chore(deps): bump the github-actions group across 1 directory with 11 updates - #4385
chore(deps): bump the github-actions group across 1 directory with 11 updates#4385dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Create GitHub Release | ||
| id: release | ||
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 | ||
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path |
There was a problem hiding this comment.
🟡 Version comment left stale after checkout action was upgraded
The checkout step's version label still reads v7.0.0 (# v7.0.0 at .github/workflows/changesets-pr.yml:29) even though the pinned commit hash was advanced to the v7.0.1 release, so the human-readable label no longer matches the version that actually runs.
Impact: Anyone auditing the workflow sees a version number that disagrees with the actual pinned action, which is misleading and can cause confusion during future upgrades.
SHA/comment mismatch details
The commit 3d3c42e5aac5ba805825da76410c181273ba90b1 is actions/checkout v7.0.1 — confirmed by every other workflow file in this PR (e.g. .github/workflows/check-review-md.yml:30) which updated its comment to # v7.0.1. Only .github/workflows/changesets-pr.yml:29 and .github/workflows/release.yml:70 retained the old # v7.0.0 label. The action behavior is correct (v7.0.1 runs); only the comment is stale.
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path |
Was this helpful? React with 👍 or 👎 to provide feedback.
| steps: | ||
| - name: Checkout repo | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path |
There was a problem hiding this comment.
🟡 Version comment left stale after checkout action was upgraded
The release checkout step's version label still reads v7.0.0 (# v7.0.0 at .github/workflows/release.yml:70) even though the pinned commit hash was advanced to the v7.0.1 release, so the human-readable label no longer matches the version that actually runs.
Impact: Anyone auditing the workflow sees a version number that disagrees with the actual pinned action, which is misleading and can cause confusion during future upgrades.
SHA/comment mismatch details
The commit 3d3c42e5aac5ba805825da76410c181273ba90b1 is actions/checkout v7.0.1 — confirmed by every other workflow file in this PR (e.g. .github/workflows/release.yml:292 in the same file) which updated its comment to # v7.0.1. Only .github/workflows/release.yml:70 and .github/workflows/changesets-pr.yml:29 retained the old # v7.0.0 label. The action behavior is correct (v7.0.1 runs); only the comment is stale.
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path |
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| - name: ⎔ Setup node | ||
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
There was a problem hiding this comment.
🔍 setup-node bumped across a major version (v6 -> v7, ESM migration)
This PR moves actions/setup-node from v6.4.0 to v7.0.0 in ~15 workflow files. Per the upstream release notes, v7.0.0 is a major release that migrates the action to ESM and upgrades @actions/cache to 5.1.0. The usage here (node-version + cache: pnpm) is standard and unlikely to break, but because it crosses a major boundary it is worth confirming the pnpm cache behavior and Node 24 runner support still function as expected in CI before merge. All inputs used (node-version, cache) remain valid in v7.
Was this helpful? React with 👍 or 👎 to provide feedback.
042ed47 to
2c731a9
Compare
@trigger.dev/build
trigger.dev
@trigger.dev/core
@trigger.dev/python
@trigger.dev/react-hooks
@trigger.dev/redis-worker
@trigger.dev/rsc
@trigger.dev/schema-to-json
@trigger.dev/sdk
commit: |
2c731a9 to
f7ea4d6
Compare
… updates Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.157` | `1.0.183` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.5.2` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.0` | `4.1.1` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.2` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | | [mitchellh/vouch/action/check-pr](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [mitchellh/vouch/action/manage-by-issue](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.1` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) Updates `anthropics/claude-code-action` from 1.0.157 to 1.0.183 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@428971d...be7b93b) Updates `docker/login-action` from 4.2.0 to 4.5.2 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...371161b) Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@fbd0ab8...7b450ff) Updates `actions/attest-build-provenance` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@a2bbfa2...0f67c3f) Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 - [Release notes](https://github.com/denoland/setup-deno/releases) - [Commits](denoland/setup-deno@667a34c...22d081f) Updates `mitchellh/vouch/action/check-pr` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `mitchellh/vouch/action/manage-by-issue` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.1 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@192e21d...6fc4b00) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.179 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: denoland/setup-deno dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: mitchellh/vouch/action/check-pr dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: mitchellh/vouch/action/manage-by-issue dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
f7ea4d6 to
03f979e
Compare
|
|
||
| - name: Run zizmor | ||
| uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 | ||
| uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 |
There was a problem hiding this comment.
🔍 zizmor-action minor bump may change findings on workflows that rely on ignore comments
zizmorcore/zizmor-action moves 0.5.7 -> 0.6.1, a minor bump of the tool that audits every workflow in this repo. Several workflows depend on inline suppressions being honored — # zizmor: ignore[artipacked] in .github/workflows/changesets-pr.yml:29 and .github/workflows/release.yml:70, and # zizmor: ignore[dangerous-triggers] in .github/workflows/vouch-check-pr.yml:4. A new analysis version can add audits or rename rule IDs, either of which would surface new SARIF findings in the Security tab. This job uploads SARIF and does not gate, so any new findings would be non-blocking but silent unless someone checks.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Bumps the github-actions group with 11 updates in the / directory:
7.0.07.0.16.4.07.0.01.0.1571.0.1834.2.04.5.24.0.14.0.24.1.04.1.13.0.13.0.22.0.42.0.51.4.21.5.01.4.21.5.00.5.70.6.1Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-nodefrom 6.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
anthropics/claude-code-actionfrom 1.0.157 to 1.0.183Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
be7b93bchore: bump Claude Code to 2.1.220 and Agent SDK to 0.3.220e0cf66dchore: bump Claude Code to 2.1.219 and Agent SDK to 0.3.21944423bdchore: bump Claude Code to 2.1.218 and Agent SDK to 0.3.218b00a341fix: share one exchanged WIF credential across spawned Claude processes (#1407)fa7e2f0chore: bump Claude Code to 2.1.217 and Agent SDK to 0.3.217b76a077chore: bump Claude Code to 2.1.216 and Agent SDK to 0.3.216af0559echore: bump Claude Code to 2.1.215 and Agent SDK to 0.3.2153553f84chore: bump Claude Code to 2.1.214 and Agent SDK to 0.3.214700e7f8chore: bump Claude Code to 2.1.212 and Agent SDK to 0.3.2123e807ecfix: handle null comment/review author from deleted accounts (#1490)Updates
docker/login-actionfrom 4.2.0 to 4.5.2Release notes
Sourced from docker/login-action's releases.
Commits
371161bMerge pull request #1058 from crazy-max/fix-dockerhub-oidc-error-handling5dc73dfchore: update generated content2aa1edesurface Docker Hub OIDC error responsesabd2ef4Merge pull request #1055 from crazy-max/test-registry-auth-oidcd49d3a9Merge pull request #1054 from crazy-max/oidc-missing-dhib58b17ctest: cover Docker Hub OIDC with registry-authbe646c2chore: update generated contentd77c059support dhi.io as Docker Hub OIDC registry06fb636Merge pull request #1037 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...a8bc953[dependabot skip] chore: update generated contentUpdates
dorny/paths-filterfrom 4.0.1 to 4.0.2Release notes
Sourced from dorny/paths-filter's releases.
Changelog
Sourced from dorny/paths-filter's changelog.
... (truncated)
Commits
7b450ffdocs: update changelog for v4.0.2 (#318)9280377fix: work around git dubious ownership errors in container jobs (#317)f3ceefdfix: use rev-parse instead of branch --show-current for older git compat (#303)61f87a1chore: fix GitHub spelling in logs (#278)b82ff81fix warning message (#282)Updates
actions/attest-build-provenancefrom 4.1.0 to 4.1.1Release notes
Sourced from actions/attest-build-provenance's releases.
Commits
0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)Updates
softprops/action-gh-releasefrom 3.0.1 to 3.0.2Release notes
Sourced from softprops/action-gh-release's releases.
Changelog
Sourced from softprops/action-gh-release's changelog.
... (truncated)
Commits
3d0d988release 3.0.2 (#818)7e13ed4fix: clarify release creation 404 errors (#817)e6c70a5fix: replace existing release assets on Gitea (#816)f345337fix: publish existing draft releases as prereleases (#801)d8a89a2fix: upload small checksum assets reliably (#815)45ece40chore(deps): remove unused TypeScript tooling (#814)f6b913cfeat: improve release error reporting and test coverage (#813)15f193dchore(deps): upgrade TypeScript to 7 (#812)cc8268dchore(deps): bump actions/checkout in the github-actions group (#810)fd0ed1echore(deps): bump the npm group with 3 updates (#811)Updates
denoland/setup-denofrom 2.0.4 to 2.0.5Release notes
Sourced from denoland/setup-deno's releases.
Commits
22d081f2.0.5 (#131)28c677fchore: use versions.json from dl.deno.land (#130)ff4860f2.0.4 (#125)6a293fcfeat: upgrade Node.js runtime from node20 to node24 (#123)390061adocs: fix identifier for latest stable release (#115)bdaa2e4docs: condense Deno version information in one section (#100)e4ff81cdocs: add lts as possible release-channel output (#99)bac1f72Update actions/checkout (#106)2f7698f2.0.3 (#102)ee64dd3fix: switch back to package.json as it's necessary for GH actions (#101)Updates
mitchellh/vouch/action/check-prfrom 1.4.2 to 1.5.0Release notes
Sourced from mitchellh/vouch/action/check-pr's releases.
Commits
d66fa29Merge pull request #93 from mitchellh/dependabot/github_actions/actions/check...c22b93dBump actions/checkout from 6.0.2 to 7.0.0baeb3bfMerge pull request #90 from trag1c/lock-issues52aec3dadd an option to lock closed issues3dbc69cMerge pull request #87 from freepicheep/example-attributea693346Update VOUCHED list21177c0Merge pull request #74 from pavelzw/vouch-cli527cdc3Merge pull request #81 from mitchellh/dependabot/github_actions/hustcer/setup...1895e9cfeat: use@exampleattribute for command examples8c80adaUpdate READMEUpdates
mitchellh/vouch/action/manage-by-issuefrom 1.4.2 to 1.5.0Release notesDescription has been truncated