chore(deps): update github actions (minor) - #1842
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
|
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates pinned GitHub Actions dependencies across CI/CD workflows to newer patch/minor versions for caching, releases, Docker builds, and SARIF uploads.
Changes:
- Bump
actions/cachefrom v5.0.5 to v5.1.0 across multiple workflows. - Bump
changesets/actionfrom v1.8.0 to v1.9.0 in the release workflow. - Bump Docker-related actions (login/setup-qemu/setup-buildx/metadata/build-push) and
github/codeql-action/upload-sarifto newer versions in image build workflows.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/release.yaml | Updates cache action and Changesets action versions used during release automation. |
| .github/workflows/deploy-pr-preview.yaml | Updates pnpm cache action version for PR preview deployments. |
| .github/workflows/deploy-github-pages.yaml | Updates pnpm cache action version for GitHub Pages deployments. |
| .github/workflows/ci-checks.yaml | Updates pnpm cache action version used in CI jobs. |
| .github/workflows/build-push-supernova-image.yaml | Updates Docker build/push pipeline actions and SARIF upload action versions. |
| .github/workflows/build-push-greenhouse-pr-preview.yaml | Updates Docker build/push pipeline actions for PR preview builds. |
| .github/workflows/build-push-greenhouse-image.yaml | Updates Docker build/push pipeline actions and SARIF upload action versions. |
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
July 28, 2026 07:30
d54133d to
9bf4de8
Compare
TilmanHaupt
previously approved these changes
Jul 28, 2026
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
July 28, 2026 10:48
9bf4de8 to
57b1585
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (4)
.github/workflows/ci-checks.yaml:41
- The same action SHAs are repeated across multiple workflow files/jobs in this PR, increasing the chance of future version drift (e.g., updating one workflow but missing another). Consider centralizing the shared ‘setup node + pnpm + cache’ logic into a reusable workflow (
workflow_call) or a composite action under.github/actions/...so action pins are defined in one place and reused everywhere.
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
.github/workflows/ci-checks.yaml:55
- The same action SHAs are repeated across multiple workflow files/jobs in this PR, increasing the chance of future version drift (e.g., updating one workflow but missing another). Consider centralizing the shared ‘setup node + pnpm + cache’ logic into a reusable workflow (
workflow_call) or a composite action under.github/actions/...so action pins are defined in one place and reused everywhere.
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
.github/workflows/ci-checks.yaml:90
- The same action SHAs are repeated across multiple workflow files/jobs in this PR, increasing the chance of future version drift (e.g., updating one workflow but missing another). Consider centralizing the shared ‘setup node + pnpm + cache’ logic into a reusable workflow (
workflow_call) or a composite action under.github/actions/...so action pins are defined in one place and reused everywhere.
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
.github/workflows/ci-checks.yaml:104
- The same action SHAs are repeated across multiple workflow files/jobs in this PR, increasing the chance of future version drift (e.g., updating one workflow but missing another). Consider centralizing the shared ‘setup node + pnpm + cache’ logic into a reusable workflow (
workflow_call) or a composite action under.github/actions/...so action pins are defined in one place and reused everywhere.
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
July 30, 2026 19:53
57b1585 to
ee160dd
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (5)
.github/workflows/release.yaml:41
- The inline
# vX.Y.Zcomments are used as the human-readable source of truth for what each pinned SHA represents. Please verify these version comments match the tag that contains the referenced commit SHA (or consider switching to tag-baseduses: ...@vXplus Dependabot, and only pin SHAs where required), to avoid future confusion during audits.
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
.github/workflows/release.yaml:55
- The inline
# vX.Y.Zcomments are used as the human-readable source of truth for what each pinned SHA represents. Please verify these version comments match the tag that contains the referenced commit SHA (or consider switching to tag-baseduses: ...@vXplus Dependabot, and only pin SHAs where required), to avoid future confusion during audits.
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
.github/workflows/release.yaml:67
- The inline
# vX.Y.Zcomments are used as the human-readable source of truth for what each pinned SHA represents. Please verify these version comments match the tag that contains the referenced commit SHA (or consider switching to tag-baseduses: ...@vXplus Dependabot, and only pin SHAs where required), to avoid future confusion during audits.
uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
.github/workflows/build-push-supernova-image.yaml:86
- Using
moby/buildkit:latestmakes builds non-reproducible and can introduce unexpected behavior (or supply-chain risk) when the upstream image changes. Prefer pinning the BuildKit image to a specific version tag or (best) an immutable digest.
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
with:
driver-opts: |
image=moby/buildkit:latest
.github/workflows/build-push-greenhouse-image.yaml:86
- Same issue as in the supernova workflow:
moby/buildkit:latestis mutable and can break reproducibility. Pin to a specific version or digest to make builds deterministic.
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
with:
driver-opts: |
image=moby/buildkit:latest
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
August 3, 2026 19:14
ee160dd to
319aa10
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
Suppressed comments (7)
.github/workflows/release.yaml:41
- The trailing
# vX.Y.Zcomments are being updated along with the pinned SHAs, but YAML comments are often used for human auditability/traceability. Please verify that each new SHA actually corresponds to the stated tagged release, or consider switching the comment to something unambiguous (e.g., the tag name resolved from the SHA at update time) to avoid misleading version attribution during security reviews.
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Setup Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
.github/workflows/release.yaml:55
- The trailing
# vX.Y.Zcomments are being updated along with the pinned SHAs, but YAML comments are often used for human auditability/traceability. Please verify that each new SHA actually corresponds to the stated tagged release, or consider switching the comment to something unambiguous (e.g., the tag name resolved from the SHA at update time) to avoid misleading version attribution during security reviews.
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
.github/workflows/release.yaml:67
- The trailing
# vX.Y.Zcomments are being updated along with the pinned SHAs, but YAML comments are often used for human auditability/traceability. Please verify that each new SHA actually corresponds to the stated tagged release, or consider switching the comment to something unambiguous (e.g., the tag name resolved from the SHA at update time) to avoid misleading version attribution during security reviews.
uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
.github/workflows/ci-checks.yaml:41
- These exact action pins are duplicated across multiple jobs (and across multiple workflow files in this PR). To reduce future drift and make upgrades less error-prone, consider centralizing common steps via a reusable workflow (
workflow_call) or a local composite action for the shared checkout/node/cache setup. This is optional, but it tends to pay off quickly in repos with many workflows.
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Use Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
.github/workflows/ci-checks.yaml:55
- These exact action pins are duplicated across multiple jobs (and across multiple workflow files in this PR). To reduce future drift and make upgrades less error-prone, consider centralizing common steps via a reusable workflow (
workflow_call) or a local composite action for the shared checkout/node/cache setup. This is optional, but it tends to pay off quickly in repos with many workflows.
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
.github/workflows/ci-checks.yaml:90
- These exact action pins are duplicated across multiple jobs (and across multiple workflow files in this PR). To reduce future drift and make upgrades less error-prone, consider centralizing common steps via a reusable workflow (
workflow_call) or a local composite action for the shared checkout/node/cache setup. This is optional, but it tends to pay off quickly in repos with many workflows.
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Use Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
.github/workflows/ci-checks.yaml:104
- These exact action pins are duplicated across multiple jobs (and across multiple workflow files in this PR). To reduce future drift and make upgrades less error-prone, consider centralizing common steps via a reusable workflow (
workflow_call) or a local composite action for the shared checkout/node/cache setup. This is optional, but it tends to pay off quickly in repos with many workflows.
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
August 4, 2026 18:30
319aa10 to
e6824c5
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
August 5, 2026 07:32
e6824c5 to
a6292e2
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
Suppressed comments (2)
.github/workflows/ci-checks.yaml:41
- These action pins are duplicated across many workflow files in this PR, which makes ongoing upgrades easy to miss or apply inconsistently. Consider enabling/using Dependabot's
github-actionsupdates (optional) so future action SHA bumps are automated and kept consistent across all workflows.
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Use Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
.github/workflows/ci-checks.yaml:55
- These action pins are duplicated across many workflow files in this PR, which makes ongoing upgrades easy to miss or apply inconsistently. Consider enabling/using Dependabot's
github-actionsupdates (optional) so future action SHA bumps are automated and kept consistent across all workflows.
- uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v5.0.5→v5.1.0v6.0.3→v6.1.0v6.4.0→v6.5.0v1.8.0→v1.9.0v7.2.0→v7.3.0v4.2.0→v4.4.0v4.6.0(+3)v6.1.0→v6.2.0v4.1.0→v4.2.0v4.1.0→v4.2.0v4.36.3→v4.37.3v4.37.6(+2)Release Notes
actions/cache (actions/cache)
v5.1.0Compare Source
What's Changed
Full Changelog: actions/cache@v5...v5.1.0
actions/checkout (actions/checkout)
v6.1.0Compare Source
actions/setup-node (actions/setup-node)
v6.5.0Compare Source
What's Changed
Full Changelog: actions/setup-node@v6.4.0...v6.5.0
changesets/action (changesets/action)
v1.9.0Compare Source
Minor Changes
#636
b072bccThanks @bluwy! - Add a new@changesets/action/pr-commentsub-action to comment on PRs#625
8795eeeThanks @bluwy! - Add a new@changesets/action/pr-statussub-action to generate the changeset status comment for PRs as an alternative to the Changesets Bot.Patch Changes
#535
34f64f6Thanks @Andarist! - Fixed an issue with GitHub releases not being created for successfully published packages when some packages failed to be published to the registry.#632
1d54b9eThanks @bluwy! - Simplify internal implementation to get changelog entries for a package version#629
e0c90aaThanks @bluwy! - Fix custom version and publish command argument parsing#645
f9585d9Thanks @Andarist! - Improved force-push handling when usingcommitMode: "github-api"so updating an existing branch no longer temporarily resets the target branch to the base commit, avoiding cases where GitHub closes open pull requests during the update. This should remove a possibility of a GitHub state race that caused the force-pushed PRs not being reopened.docker/build-push-action (docker/build-push-action)
v7.3.0Compare Source
docker/login-action (docker/login-action)
v4.4.0Compare Source
v4.3.0Compare Source
Full Changelog: docker/login-action@v4.2.0...v4.3.0
docker/metadata-action (docker/metadata-action)
v6.2.0Compare Source
docker/setup-buildx-action (docker/setup-buildx-action)
v4.2.0Compare Source
Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0
docker/setup-qemu-action (docker/setup-qemu-action)
v4.2.0Compare Source
github/codeql-action (github/codeql-action)
v4.37.3Compare Source
No user facing changes.
v4.37.2Compare Source
config-fileinput that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, theremote=prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023v4.37.1Compare Source
v4.37.0Compare Source
config-fileinput for thecodeql-action/initstep will soon support a new[owner/]repo[@ref][:path]format. All components except the repository name are optional. If omitted,ownerdefaults to the same owner as the repository the analysis is running for,reftomain, andpathto.github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.