chore(deps): update github actions (major) - #97
Conversation
![ferrfleet[bot]](https://avatars.githubusercontent.com/in/4354888?s=60&v=4){kind=small}
There was a problem hiding this comment.
Ten actions bumped to their next major, re-pinned to SHA with version comments. Checked all 10 SHAs against their claimed tags (checkout v7, pnpm/action-setup v6, setup-node v7, setup-helm v5, setup-buildx v4, login-action v4, build-push-action v7, upload-artifact v7, download-artifact v8, metadata-action v6) — all match.
Went through each changelog against how this repo actually calls the action:
- checkout v5→v7: no inputs used beyond
fetch-depth/persist-credentials/ref; the v7 restriction on unsafe fork-PR ref overrides doesn't apply (nopull_request_targetusage here) and was already live since v5.1 anyway. - pnpm/action-setup v4→v6, setup-node v6→v7, setup-helm v4→v5, setup-buildx v3→v4, login-action v3→v4, build-push-action v6→v7, metadata-action v5→v6: no breaking change touches the inputs this repo sets (node-version/cache, registry/username/password, context/file/platforms/cache-*/outputs, images/tags). Safe.
- upload-artifact v4→v7: default zip-upload behavior with
name/path/retention-days/if-no-files-foundis unchanged.
Nit: download-artifact v4→v8 (image.yml's manifest job, downloading digest-* by pattern with merge-multiple: true) — v8.0.0 makes artifact digest mismatches a hard error by default instead of a warning. Legitimate hardening, but it's a fail-closed behavior change on a path this PR's CI doesn't exercise (image.yml is workflow_call/workflow_dispatch only, not triggered by push/PR). Worth a mental note the next time an image build runs, not a reason to hold this up.
CI: the checks that have finished are green (conventional-commit, sign-off, chart, resolve-latest-release-tag); build/compose/coverage were still running as of this review with nothing failed. No CI failures tied to this bump.
SonarQube — aucune nouvelle issueComparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail |
23ded01 to
26e1c2c
Compare
Signed-off-by: ferrlabs-renovate[bot] <282300760+ferrlabs-renovate[bot]@users.noreply.github.com>
26e1c2c to
5939b81
Compare
This PR contains the following updates:
v5→v7v4→v8v6→v7v4→v7v4→v5v6→v7v3→v4v5→v6v3→v4v4→v6v6.1.0Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v6.0.3...v6.1.0
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
actions/download-artifact (actions/download-artifact)
v8.0.1Compare Source
What's Changed
Full Changelog: actions/download-artifact@v8...v8.0.1
v8.0.0Compare Source
v8 - What's new
Direct downloads
To support direct uploads in
actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks theContent-Typeheader ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the newskip-decompressparameter totrue.Enforced checks (breaking)
A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the
digest-mismatchparameter. To be secure by default, we are now defaulting the behavior toerrorwhich will fail the workflow run.ESM
To support new versions of the @actions/* packages, we've upgraded the package to ESM.
What's Changed
errorby @danwkennedy in #461Full Changelog: actions/download-artifact@v7...v8.0.0
v7.0.0Compare Source
v7 - What's new
Node.js 24
This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
What's Changed
New Contributors
Full Changelog: actions/download-artifact@v6.0.0...v7.0.0
v6.0.0Compare Source
What's Changed
BREAKING CHANGE: this update supports Node
v24.x. This is not a breaking change per-se but we're treating it as such.@actions/artifacttov4.0.0v6.0.0by @danwkennedy in #438New Contributors
Full Changelog: actions/download-artifact@v5...v6.0.0
v5.0.0Compare Source
What's Changed
v5.0.0
🚨 Breaking Change
This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.
What Changed
Previously, single artifact downloads behaved differently depending on how you specified the artifact:
name: my-artifact→ extracted topath/(direct)artifact-ids: 12345→ extracted topath/my-artifact/(nested)Now both methods are consistent:
name: my-artifact→ extracted topath/(unchanged)artifact-ids: 12345→ extracted topath/(fixed - now direct)Migration Guide
✅ No Action Needed If:
merge-multiple: trueas a workaroundYou download single artifacts by ID and your workflows expect the nested directory structure.
Before v5 (nested structure):
To maintain old behavior (if needed):
New Contributors
Full Changelog: actions/download-artifact@v4...v5.0.0
actions/setup-node (actions/setup-node)
v7.0.0Compare Source
What's Changed
Enhancements:
Bug fixes:
mirrorTokeningetManifestif it's provided by @deiga in #1548Documentation updates:
Dependency update:
New Contributors
Full Changelog: actions/setup-node@v6...v7.0.0
actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
v7.0.0Compare Source
v7 What's new
Direct Uploads
Adds support for uploading single files directly (unzipped). Callers can set the new
archiveparameter tofalseto skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. Thenameparameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.ESM
To support new versions of the
@actions/*packages, we've upgraded the package to ESM.What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v6...v7.0.0
v6.0.0Compare Source
v6 - What's new
Node.js 24
This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
What's Changed
Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0
v5.0.0Compare Source
What's Changed
BREAKING CHANGE: this update supports Node
v24.x. This is not a breaking change per-se but we're treating it as such.@actions/artifacttov4.0.0v5.0.0by @danwkennedy in #734New Contributors
Full Changelog: actions/upload-artifact@v4...v5.0.0
azure/setup-helm (azure/setup-helm)
v5.0.1Compare Source
Fixed
Changed
v5.0.0Compare Source
Changed
docker/build-push-action (docker/build-push-action)
v7.3.0Compare Source
Full Changelog: docker/build-push-action@v7.2.0...v7.3.0
v7.2.0Compare Source
Full Changelog: docker/build-push-action@v7.1.0...v7.2.0
v7.1.0Compare Source
Full Changelog: docker/build-push-action@v7.0.0...v7.1.0
v7.0.0Compare Source
DOCKER_BUILD_NO_SUMMARYandDOCKER_BUILD_EXPORT_RETENTION_DAYSenvs by @crazy-max in #1473Full Changelog: docker/build-push-action@v6.19.2...v7.0.0
docker/login-action (docker/login-action)
v4.6.0Compare Source
Full Changelog: docker/login-action@v4.5.2...v4.6.0
v4.5.2Compare Source
Full Changelog: docker/login-action@v4.5.1...v4.5.2
v4.5.1Compare Source
dhi.ioas Docker Hub OIDC registry by @crazy-max in #1054Full Changelog: docker/login-action@v4.5.0...v4.5.1
v4.5.0Compare Source
Full Changelog: docker/login-action@v4.4.0...v4.5.0
v4.4.0Compare Source
registry-authsecret mask by @crazy-max in #1035Full Changelog: docker/login-action@v4.3.0...v4.4.0
v4.3.0Compare Source
Full Changelog: docker/login-action@v4.2.0...v4.3.0
v4.2.0Compare Source
Full Changelog: docker/login-action@v4.1.0...v4.2.0
v4.1.0Compare Source
Full Changelog: docker/login-action@v4.0.0...v4.1.0
v4.0.0Compare Source
Full Changelog: docker/login-action@v3.7.0...v4.0.0
docker/metadata-action (docker/metadata-action)
v6.2.0Compare Source
Full Changelog: docker/metadata-action@v6.1.0...v6.2.0
v6.1.0Compare Source
Full Changelog: docker/metadata-action@v6.0.0...v6.1.0
v6.0.0Compare Source
#inside values while still supporting full-line#comments by @crazy-max in #607Full Changelog: docker/metadata-action@v5.10.0...v6.0.0
docker/setup-buildx-action (docker/setup-buildx-action)
v4.3.0Compare Source
Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0
v4.2.0Compare Source
Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0
v4.1.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.