Uh oh!
There was an error while loading. Please reload this page.
chore(deps): bump the official-actions group across 1 directory with 3 updates - #2941
Conversation
be1eda1 to
db1132cCompareThere was a problem hiding this comment.
Pull request overview
This PR updates pinned GitHub Actions SHAs in existing workflows to newer major versions for the “official-actions” set, keeping CI and dependency-audit automation aligned with upstream security and runtime improvements.
Changes:
- Bump
actions/checkoutto v7.0.1 (pinned by commit SHA) in the dependency audit workflow. - Bump
actions/setup-nodeto v7.0.0 (pinned by commit SHA) in the dependency audit workflow. - Bump
actions/cacheto v6.1.0 (pinned by commit SHA) for the Electron artifact cache step in CI.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/dependency-audit.yml | Updates checkout/setup-node action pins used by the dependency audit job. |
| .github/workflows/ci.yml | Updates the cache action pin for restoring the Electron artifact cache in CI. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…3 updates Bumps the official-actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-node](https://github.com/actions/setup-node) and [actions/cache](https://github.com/actions/cache). Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.4.0...3d3c42e) Updates `actions/setup-node` from 4.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4.4.0...8207627) Updates `actions/cache` from 4.3.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...55cc834) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: official-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: official-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: official-actions ... Signed-off-by: dependabot[bot] <support@github.com>
db1132c to
b792ab2Compare
Astro-Han
left a comment
There was a problem hiding this comment.
Thanks for keeping the remaining official Actions pins aligned. I reviewed exact head b792ab28f8f9712befe0e7336c74dd501219a47e.
The change is the smallest sufficient solution: it updates only the three stale SHA-pinned references and does not add a parallel dependency path or unrelated configuration. I verified that the new SHAs correspond to the advertised upstream tags, the Node 24 runner requirement is satisfied by the GitHub-hosted runners used here, and the affected checkout/cache/setup-node inputs remain compatible. The dependency-audit and current-head CI runs are green.
Conclusion: APPROVE — no P0–P3 findings.
AI-assisted review disclosure: Codex coordinated an independent @reviewer pass and a read-only ollama-cloud/deepseek-v4-flash:high pass. The review checked the exact pins, upstream tag correspondence, relevant major-version compatibility, workflow usage, and current-head checks. A human contributor remains responsible for the final merge decision.
中文摘要
已审查当前 head。三个官方 Action 的 SHA 与对应上游 tag 一致；Node 24 runner 要求与仓库使用的 GitHub-hosted runners 兼容，现有 checkout/cache/setup-node 参数没有发现破坏性变化，当前 CI 与依赖审计均通过。改动只更新三个过期 pin，是最小充分方案，没有 P0–P3 问题。结论：APPROVE。
Uh oh!
There was an error while loading. Please reload this page.
Bumps the official-actions group with 3 updates in the / directory: actions/checkout, actions/setup-node and actions/cache.
Updates
actions/checkoutfrom 4.4.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-nodefrom 4.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
actions/cachefrom 4.3.0 to 6.1.0Release notes
Sourced from actions/cache's releases.
... (truncated)
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
55cc834Merge pull request #1768 from jasongin/readonly-cached8cd72fBump@actions/cacheto v6.1.0 - handle cache write error due to RO token2c8a9bdMerge pull request #1760 from actions/samirat/esm_migration_and_package_updatee9b91fdPrettier fixese4884b8Rebuild dist10baf01Fixed licensese39b386Fix test mock return orderb692820PR feedback6074912Rebuild dist bundles as ESM to match type:module5a912e8Fix lint and jest issues