chore(deps): bump the github-actions group across 1 directory with 13 updates - #4614
chore(deps): bump the github-actions group across 1 directory with 13 updates#4614dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Create GitHub Release | ||
| id: release | ||
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 | ||
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path |
There was a problem hiding this comment.
🟡 Two workflow files record the wrong version number next to the updated checkout action
The checkout step's version label is left at the old value (# v7.0.0 at .github/workflows/changesets-pr.yml:29) even though the pinned commit was moved to 7.0.1, so the recorded version no longer matches what actually runs.
Impact: Anyone reading or auditing these release workflows sees an inaccurate action version, which can mislead future upgrades and audits.
Why dependabot missed these two lines and where else it happens
Both affected lines carry an extra trailing zizmor: ignore[...] comment after the version comment, which is why the version token was not rewritten: .github/workflows/changesets-pr.yml:29 and .github/workflows/release.yml:70. Every other occurrence in the PR was correctly updated to # v7.0.1 (e.g. .github/workflows/release.yml:292). The digest 3d3c42e5aac5ba805825da76410c181273ba90b1 is v7.0.1, so only the comment is stale.
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path |
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| - name: Setup node | ||
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
There was a problem hiding this comment.
🔍 setup-node major bump (v6→v7) migrates the action to ESM and drops the dummy NODE_AUTH_TOKEN export
This is a major-version bump of actions/setup-node applied across ~12 workflows. Upstream v7 migrated to ESM, added cache-primary-key/cache-matched-key outputs, and removed the dummy NODE_AUTH_TOKEN export. No workflow in this repo reads NODE_AUTH_TOKEN from a setup-node step or consumes setup-node outputs (the npm publish paths in .github/workflows/release.yml use OIDC trusted publishing plus npm install -g npm@11.6.4), so the removal should be inert here. Worth confirming that self-hosted warp-* runners support the Node 24 ESM action runtime, since most jobs in this repo run on them rather than GitHub-hosted runners.
Was this helpful? React with 👍 or 👎 to provide feedback.
… updates Bumps the github-actions group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.6.0` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.0` | `4.2.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.157` | `1.0.187` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.3` | | [WarpBuilds/setup-node](https://github.com/warpbuilds/setup-node) | `6.3.0` | `7.0.0` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.2` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | | [WarpBuilds/cache](https://github.com/warpbuilds/cache) | `1.4.13` | `2.0.0` | | [mitchellh/vouch/action/check-pr](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [mitchellh/vouch/action/manage-by-issue](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `docker/login-action` from 4.2.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...dbcb813) Updates `actions/attest-build-provenance` from 4.1.0 to 4.2.2 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@a2bbfa2...4d10147) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) Updates `anthropics/claude-code-action` from 1.0.157 to 1.0.187 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@428971d...1623c36) Updates `dorny/paths-filter` from 4.0.1 to 4.0.3 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@fbd0ab8...ceb8a2b) Updates `WarpBuilds/setup-node` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/warpbuilds/setup-node/releases) - [Commits](WarpBuilds/setup-node@bc639b4...2867cf8) Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 - [Release notes](https://github.com/denoland/setup-deno/releases) - [Commits](denoland/setup-deno@667a34c...22d081f) Updates `WarpBuilds/cache` from 1.4.13 to 2.0.0 - [Release notes](https://github.com/warpbuilds/cache/releases) - [Changelog](https://github.com/WarpBuilds/cache/blob/main/RELEASES.md) - [Commits](WarpBuilds/cache@40f3443...dad44e2) Updates `mitchellh/vouch/action/check-pr` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `mitchellh/vouch/action/manage-by-issue` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.187 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: denoland/setup-deno dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: mitchellh/vouch/action/check-pr dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: mitchellh/vouch/action/manage-by-issue dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: WarpBuilds/cache dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: WarpBuilds/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
44ac28d to
b741f5b
Compare
|
|
||
| - name: Run zizmor | ||
| uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 | ||
| uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 |
There was a problem hiding this comment.
🔍 zizmor-action 0.5.7 -> 0.6.2 can introduce new findings that fail the workflow-checks job
The zizmor action minor bump pulls in a newer zizmor engine, which typically ships new audits. The zizmor job in this workflow has no continue-on-error, so any newly-introduced finding at or above the configured level will turn the job red for every PR touching .github/**. Since this PR itself touches only workflow files, the job runs here and its result is the practical smoke test — confirm it is green before merging.
Was this helpful? React with 👍 or 👎 to provide feedback.
@trigger.dev/build
trigger.dev
@trigger.dev/core
@trigger.dev/python
@trigger.dev/react-hooks
@trigger.dev/redis-worker
@trigger.dev/rsc
@trigger.dev/schema-to-json
@trigger.dev/sdk
commit: |
1 participant
Bumps the github-actions group with 13 updates in the / directory:
7.0.07.0.14.2.04.6.04.1.04.2.26.4.07.0.01.0.1571.0.1874.0.14.0.36.3.07.0.03.0.13.0.22.0.42.0.51.4.132.0.01.4.21.5.01.4.21.5.00.5.70.6.2Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
docker/login-actionfrom 4.2.0 to 4.6.0Release notes
Sourced from docker/login-action's releases.
Commits
dbcb813Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...5bcb015[dependabot skip] chore: update generated contentb30b2f2build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...9087f1eMerge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.20009830[dependabot skip] chore: update generated content2325523build(deps): bump js-yaml from 5.2.1 to 5.2.24ec1d4aMerge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.225fc99baMerge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...e512bd5Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...a146c91Merge pull request #1059 from crazy-max/harden-buildx-scope-pathsUpdates
actions/attest-build-provenancefrom 4.1.0 to 4.2.2Release notes
Sourced from actions/attest-build-provenance's releases.
Commits
4d10147Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)e3fe62eBump the actions-minor group with 2 updates (#860)0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)Updates
actions/setup-nodefrom 6.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
anthropics/claude-code-actionfrom 1.0.157 to 1.0.187Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
1623c36chore: bump Claude Code to 2.1.224 and Agent SDK to 0.3.22496e281fRun checkout auth cleanup when API commit signing is enabled (#1597)e1fc925Scope the config snapshot to files inside the working tree (#1596)0aee57aRedact common credential patterns from published run output (#1595)c038e4dchore: bump Claude Code to 2.1.223 and Agent SDK to 0.3.2234c04887Invoke the formatter directly from the format hook (#1594)9db594cchore: bump Claude Code to 2.1.222 and Agent SDK to 0.3.222acb0385Check collaborator permissions for workflow_run events (#1590)b80a0f0Match downloaded images to their source URLs by asset identifier (#1588)6fb6bb6Pin bun config for MCP server processes (#1589)Updates
dorny/paths-filterfrom 4.0.1 to 4.0.3Release notes
Sourced from dorny/paths-filter's releases.
Changelog
Sourced from dorny/paths-filter's changelog.
... (truncated)
Commits
ceb8a2bUpdate CHANGELOG.md for v4.0.3 and v3.0.4 (#327)ef09b88Document safe handling of file list outputs in workflows (#326)44adc5bMerge commit from fork4711b7afeat: add 'some-with-excludes' predicate quantifier (#322)93c889ffix: escape multi-line filenames in list-files shell and csv outputb41dfa9docs: add contents permission to PR example (#248)9af6e5afix: scope base-ignored warning to API path (#319)cae9006docs: update outputs in readme to account for the 'every' predicate-quantifie...7b450ffdocs: update changelog for v4.0.2 (#318)9280377fix: work around git dubious ownership errors in container jobs (#317)Updates
WarpBuilds/setup-nodefrom 6.3.0 to 7.0.0Release notes
Sourced from WarpBuilds/setup-node's releases.
Commits
2867cf8Merge pull request #8 from WarpBuilds/sync/upstream-v79aed42eMove to@warpbuilds/cache2.0.092cca72Address zizmor findings in the warp e2e workflowca70432Regenerate license manifests for 2.0.0-113f681fMove to@warpbuilds/cache2.0.0-1b5b858aMove macOS CI to warp-macos-15 runners169d5c0Regenerate license manifests for the new dependency treeb77752bSync upstream v7 and move to@warpbuilds/cache2.xe51e5fefix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time Do...32f57acdocs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change (#1593)Updates
softprops/action-gh-releasefrom 3.0.1 to 3.0.2Release notes
Sourced from softprops/action-gh-release's releases.
Changelog
Sourced from softprops/action-gh-release's changelog.
... (truncated)
Commits
3d0d988release 3.0.2 (#818)7e13ed4fix: clarify release creation 404 errors (#817)e6c70a5fix: replace existing release assets on Gitea (#816)f345337fix: publish existing draft releases as prereleases (#801)d8a89a2fix: upload small checksum assets reliably (#815)45ece40chore(deps): remove unused TypeScript tooling (#814)f6b913cfeat: improve release error reporting and test coverage (#813)15f193dchore(deps): upgrade TypeScript to 7 (#812)cc8268dchore(deps): bump actions/checkout in the github-actions group (#810)fd0ed1echore(deps): bump the npm group with 3 updates (#811)Updates
denoland/setup-denofrom 2.0.4 to 2.0.5Release notes
Sourced from denoland/setup-deno's releases.