chore(deps): bump the github-actions group across 1 directory with 11 updates - #4385
chore(deps): bump the github-actions group across 1 directory with 11 updates#4385dependabot[bot] wants to merge 1 commit into
Conversation
… updates Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.157` | `1.0.179` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.4.0` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.0` | `4.1.1` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.2` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | | [mitchellh/vouch/action/check-pr](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [mitchellh/vouch/action/manage-by-issue](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.0` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) Updates `anthropics/claude-code-action` from 1.0.157 to 1.0.179 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@428971d...b76a077) Updates `docker/login-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...af1e73f) Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@fbd0ab8...7b450ff) Updates `actions/attest-build-provenance` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@a2bbfa2...0f67c3f) Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 - [Release notes](https://github.com/denoland/setup-deno/releases) - [Commits](denoland/setup-deno@667a34c...22d081f) Updates `mitchellh/vouch/action/check-pr` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `mitchellh/vouch/action/manage-by-issue` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.0 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@192e21d...6599ee8) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.179 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: denoland/setup-deno dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: mitchellh/vouch/action/check-pr dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: mitchellh/vouch/action/manage-by-issue dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Create GitHub Release | ||
| id: release | ||
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 | ||
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path |
There was a problem hiding this comment.
🟡 Version comment left stale after checkout action was upgraded
The checkout step's version label still reads v7.0.0 (# v7.0.0 at .github/workflows/changesets-pr.yml:29) even though the pinned commit hash was advanced to the v7.0.1 release, so the human-readable label no longer matches the version that actually runs.
Impact: Anyone auditing the workflow sees a version number that disagrees with the actual pinned action, which is misleading and can cause confusion during future upgrades.
SHA/comment mismatch details
The commit 3d3c42e5aac5ba805825da76410c181273ba90b1 is actions/checkout v7.0.1 — confirmed by every other workflow file in this PR (e.g. .github/workflows/check-review-md.yml:30) which updated its comment to # v7.0.1. Only .github/workflows/changesets-pr.yml:29 and .github/workflows/release.yml:70 retained the old # v7.0.0 label. The action behavior is correct (v7.0.1 runs); only the comment is stale.
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path |
Was this helpful? React with 👍 or 👎 to provide feedback.
| steps: | ||
| - name: Checkout repo | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path |
There was a problem hiding this comment.
🟡 Version comment left stale after checkout action was upgraded
The release checkout step's version label still reads v7.0.0 (# v7.0.0 at .github/workflows/release.yml:70) even though the pinned commit hash was advanced to the v7.0.1 release, so the human-readable label no longer matches the version that actually runs.
Impact: Anyone auditing the workflow sees a version number that disagrees with the actual pinned action, which is misleading and can cause confusion during future upgrades.
SHA/comment mismatch details
The commit 3d3c42e5aac5ba805825da76410c181273ba90b1 is actions/checkout v7.0.1 — confirmed by every other workflow file in this PR (e.g. .github/workflows/release.yml:292 in the same file) which updated its comment to # v7.0.1. Only .github/workflows/release.yml:70 and .github/workflows/changesets-pr.yml:29 retained the old # v7.0.0 label. The action behavior is correct (v7.0.1 runs); only the comment is stale.
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path |
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| - name: ⎔ Setup node | ||
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
There was a problem hiding this comment.
🔍 setup-node bumped across a major version (v6 -> v7, ESM migration)
This PR moves actions/setup-node from v6.4.0 to v7.0.0 in ~15 workflow files. Per the upstream release notes, v7.0.0 is a major release that migrates the action to ESM and upgrades @actions/cache to 5.1.0. The usage here (node-version + cache: pnpm) is standard and unlikely to break, but because it crosses a major boundary it is worth confirming the pnpm cache behavior and Node 24 runner support still function as expected in CI before merge. All inputs used (node-version, cache) remain valid in v7.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Bumps the github-actions group with 11 updates in the / directory:
7.0.07.0.16.4.07.0.01.0.1571.0.1794.2.04.4.04.0.14.0.24.1.04.1.13.0.13.0.22.0.42.0.51.4.21.5.01.4.21.5.00.5.70.6.0Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-nodefrom 6.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
anthropics/claude-code-actionfrom 1.0.157 to 1.0.179Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
b76a077chore: bump Claude Code to 2.1.216 and Agent SDK to 0.3.216af0559echore: bump Claude Code to 2.1.215 and Agent SDK to 0.3.2153553f84chore: bump Claude Code to 2.1.214 and Agent SDK to 0.3.214700e7f8chore: bump Claude Code to 2.1.212 and Agent SDK to 0.3.2123e807ecfix: handle null comment/review author from deleted accounts (#1490)2988cbedocs: map custom_instructions to --append-system-prompt (#1480) (#1484)a1c0599fix(format): filter out thinking_tokens system messages from step summary (#1...5bfa96afix: allow leading underscore in branch names (valid per git-check-ref-format...214a706fix: map claude_args model to SDK options (#1474)5f509a1fix(sanitizer): strip alt text from reference-style markdown images (#1488)Updates
docker/login-actionfrom 4.2.0 to 4.4.0Release notes
Sourced from docker/login-action's releases.
Commits
af1e73fMerge pull request #1034 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...da722bd[dependabot skip] chore: update generated content2916ad6build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...ca0a662Merge pull request #1035 from crazy-max/fix-registry-auth-empty-maskc455755chore: update generated content4835190skip empty registry-auth secret mask992421cMerge pull request #1033 from docker/dependabot/github_actions/docker/bake-ac...b249b43Merge pull request #1032 from docker/dependabot/github_actions/docker/bake-ac...1b67977build(deps): bump docker/bake-action from 7.2.0 to 7.3.09d49d6abuild(deps): bump docker/bake-action/subaction/matrixUpdates
dorny/paths-filterfrom 4.0.1 to 4.0.2Release notes
Sourced from dorny/paths-filter's releases.
Changelog
Sourced from dorny/paths-filter's changelog.
... (truncated)
Commits
7b450ffdocs: update changelog for v4.0.2 (#318)9280377fix: work around git dubious ownership errors in container jobs (#317)f3ceefdfix: use rev-parse instead of branch --show-current for older git compat (#303)61f87a1chore: fix GitHub spelling in logs (#278)b82ff81fix warning message (#282)Updates
actions/attest-build-provenancefrom 4.1.0 to 4.1.1Release notes
Sourced from actions/attest-build-provenance's releases.
Commits
0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)Updates
softprops/action-gh-releasefrom 3.0.1 to 3.0.2Release notes
Sourced from softprops/action-gh-release's releases.
Changelog
Sourced from softprops/action-gh-release's changelog.
... (truncated)
Commits
3d0d988release 3.0.2 (#818)7e13ed4fix: clarify release creation 404 errors (#817)e6c70a5fix: replace existing release assets on Gitea (#816)f345337fix: publish existing draft releases as prereleases (#801)d8a89a2fix: upload small checksum assets reliably (#815)45ece40chore(deps): remove unused TypeScript tooling (#814)f6b913cfeat: improve release error reporting and test coverage (#813)15f193dchore(deps): upgrade TypeScript to 7 (#812)cc8268dchore(deps): bump actions/checkout in the github-actions group (#810)fd0ed1echore(deps): bump the npm group with 3 updates (#811)Updates
denoland/setup-denofrom 2.0.4 to 2.0.5Release notes
Sourced from denoland/setup-deno's releases.
Commits
22d081f2.0.5 (#131)28c677fchore: use versions.json from dl.deno.land (#130)ff4860f2.0.4 (#125)6a293fcfeat: upgrade Node.js runtime from node20 to node24 (#123)390061adocs: fix identifier for latest stable release (#115)bdaa2e4docs: condense Deno version information in one section (#100)e4ff81cdocs: add lts as possible release-channel output (#99)bac1f72Update actions/checkout (#106)2f7698f2.0.3 (#102)ee64dd3fix: switch back to package.json as it's necessary for GH actions (#101)Updates
mitchellh/vouch/action/check-prfrom 1.4.2 to 1.5.0Release notes
Sourced from mitchellh/vouch/action/check-pr's releases.
Commits
d66fa29Merge pull request #93 from mitchellh/dependabot/github_actions/actions/check...c22b93dBump actions/checkout from 6.0.2 to 7.0.0baeb3bfMerge pull request #90 from trag1c/lock-issues52aec3dadd an option to lock closed issues3dbc69cMerge pull request #87 from freepicheep/example-attributea693346Update VOUCHED list21177c0Merge pull request #74 from pavelzw/vouch-cli527cdc3Merge pull request #81 from mitchellh/dependabot/github_actions/hustcer/setup...1895e9cfeat: use@exampleattribute for command examples8c80adaUpdate READMEUpdates
mitchellh/vouch/action/manage-by-issuefrom 1.4.2 to 1.5.0Release notes
Sourced from mitchellh/vouch/action/manage-by-issue's releases.
Commits
d66fa29Merge pull request #93 from mitchellh/dependabot/github_actions/actions/check...c22b93dBump actions/checkout from 6.0.2 to 7.0.0baeb3bfMerge pull request #90 from trag1c/lock-issues52aec3dadd an option to lock closed issues