chore(deps): bump the github-actions group with 8 updates #3209
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Setup node | ||
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | ||
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v4 |
Check warning
Code scanning / zizmor
detects commit SHAs that don't match their version comment tags Warning
|
|
||
| - name: Setup node | ||
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | ||
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v4 |
Check warning
Code scanning / zizmor
detects commit SHAs that don't match their version comment tags Warning
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
|
||
| - name: Setup node | ||
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | ||
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v4 |
There was a problem hiding this comment.
comment says # v4 but the hash 6044e13b5dc448c55e2357c09f80417699197238 is for v6.2.0
Suggested change
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v4 | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 |
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/tidy3d-python-client-tests.yml
Line: 383:383
Comment:
comment says `# v4` but the hash `6044e13b5dc448c55e2357c09f80417699197238` is for v6.2.0
```suggestion
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
```
How can I resolve this? If you propose a fix, please make it concise.
Contributor
There was a problem hiding this comment.
hoped that dependabot did it automatically :/
Additional Comments (1)
All updated actions ( Prompt To Fix With AIThis is a comment left during a code review.
Path: .github/workflows/tidy3d-python-client-tests.yml
Line: 592:592
Comment:
check that self-hosted runner `slurm-runner` is updated to minimum v2.327.1
All updated actions (`actions/checkout` v6, `actions/upload-artifact` v6, `actions/download-artifact` v7, `actions/github-script` v8) require minimum Actions Runner version v2.327.1 due to Node.js 24 requirement.
How can I resolve this? If you propose a fix, please make it concise. |
Contributor
Diff CoverageDiff: origin/develop...HEAD, staged and unstaged changesNo lines with coverage information in this diff. |
Bumps the github-actions group with 8 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `4.0.2` | `5.1.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `6.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `7.0.0` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.0.8` | `2.5.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6.7.0` | `7.2.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.2.0` | | [actions/github-script](https://github.com/actions/github-script) | `7.1.0` | `8.0.0` | Updates `actions/checkout` from 4.3.1 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.3.1...de0fac2) Updates `aws-actions/configure-aws-credentials` from 4.0.2 to 5.1.1 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@e3dd6a4...61815dc) Updates `actions/upload-artifact` from 4.6.2 to 6.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...b7c566a) Updates `actions/download-artifact` from 4.3.0 to 7.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...37930b1) Updates `softprops/action-gh-release` from 2.0.8 to 2.5.0 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@c062e08...a06a81a) Updates `astral-sh/setup-uv` from 6.7.0 to 7.2.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@b75a909...61cb8a9) Updates `actions/setup-node` from 4.4.0 to 6.2.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@49933ea...6044e13) Updates `actions/github-script` from 7.1.0 to 8.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@f28e40c...ed59741) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: 5.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
force-pushed
the
dependabot/github_actions/github-actions-82065b233a
branch
from
9101c58 to
1812653
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 8 updates:
4.3.16.0.24.0.25.1.14.6.26.0.04.3.07.0.02.0.82.5.06.7.07.2.04.4.06.2.07.1.08.0.0Updates
actions/checkoutfrom 4.3.1 to 6.0.2Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)Updates
aws-actions/configure-aws-credentialsfrom 4.0.2 to 5.1.1Release notes
Sourced from aws-actions/configure-aws-credentials's releases.
... (truncated)
Changelog
Sourced from aws-actions/configure-aws-credentials's changelog.
... (truncated)
Commits
61815dcchore(main): release 5.1.1 (#1564)56d6a58chore: release 5.1.14a54c24chore(deps-dev): bump glob from 10.4.5 to 10.5.0 (#1563)b2793c9chore(deps-dev): bump@types/nodefrom 24.10.0 to 24.10.1 (#1559)8c230bfchore: Update distf7a5b07chore(deps): bump@aws-sdk/client-stsfrom 3.928.0 to 3.933.0 (#1558)730fc04chore(deps-dev): bump@biomejs/biomefrom 2.3.4 to 2.3.6 (#1555)bc0dd36chore(deps-dev): bump memfs from 4.50.0 to 4.51.0 (#1556)f2964c7chore: Update distcf46495chore(deps): bump@aws-sdk/client-stsfrom 3.922.0 to 3.928.0 (#1548)Updates
actions/upload-artifactfrom 4.6.2 to 6.0.0Release notes
Sourced from actions/upload-artifact's releases.
Commits
b7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEddc45eddocs: update README to correct action name for Node.js 24 support615b319chore: release v6.0.0 for Node.js 24 support017748bMerge pull request #744 from actions/fix-storage-blob38d4c79chore: rebuild dist7d27270chore: add missing license cache files for@actions/core,@actions/io, and mi...5f643d3chore: update license files for@actions/artifact@5.0.1 dependencies1df1684chore: update package-lock.json with@actions/artifact@5.0.1b5b1a91fix: update@actions/artifactto ^5.0.0 for Node.js 24 punycode fixUpdates
actions/download-artifactfrom 4.3.0 to 7.0.0Release notes
Sourced from actions/download-artifact's releases.
... (truncated)
Commits
37930b1Merge pull request #452 from actions/download-artifact-v7-release72582b9doc: update readme0d2ec9dchore: release v7.0.0 for Node.js 24 supportfd7ae8fMerge pull request #451 from actions/fix-storage-blobd484700chore: restore minimatch.dep.yml license file03a8080chore: remove obsolete dependency license files56fe6d9chore: update@actions/artifactlicense file to 5.0.18e3ebc4chore: update package-lock.json with@actions/artifact@5.0.11e3c4b4fix: update@actions/artifactto ^5.0.0 for Node.js 24 punycode fix458627dchore: use local@actions/artifactpackage for Node.js 24 testingUpdates
softprops/action-gh-releasefrom 2.0.8 to 2.5.0Release notes
Sourced from softprops/action-gh-release's releases.
... (truncated)
Changelog
Sourced from softprops/action-gh-release's changelog.
... (truncated)
Commits
a06a81arelease 2.5.07da8983feat: mark release as draft until all artifacts are uploaded (#692)8797328chore(deps): bump actions/checkout in the github-actions group (#689)1bfc62achore(deps): bump the npm group across 1 directory with 5 updates (#697)5be0e66release 2.4.2af658b4feat: Ensure generated release notes cannot be over 125000 characters (#684)237aaccchore: bump node to 24.11.000362bechore(deps): bump the npm group with 5 updates (#687)0adea5achore(deps): bump the npm group with 3 updates (#686)aa05f9dchore(deps): bump actions/setup-node from 5.0.0 to 6.0.0 in the github-action...Updates
astral-sh/setup-uvfrom 6.7.0 to 7.2.0Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
61cb8a9add outputs python-version and python-cache-hit (#728)11050edfix: use uv_build backend for old-python-constraint-project (#729)1d22fafBump peter-evans/create-pull-request from 7.0.9 to 8.0.0 (#719)f4ed82aBump github/codeql-action from 4.31.6 to 4.31.9 (#723)e0409b4chore: update known checksums for 0.9.22 (#727)702b425chore: update known checksums for 0.9.21 (#726)2630c86chore: update known checksums for 0.9.20 (#725)45cfcb3Add action typings with validation (#721)ce0a899chore: update known checksums for 0.9.18 (#718)9c8d030chore: remove stray space from UV_PYTHON_INSTALL_DIR message (#720)Updates
actions/setup-nodefrom 4.4.0 to 6.2.0Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
6044e13Docs: bump actions/checkout from v5 to v6 (#1468)8e49463Fix README typo (#1226)621ac41README.md: bump to latest released checkout version v6 (#1446)2951748Bump@actions/cacheto v5.0.1 (#1449)21ddc7bCorrect mirror option typos (#1442)65d868fUpdate Documentation for Lockfile (#1454)395ad32Bump js-yaml from 3.14.1 to 3.14.2 (#1435)a4d2e2bBump actions/checkout from 5 to 6 (#1439)b9b25d4Remove always-auth configuration handling from action (#1436)633bb92Bump@actions/cachefrom 4.0.3 to 4.1.0 (#1384)Updates
actions/github-scriptfrom 7.1.0 to 8.0.0Release notes
Sourced from actions/github-script's releases.
Commits
ed59741Merge pull request #653 from actions/sneha-krip/readme-for-v8Greptile Overview
Greptile Summary
This PR updates 8 GitHub Actions dependencies across workflow files, bringing critical security updates and new features while introducing Node.js 24 runtime requirements.
Key Changes:
actions/checkoutv4.3.1 → v6.0.2: Updates to Node.js 24 runtime with improved credential handlingaws-actions/configure-aws-credentialsv4.0.2 → v5.1.1: Breaking changes to input handling, adds timeout and proxy supportactions/upload-artifactv4.6.2 → v6.0.0: Node.js 24 runtime updateactions/download-artifactv4.3.0 → v7.0.0: Node.js 24 runtime update (major version jump)softprops/action-gh-releasev2.0.8 → v2.5.0: Adds draft-until-complete feature for releasesastral-sh/setup-uvv6.7.0 → v7.2.0: Adds python-version and python-cache-hit outputsactions/setup-nodev4.4.0 → v6.2.0: Breaking change limiting automatic caching to npm onlyactions/github-scriptv7.1.0 → v8.0.0: Updates to Node.js 24 runtimeIssues Found:
tidy3d-python-client-tests.yml(shows v4 but is actually v6.2.0)slurm-runnermust be verified to meet minimum runner version v2.327.1 for Node.js 24 compatibilityConfidence Score: 4/5
slurm-runnerused in the test suite needs verification. One minor documentation issue was found (incorrect version comment). All breaking changes are backward-compatible at the workflow level - no workflow syntax changes are required..github/workflows/tidy3d-python-client-tests.yml- contains incorrect version comment and uses self-hosted runner that needs runner version verificationImportant Files Changed
actions/checkout(v4.3.1→v6.0.2) andaws-actions/configure-aws-credentials(v4.0.2→v5.1.1) for integration testsactions/checkout(v4.3.1→v6.0.2),actions/upload-artifact(v4.6.2→v6.0.0),actions/download-artifact(v4.3.0→v7.0.0)actions/checkout(v4.3.1→v6.0.2),astral-sh/setup-uv(v6.7.0→v7.2.0),actions/setup-node(v4.4.0→v6.2.0),actions/github-script(v7.1.0→v8.0.0), andaws-actions/configure-aws-credentials(v4.0.2→v5.1.1); includes incorrect version comment for setup-node and potential self-hosted runner compatibility concernsSequence Diagram
sequenceDiagram participant Dev as Developer participant GH as GitHub Actions participant Checkout as actions/checkout v6.0.2 participant SetupNode as actions/setup-node v6.2.0 participant SetupUV as astral-sh/setup-uv v7.2.0 participant AWS as aws-actions/configure-aws-credentials v5.1.1 participant Artifacts as upload/download-artifact v6/v7 participant Release as softprops/action-gh-release v2.5.0 participant Script as actions/github-script v8.0.0 Dev->>GH: Push commit or create PR GH->>Checkout: Checkout repository Note over Checkout: Requires Runner v2.327.1+<br/>Uses Node.js 24 Checkout-->>GH: Code ready alt Code Quality Tests GH->>SetupNode: Setup Node.js for commitlint Note over SetupNode: v6 breaking change:<br/>Auto-caching limited to npm only SetupNode-->>GH: Node.js ready end alt Python Tests GH->>SetupUV: Setup UV for Python Note over SetupUV: Updated to v7.2.0 SetupUV-->>GH: UV ready GH->>AWS: Configure AWS credentials Note over AWS: v5 breaking change:<br/>Input handling updated AWS-->>GH: AWS configured end alt Build & Deploy GH->>Artifacts: Upload build artifacts Note over Artifacts: v6 requires Runner v2.327.1+<br/>Uses Node.js 24 Artifacts-->>GH: Artifacts stored GH->>Artifacts: Download artifacts for deployment Note over Artifacts: v7 requires Runner v2.327.1+<br/>Uses Node.js 24 Artifacts-->>GH: Artifacts retrieved end alt Release Process GH->>Release: Create GitHub release Note over Release: v2.5.0 adds draft-until-complete feature Release-->>GH: Release created end alt PR Automation GH->>Script: Run GitHub script for coverage Note over Script: v8 requires Runner v2.327.1+<br/>Uses Node.js 24 Script-->>GH: Script complete end GH-->>Dev: Workflow complete