Skip to content

Bump the github-actions group across 1 directory with 8 updates - #1113

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-dd5d4a4a48
Open

Bump the github-actions group across 1 directory with 8 updates#1113
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-dd5d4a4a48

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 8 updates in the / directory:

Package From To
actions/checkout 6.0.2 7.0.1
actions/setup-node 6.3.0 7.0.0
ruby/setup-ruby 1.299.0 1.321.0
rhysd/actionlint 1.7.11 1.7.12
zizmorcore/zizmor-action 0.5.2 0.6.2
actions/upload-artifact 7.0.0 7.0.1
actions/cache 4.3.0 6.1.0
actions/upload-pages-artifact 4.0.0 5.0.0

Updates actions/checkout from 6.0.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-node from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates ruby/setup-ruby from 1.299.0 to 1.321.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.321.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.320.0...v1.321.0

v1.320.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.319.0...v1.320.0

v1.319.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.318.0...v1.319.0

v1.318.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.317.0...v1.318.0

v1.317.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.316.0...v1.317.0

v1.316.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.315.0...v1.316.0

v1.315.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.314.0...v1.315.0

... (truncated)

Commits
  • 95ef2b0 Add jruby-10.1.1.0
  • a30dfa4 Update CRuby releases on Windows
  • 003a5c4 Add ruby-3.3.12
  • 8e41b36 Update CRuby releases on Windows
  • 6e5d382 Add ruby-4.0.6
  • d45b1a4 Update CRuby releases on Windows
  • 0dafeac Add ruby-3.4.10
  • bf35c27 Bump actions/checkout from 6 to 7
  • 9eb537c Add support for ubuntu-26.04 and ubuntu-26.04-arm
  • e1a3b10 Improve versions-strings-for-builder.rb
  • Additional commits viewable in compare view

Updates rhysd/actionlint from 1.7.11 to 1.7.12

Release notes

Sourced from rhysd/actionlint's releases.

v1.7.12

Changelog

Sourced from rhysd/actionlint's changelog.

v1.7.12 - 2026-03-30

[Changes][v1.7.12]

v1.7.11 - 2026-02-14

  • Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @​heppu) 
    env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}
  • Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @​hugovk and @​muzimuzhi)
  • Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @​takaram) 
    $ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API
The following policy criteria will be enforced:

Predicate type must match:................ https://slsa.dev/provenance/v1
Source Repository Owner URI must match:... https://github.com/rhysd
Source Repository URI must match:......... https://github.com/rhysd/actionlint
Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

... (truncated)

Commits

Updates zizmorcore/zizmor-action from 0.5.2 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

v0.6.1

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

v0.5.7

1.26.1 is now available via the action 1.26.1 is now the default version of zizmor used by the action

v0.5.6

  • 1.25.2 is now available via the action
  • 1.25.2 is now the default version of zizmor used by the action

v0.5.5

This is a no-op release.

v0.5.4

  • 1.25.0 is now available via the action
  • 1.25.0 is now the default version of zizmor used by the action

v0.5.3

What's Changed

  • 1.24.0 and 1.24.1 are now available via the action
  • 1.24.1 is now the default version of zizmor used by the action

Full Changelog: zizmorcore/zizmor-action@v0.5.2...v0.5.3

Commits

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • See full diff in compare view

Updates actions/cache from 4.3.0 to 6.1.0

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates actions/upload-pages-artifact from 4.0.0 to 5.0.0

Release notes

Sourced from actions/upload-pages-artifact's releases.

v5.0.0

Changelog

See details of all code changes since previous release.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 13, 2026
Copilot AI balanced review requested due to automatic review settings June 13, 2026 12:23
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 13, 2026
Copilot AI reviewed Jun 13, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-dd5d4a4a48 branch 2 times, most recently from 1c46f62 to 477267d Compare June 27, 2026 12:23
Copilot AI review requested due to automatic review settings June 27, 2026 12:23
Copilot AI reviewed Jun 27, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-dd5d4a4a48 branch 2 times, most recently from 3707adf to 6ce114d Compare July 4, 2026 12:23
Copilot AI review requested due to automatic review settings July 4, 2026 12:23
Copilot AI reviewed Jul 4, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-dd5d4a4a48 branch 2 times, most recently from b606099 to c6bf2a7 Compare July 11, 2026 12:23
Copilot AI review requested due to automatic review settings July 11, 2026 12:23
Copilot AI reviewed Jul 11, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-dd5d4a4a48 branch from c6bf2a7 to b8ba12a Compare July 18, 2026 12:23
Copilot AI review requested due to automatic review settings July 18, 2026 12:23
Copilot AI reviewed Jul 18, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

.github/workflows/ci.yml:2

  • The workflows rely on pinned SHAs (good), but the trailing # vX.Y.Z comments are the only human-friendly audit trail. Please verify the comment versions actually correspond to the pinned commits/tags (and are from the expected upstream repositories), otherwise future audits/debugging may be misleading. If mismatched, update the comments (or consider linking to the release/tag URL in the comment).

Comment thread .github/workflows/ci.yml Outdated
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
Comment thread .github/workflows/ci.yml Outdated

- name: Set up Ruby
uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0
uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
Comment thread .github/workflows/ci.yml Outdated

- name: Set up Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
Copilot AI review requested due to automatic review settings July 25, 2026 12:23
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-dd5d4a4a48 branch from b8ba12a to 731aea3 Compare July 25, 2026 12:23
Copilot AI reviewed Jul 25, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

Comment thread .github/workflows/ci.yml
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread .github/workflows/ci.yml Outdated

- name: Set up Ruby
uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0
uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
Comment thread .github/workflows/ci.yml

- name: Set up Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
Comment thread .github/workflows/ci.yml
- name: Cache Playwright browsers
id: playwright-cache
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
Copilot AI review requested due to automatic review settings August 1, 2026 12:26
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-dd5d4a4a48 branch from 731aea3 to 91626bb Compare August 1, 2026 12:26
Copilot AI reviewed Aug 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (9)

.github/workflows/home.yml:28

  • Because these actions are pinned by SHA, the trailing # v… comments are often relied on by tooling (e.g., Dependabot’s version detection for pinned-action updates) and by humans during audits. Please verify that each # vX.Y.Z comment matches the actual upstream tag that contains the pinned SHA; if not, update the comment to the correct tag/version (or to the intended major tag like # v4) to avoid misleading dependency tracking.
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/home.yml:33

  • Because these actions are pinned by SHA, the trailing # v… comments are often relied on by tooling (e.g., Dependabot’s version detection for pinned-action updates) and by humans during audits. Please verify that each # vX.Y.Z comment matches the actual upstream tag that contains the pinned SHA; if not, update the comment to the correct tag/version (or to the intended major tag like # v4) to avoid misleading dependency tracking.
        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0

.github/workflows/home.yml:48

  • Because these actions are pinned by SHA, the trailing # v… comments are often relied on by tooling (e.g., Dependabot’s version detection for pinned-action updates) and by humans during audits. Please verify that each # vX.Y.Z comment matches the actual upstream tag that contains the pinned SHA; if not, update the comment to the correct tag/version (or to the intended major tag like # v4) to avoid misleading dependency tracking.
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0

.github/workflows/ci.yml:18

  • Same concern as in home.yml: with SHAs, the # v… annotations need to match the actual tags that include those commits, otherwise dependency update tooling and reviews can be misled. Additionally, actions/cache is being bumped across major versions per the comment (v4.x → v6.x); please confirm the pinned SHA corresponds to the intended release line and that any breaking input/output changes are accounted for, and adjust the # v… annotation accordingly.
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/ci.yml:23

  • Same concern as in home.yml: with SHAs, the # v… annotations need to match the actual tags that include those commits, otherwise dependency update tooling and reviews can be misled. Additionally, actions/cache is being bumped across major versions per the comment (v4.x → v6.x); please confirm the pinned SHA corresponds to the intended release line and that any breaking input/output changes are accounted for, and adjust the # v… annotation accordingly.
        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0

.github/workflows/ci.yml:29

  • Same concern as in home.yml: with SHAs, the # v… annotations need to match the actual tags that include those commits, otherwise dependency update tooling and reviews can be misled. Additionally, actions/cache is being bumped across major versions per the comment (v4.x → v6.x); please confirm the pinned SHA corresponds to the intended release line and that any breaking input/output changes are accounted for, and adjust the # v… annotation accordingly.
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/ci.yml:176

  • Same concern as in home.yml: with SHAs, the # v… annotations need to match the actual tags that include those commits, otherwise dependency update tooling and reviews can be misled. Additionally, actions/cache is being bumped across major versions per the comment (v4.x → v6.x); please confirm the pinned SHA corresponds to the intended release line and that any breaking input/output changes are accounted for, and adjust the # v… annotation accordingly.
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

.github/workflows/benchmarks.yml:24

  • Please validate that the # v… comments align with the actual upstream tags for these pinned SHAs. Keeping these annotations accurate improves auditability and helps automation correctly detect available updates for pinned GitHub Actions.
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/benchmarks.yml:65

  • Please validate that the # v… comments align with the actual upstream tags for these pinned SHAs. Keeping these annotations accurate improves auditability and helps automation correctly detect available updates for pinned GitHub Actions.
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

@dependabot
Bump the github-actions group across 1 directory with 8 updates
3c131fa 
Bumps the github-actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.1` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `7.0.0` |
| [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.299.0` | `1.321.0` |
| [rhysd/actionlint](https://github.com/rhysd/actionlint) | `1.7.11` | `1.7.12` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.2` | `0.6.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` |
| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `4.0.0` | `5.0.0` |



Updates `actions/checkout` from 6.0.2 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...3d3c42e)

Updates `actions/setup-node` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...8207627)

Updates `ruby/setup-ruby` from 1.299.0 to 1.321.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](ruby/setup-ruby@3ff19f5...95ef2b0)

Updates `rhysd/actionlint` from 1.7.11 to 1.7.12
- [Release notes](https://github.com/rhysd/actionlint/releases)
- [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md)
- [Commits](rhysd/actionlint@393031a...914e7df)

Updates `zizmorcore/zizmor-action` from 0.5.2 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@71321a2...3dc1ecc)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `actions/cache` from 4.3.0 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0057852...55cc834)

Updates `actions/upload-pages-artifact` from 4.0.0 to 5.0.0
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](actions/upload-pages-artifact@7b1f4a7...fc324d3)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/upload-pages-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: rhysd/actionlint
  dependency-version: 1.7.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: ruby/setup-ruby
  dependency-version: 1.310.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI review requested due to automatic review settings August 8, 2026 12:23
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-dd5d4a4a48 branch from 91626bb to 3c131fa Compare August 8, 2026 12:23
Copilot AI reviewed Aug 8, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (12)

.github/workflows/ci.yml:18

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/ci.yml:23

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0

.github/workflows/ci.yml:29

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/ci.yml:50

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/ci.yml:69

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/ci.yml:74

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/ci.yml:108

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/ci.yml:113

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0

.github/workflows/ci.yml:120

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/ci.yml:157

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/ci.yml:162

  • The same action SHAs are repeated many times within this workflow (and across other workflows). This makes future bumps error-prone and time-consuming. Consider factoring these jobs into a reusable workflow (or a composite action) so action version updates happen in one place.
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/ci.yml:176

  • This is a major-version jump for actions/cache (v4 → v6). Major upgrades can include behavior changes that affect cache restore/save semantics and, in turn, CI reliability/time. To reduce operational risk, add a brief note (in-file comment or PR description) referencing the upstream release notes/why this major bump is safe for your usage (paths/keys), so future debugging has clear provenance.
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant