Skip to content

Bump the github-actions group across 1 directory with 7 updates - #48875

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-9078c7da52
Open

Bump the github-actions group across 1 directory with 7 updates#48875
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-9078c7da52

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 7 updates in the / directory:

Package From To
actions/checkout 6.1.0 7.0.1
github/gh-aw-actions/setup 0.80.9 0.87.7
github/gh-aw-actions/setup-cli 0.80.9 0.87.7
actions/cache/restore 5.0.5 6.1.0
actions/cache/save 5.0.5 6.1.0
actions/setup-python 6.3.0 7.0.0
actions/setup-node 6.4.0 7.0.0

Updates actions/checkout from 6.1.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates github/gh-aw-actions/setup from 0.80.9 to 0.87.7

Release notes

Sourced from github/gh-aw-actions/setup's releases.

v0.87.7

Sync of actions from gh-aw at v0.87.7.

v0.87.6

Sync of actions from gh-aw at v0.87.6.

v0.87.5

Sync of actions from gh-aw at v0.87.5.

v0.87.4

Sync of actions from gh-aw at v0.87.4.

v0.87.2

Sync of actions from gh-aw at v0.87.2.

v0.87.1

Sync of actions from gh-aw at v0.87.1.

v0.87.0

Sync of actions from gh-aw at v0.87.0.

v0.86.3

Sync of actions from gh-aw at v0.86.3.

v0.86.2

Sync of actions from gh-aw at v0.86.2.

v0.86.1

Sync of actions from gh-aw at v0.86.1.

v0.86.0

Sync of actions from gh-aw at v0.86.0.

v0.85.4

Sync of actions from gh-aw at v0.85.4.

v0.83.2

Sync of actions from gh-aw at v0.83.2.

v0.83.1

Sync of actions from gh-aw at v0.83.1.

v0.83.0

Sync of actions from gh-aw at v0.83.0.

v0.82.15

Sync of actions from gh-aw at v0.82.15.

v0.82.14

Sync of actions from gh-aw at v0.82.14.

... (truncated)

Commits

Updates github/gh-aw-actions/setup-cli from 0.80.9 to 0.87.7

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.87.7

Sync of actions from gh-aw at v0.87.7.

v0.87.6

Sync of actions from gh-aw at v0.87.6.

v0.87.5

Sync of actions from gh-aw at v0.87.5.

v0.87.4

Sync of actions from gh-aw at v0.87.4.

v0.87.2

Sync of actions from gh-aw at v0.87.2.

v0.87.1

Sync of actions from gh-aw at v0.87.1.

v0.87.0

Sync of actions from gh-aw at v0.87.0.

v0.86.3

Sync of actions from gh-aw at v0.86.3.

v0.86.2

Sync of actions from gh-aw at v0.86.2.

v0.86.1

Sync of actions from gh-aw at v0.86.1.

v0.86.0

Sync of actions from gh-aw at v0.86.0.

v0.85.4

Sync of actions from gh-aw at v0.85.4.

v0.83.2

Sync of actions from gh-aw at v0.83.2.

v0.83.1

Sync of actions from gh-aw at v0.83.1.

v0.83.0

Sync of actions from gh-aw at v0.83.0.

v0.82.15

Sync of actions from gh-aw at v0.82.15.

v0.82.14

Sync of actions from gh-aw at v0.82.14.

... (truncated)

Commits

Updates actions/cache/restore from 5.0.5 to 6.1.0

Release notes

Sourced from actions/cache/restore's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache/restore's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates actions/cache/save from 5.0.5 to 6.1.0

Release notes

Sourced from actions/cache/save's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache/save's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 3, 2026
Copilot AI balanced review requested due to automatic review settings September 3, 2026 02:46
@dependabot
dependabot Bot requested a review from a team as a code owner September 3, 2026 02:46
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 3, 2026
@azure-pipelines

azure-pipelines Bot commented Sep 3, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI reviewed Sep 3, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Generated workflows must be regenerated so their manifests and compiler metadata match the updated action pins.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates pinned GitHub Actions dependencies across repository automation workflows.

Changes:

  • Upgrades checkout, cache, Python, Node.js, and gh-aw actions.
  • Retains commit-SHA pinning.
  • Updates generated workflows without fully regenerating their metadata.
File summaries
File Reviewed change
.github/workflows/verify-links.yml Updates checkout.
.github/workflows/post-apiview.yml Updates checkout.
.github/workflows/pipeline-analysis-next-steps.lock.yml Updates actions, but leaves generated manifest metadata stale.
.github/workflows/pipeline-analysis-auto-fix.lock.yml Updates actions, but leaves generated manifest metadata stale.
.github/workflows/mgmt-sdk-pr-review.lock.yml Updates gh-aw setup, but leaves generated manifest metadata stale.
.github/workflows/issue-triage.lock.yml Updates actions, but leaves generated manifest metadata stale.
.github/workflows/doc-consistency-check.lock.yml Updates actions, but leaves generated manifest metadata stale.
.github/workflows/dependency-checker.yml Updates checkout and Python setup.
.github/workflows/copilot-setup-steps.yml Updates setup actions; one version annotation is incorrect.
.github/workflows/azure-sdk-tools.yml Updates checkout and Python setup.
.github/workflows/agentics-maintenance.yml Directly edits a generated workflow without updating its gh-aw version.
.github/workflows/actionlint.yml Updates checkout.
Review details

Suppressed comments (1)

.github/workflows/copilot-setup-steps.yml:40

  • The PR identifies this SHA as the v0.87.7 update, but the inline annotation says v0.87.8. Correct the annotation so future dependency audits do not report the wrong release.
        uses: github/gh-aw-actions/setup-cli@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8
  • Files reviewed: 12/12 changed files
  • Comments generated: 6
  • Review effort level: Balanced

Comment thread .github/workflows/agentics-maintenance.yml
steps:
- name: Setup Scripts
uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8
Comment thread .github/workflows/doc-consistency-check.lock.yml
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8
Comment thread .github/workflows/issue-triage.lock.yml
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8
Comment thread .github/workflows/mgmt-sdk-pr-review.lock.yml
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@423b3dc04bbf1b1797194a4a75aa5cf5d0d4f5b3 # v0.87.1
uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8
Comment thread .github/workflows/pipeline-analysis-auto-fix.lock.yml
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8
Comment thread .github/workflows/pipeline-analysis-next-steps.lock.yml
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@8c7d04ebf1ece56cd381446125da3e0f6896294a # v0.80.9
uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8
@dependabot
Bump the github-actions group across 1 directory with 7 updates
a616bc9 
Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.1.0` | `7.0.1` |
| [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) | `0.80.9` | `0.87.7` |
| [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) | `0.80.9` | `0.87.7` |
| [actions/cache/restore](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |
| [actions/cache/save](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` |



Updates `actions/checkout` from 6.1.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6.1.0...3d3c42e)

Updates `github/gh-aw-actions/setup` from 0.80.9 to 0.87.7
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@v0.80.9...1aa033c)

Updates `github/gh-aw-actions/setup-cli` from 0.80.9 to 0.87.7
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@8c7d04e...1aa033c)

Updates `actions/cache/restore` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5.0.5...55cc834)

Updates `actions/cache/save` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5.0.5...55cc834)

Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)

Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6.4.0...8207627)

---
updated-dependencies:
- dependency-name: actions/cache/restore
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache/save
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/gh-aw-actions/setup
  dependency-version: 0.87.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/gh-aw-actions/setup-cli
  dependency-version: 0.87.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI review requested due to automatic review settings September 3, 2026 23:33
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-9078c7da52 branch from dbd0904 to a616bc9 Compare September 3, 2026 23:33
Copilot AI reviewed Sep 3, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Generated workflows must be regenerated after updating their dependency sources so manifests and action pins remain consistent.

Review details

Suppressed comments (6)

.github/workflows/agentics-maintenance.yml:99

  • This file is generated and explicitly says not to edit it (line 1), but .github/aw/actions-lock.json:18-21 still pins this setup action to v0.80.9. Update the gh-aw dependency source and regenerate the maintenance workflow; otherwise the next gh aw compile can revert this pin and the generated-version header remains misleading.
        uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8

.github/workflows/doc-consistency-check.lock.yml:99

  • This updates generated steps without updating the embedded gh-aw-manifest, which still lists the old checkout, cache, setup-node, and setup SHAs. Since lines 1–3 mark this file as generated, update the dependency source and run gh aw compile --dependabot; otherwise dependency metadata is inaccurate and recompilation can restore the old pins.
        uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8

.github/workflows/issue-triage.lock.yml:108

  • This updates generated steps without updating the embedded gh-aw-manifest, which still lists the old checkout, cache, setup-node, and setup SHAs. Since lines 1–3 mark this file as generated, update the dependency source and run gh aw compile --dependabot; otherwise dependency metadata is inaccurate and recompilation can restore the old pins.
        uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8

.github/workflows/mgmt-sdk-pr-review.lock.yml:96

  • The embedded gh-aw-manifest still records github/gh-aw-actions/setup at 423b3dc..., while the executable steps now use 1aa033c.... This generated file explicitly requires regeneration (lines 1–3); update the dependency source and run gh aw compile --dependabot so the manifest and all generated references remain consistent.
        uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8

.github/workflows/pipeline-analysis-auto-fix.lock.yml:177

  • The embedded gh-aw-manifest still records github/gh-aw-actions/setup at 423b3dc..., while the executable steps now use 1aa033c.... This generated file explicitly requires regeneration (lines 1–3); update the dependency source and run gh aw compile --dependabot so the manifest and all generated references remain consistent.
        uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8

.github/workflows/pipeline-analysis-next-steps.lock.yml:167

  • The embedded gh-aw-manifest still records github/gh-aw-actions/setup at 423b3dc..., while the executable steps now use 1aa033c.... This generated file explicitly requires regeneration (lines 1–3); update the dependency source and run gh aw compile --dependabot so the manifest and all generated references remain consistent.
        uses: github/gh-aw-actions/setup@1aa033c7bf25ac9428fe521065b90c30a7070c4e # v0.87.8
  • Files reviewed: 12/12 changed files
  • Comments generated: 0 new
  • Review effort level: Balanced

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant