Skip to content

Update github-actions (major) - #101

Open
renovate[bot] wants to merge 1 commit into
2.0.xfrom
renovate/major-github-actions
Open

Update github-actions (major)#101
renovate[bot] wants to merge 1 commit into
2.0.xfrom
renovate/major-github-actions

Conversation

@renovate

@renovate renovate Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/checkout action major v6.1.0 → v7.0.1
astral-sh/setup-uv action major v8.3.2 → v10.3.0
metcalfc/changelog-generator action major v4.9.1 → v5.0.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

actions/checkout

v7.0.1

Compare Source

v7.0.0

Compare Source

  • Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
  • Various dependency updates
astral-sh/setup-uv

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in #​984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v9.0.0: 🌈 Change prune-cache default to false

Compare Source

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #​967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes

🐛 Bug fixes

  • fix: fall back to distribution ID when os-release has no version field @​cxzhong (#​961)

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

metcalfc/changelog-generator

v5.0.1

Compare Source

  • 031a640 - 5.0.1
  • 122a6c2 - Base the changelog on the previous release of the same line, and assert it (#​479)
  • 0bee5ad - fix: return the modified changelog as a real multiline output (#​478)

v5.0.0

Compare Source

Breaking change: commit subjects render as literal text

Every changelog line now wraps the commit subject in an inline-code span.

before:  - [f723555](.../commit/f723555) - build(deps-dev): bump @vercel/ncc to 0.45.0 (#​470)
after:   - [f723555](.../commit/f723555) - ` build(deps-dev): bump @vercel/ncc to 0.45.0 (#​470) `

A commit subject is untrusted input. Anyone whose pull request you merge
chooses that text, and this action pastes it directly into your release notes.
Rendered as active Markdown, a subject could contribute links, images,
@mentions, issue references, raw HTML, or additional changelog entries to a
release it had no business editing. Rendering it as literal text closes that
off.

What this costs you. Subjects render monospace, and #123, GH-123, bare
commit SHAs, and :emoji: inside a subject no longer autolink. Because
GitHub's squash merge appends (#​123) to the subject by default, most lines
in a typical repository lose that link. The generated commit link at the start
of each line is unaffected. Control characters, line and paragraph separators,
and bidirectional-control characters are replaced with spaces, so a subject can
never span more than its own line.

No inputs or outputs changed, and the No Changes. sentinel is unchanged.

Staying on the previous format

v4.9.0
carries every security and dependency fix in this release -- including undici
7.29.0, which closes 12 advisories -- with the v4 output format untouched. Pin
metcalfc/changelog-generator@v4 to stay there. The v4 tag will keep moving
on the maintenance line.

What is in this release

Relative to v4.9.0, v5.0.0 adds only the escaping change. Both releases share
everything else:

  • Render changelog subjects as literal text (#​475) -- v5 only
  • Keep release tag names out of shell source (#​473)
  • Verify release bundle before attestation (#​474)
  • Bound the dependency overrides and clear the undici advisories (#​476)
  • Stop bump:workflow rewriting pinned actions' provenance comments (#​477)
  • Bump @vercel/ncc (#​470), eslint (#​472), globals (#​471), codeql-action (#​469)

Full history: v4.8.0...v5.0.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-advanced-security[bot]
github-advanced-security Bot found potential problems Jun 22, 2026
View reviewed changes
Comment thread .github/workflows/lint-workflows.yml Fixed
Comment thread .github/workflows/lint-workflows.yml Fixed
@renovate renovate Bot changed the title Update github-actions to v7 Update github-actions (major) Jun 22, 2026
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from e49fcbd to faed12a Compare June 24, 2026 08:54
@renovate renovate Bot changed the title Update github-actions (major) Update actions/checkout action to v7 Jun 25, 2026
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from faed12a to b02075e Compare July 21, 2026 01:44
github-advanced-security[bot]
github-advanced-security Bot found potential problems Jul 21, 2026
View reviewed changes
Comment thread .github/workflows/lint-workflows.yml
egress-policy: audit

- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread .github/workflows/lint-workflows.yml
egress-policy: audit

- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from b02075e to 5cb4a77 Compare July 21, 2026 19:36
@renovate renovate Bot changed the title Update actions/checkout action to v7 Update github-actions (major) Jul 21, 2026
github-advanced-security[bot]
github-advanced-security Bot found potential problems Jul 21, 2026
View reviewed changes
Comment thread .github/workflows/lint-workflows.yml Outdated

- name: Install the latest version of uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from 16ddf74 to 5fa5f26 Compare August 14, 2026 17:08
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from 5fa5f26 to 339d045 Compare August 26, 2026 07:13
github-advanced-security[bot]
github-advanced-security Bot found potential problems Aug 26, 2026
View reviewed changes
Comment thread .github/workflows/release.yml
- name: Generate changelog
id: changelog
uses: metcalfc/changelog-generator@0440d0932f9a0dd1cc9ecd8412830761351323bd # v4.7.0
uses: metcalfc/changelog-generator@031a6408a9ad7fa6dcda49b7222ab2b54110a680 # v5.0.1
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from 339d045 to b691fc2 Compare September 10, 2026 21:53
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from a15ffd0 to 544b071 Compare September 21, 2026 14:23
@renovate
renovate Bot force-pushed the renovate/major-github-actions branch from 544b071 to 3325feb Compare October 10, 2026 02:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@github-advanced-security