehrope)" <[email-masked]>
Date: Sun, 15 Mar 2026 14:36:23 +0000

We already have the SHA in place. This is supposed to be just updating the comments to reflect the full version rather than just `v${MAJOR}`.

Except for this one:

```
diff --git a/.github/workflows/pgp-key-maintenance.yaml b/.github/workflows/pgp-key-maintenance.yaml
index 42bf3d3f..88b1e34d 100644
--- a/.github/workflows/pgp-key-maintenance.yaml
+++ b/.github/workflows/pgp-key-maintenance.yaml
@@ -8,7 +8,7 @@ permissions: read-all
 jobs:
   pgp-key-maintenance:
     name: PGP key maintenance
-    uses: vlsi/provision-release-pgp-key/.github/workflows/pgp-key-maintenance.yaml@47caa11d98dd9e897523af1f16532bf6152e8444 # v1
+    uses: vlsi/provision-release-pgp-key/.github/workflows/pgp-key-maintenance.yaml@7c6e3c4eb82ecdd18d1959f3f1a41af9ea0aac0e # v1.0.0
     secrets:
       RELEASE_PGP_SECRET_UPDATE_TOKEN: ${{ secrets.RELEASE_PGP_SECRET_UPDATE_TOKEN }}
       RELEASE_PGP_PRIVATE_KEY: ${{ secrets.RELEASE_PGP_PRIVATE_KEY }}
```

Why did the hash for that change?

---

From: "vlsi (@vlsi)" <[email-masked]>
Date: Sun, 15 Mar 2026 15:04:32 +0000

Because old sha was not tagged

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Sun, 15 Mar 2026 22:02:35 +0000

So apparently you can setup dependabot for the github actions as well