Skip to content

Bump GitHub Actions dependencies#1

Open
wallentx wants to merge 2 commits into
mainfrom
wallentx/actions-update
Open

Bump GitHub Actions dependencies#1
wallentx wants to merge 2 commits into
mainfrom
wallentx/actions-update

Conversation

@wallentx

@wallentx wallentx commented Jun 24, 2026

Copy link
Copy Markdown

Bumps the github-actions group with 5 updates: actions/checkout, actions/setup-node, actions/configure-pages, actions/upload-pages-artifact, actions/deploy-pages.

actions/checkout

Updates actions/checkout from 4 to 7 across 1 workflow entry.

Investigation: Compatibility & Safety Details
  • Caution Detail: Version 7 blocks checkout of fork PRs under pull_request_target or workflow_run events by default to prevent 'pwn request' vulnerabilities.
  • Safety: The workflow in this repository only triggers on push to main and workflow_dispatch, not on fork PR events, making the update safe.
Release notes

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

Changelog

Sourced from actions/checkout's changelog.

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

Commits

Sourced from actions/checkout's commit history.

  • 9f26565 Update actions checkout to use node 24 (#2226)
  • 08c6903 Prepare v5.0.0 release (#2238)
  • ff7abcd Update README to include Node.js 24 support details and requirements (#2248)
  • 069c695 Persist creds to a separate file (#2286)
  • 71cf226 v6-beta (#2298)
  • 1af3b93 update readme/changelog for v6 (#2311)
  • c2d88d3 Update all references from v5 and v4 to v6 (#2314)
  • 033fa0d Add worktree support for persist-credentials includeIf (#2327)
  • 8e8c483 Clarify v6 README (#2328)
  • 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (#2355)
  • de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
  • 0c366fd Update changelog (#2357)
  • 900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
  • 1cce339 Fix checkout init for SHA-256 repositories (#2439)
  • df4cb1c Update changelog for v6.0.3 (#2446)
  • f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
  • 0f9f3aa Bump actions/publish-immutable-action (#2458)
  • 7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
  • 130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
  • 537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
  • d914b26 upgrade module to esm and update dependencies (#2463)
  • f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
  • 1044a6d getting ready for checkout v7 release (#2464)
  • 9c091bb update error wording (#2467)
    See full diff in compare view.

Dependabot compatibility score

actions/setup-node

Updates actions/setup-node from 4 to 6 across 1 workflow entry.

Investigation: Compatibility & Safety Details
  • Caution Detail: Node 24 runtime upgrade and automatic caching changes.
  • Safety: The workflow explicitly defines cache: npm, which bypasses automatic detection conflicts.
Release notes

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

What's Changed

Documentation

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

What's Changed

Enhancement:

Dependency updates:

Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

  • Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by @dependabot[bot] in #1336
  • Upgrade prettier from 2.8.8 to 3.6.2 by @dependabot[bot] in #1334
  • Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @dependabot[bot] in #1362

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

Changelog

No changelog file was found for actions/setup-node.

actions-snitch looked for CHANGELOG.md, changelog.md, CHANGES.md, and HISTORY.md.

Commits

Sourced from actions/setup-node's commit history.

  • 08f58d1 Bump @octokit/request-error and @actions/github (#1227)
  • 7e24a65 Bump uuid from 9.0.1 to 11.1.0 (#1273)
  • 65becef Bump undici from 5.28.5 to 5.29.0 (#1295)
  • 5e2628c Bumps form-data (#1332)
  • d7a1131 Enhance caching in setup-node with automatic package manager detection (#1348)
  • b7234cc Upgrade action to use node24 (#1325)
  • a0853c2 Bump actions/checkout from 4 to 5 (#1345)
  • cd2651c Bump ts-jest from 29.1.2 to 29.4.1 (#1336)
  • 89d709d Bump prettier from 2.8.8 to 3.6.2 (#1334)
  • 1342781 Bump actions/publish-action from 0.3.0 to 0.4.0 (#1362)
  • 2028fbc Limit automatic caching to npm, update workflows and documentation (#1374)
  • dda4788 Add example for restore-only cache in documentation (#1419)
  • 633bb92 Bump @actions/cache from 4.0.3 to 4.1.0 (#1384)
  • b9b25d4 Remove always-auth configuration handling from action (#1436)
  • a4d2e2b Bump actions/checkout from 5 to 6 (#1439)
  • 395ad32 Bump js-yaml from 3.14.1 to 3.14.2 (#1435)
  • 65d868f Update Documentation for Lockfile (#1454)
  • 21ddc7b Correct mirror option typos (#1442)
  • 2951748 Bump @actions/cache to v5.0.1 (#1449)
  • 621ac41 README.md: bump to latest released checkout version v6 (#1446)
  • 8e49463 Fix README typo (#1226)
  • 6044e13 Docs: bump actions/checkout from v5 to v6 (#1468)
  • d02c89d Fix npm audit issues (#1491)
  • efcb663 fix: remove hardcoded bearer (#1467)
  • 774c1d6 feat(node-version-file): support parsing devEngines field (#1283)
  • c882bff Replace uuid with crypto.randomUUID() (#1378)
  • 54045ab Scope test lockfiles by package manager and update cache tests (#1495)
  • 53b8394 Bump minimatch from 3.1.2 to 3.1.5 (#1498)
  • ab72c7e Upgrade @actions dependencies (#1525)
  • 48b55a0 Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)
    See full diff in compare view.

Dependabot compatibility score

actions/configure-pages

Updates actions/configure-pages from 5 to 6 across 1 workflow entry.

Release notes

v6.0.0

Changelog

  • upgrade to node 24 @salmanmkc (#186)
  • Upgrade IA Publish @Jcambass (#165)
  • Add workflow file for publishing releases to immutable action package @Jcambass (#163)
  • pin draft release version @YiMysty (#162)
  • Bump espree from 9.6.1 to 10.1.0 @dependabot (#160)
  • Bump eslint-config-prettier from 8.8.0 to 9.1.0 @dependabot (#143)
  • Be more friendly to Dependabot @yoannchaudet (#158)
  • Bump eslint-plugin-github from 4.10.2 to 5.0.1 @dependabot (#154)
  • Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group @dependabot (#156)
  • Bump undici from 5.28.3 to 5.28.4 @dependabot (#145)

See details of all code changes since previous release.

Changelog

No changelog file was found for actions/configure-pages.

actions-snitch looked for CHANGELOG.md, changelog.md, CHANGES.md, and HISTORY.md.

Commits

Sourced from actions/configure-pages's commit history.

  • 34b0311 Bump undici from 5.28.3 to 5.28.4
  • c872373 Update distributables after Dependabot 🤖
  • e1bedb3 Merge pull request #145 from actions/dependabot/npm_and_yarn/undici-5.28.4
  • 197d7ac Bump eslint-plugin-github from 4.10.2 to 5.0.1
  • c3ccc39 Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group
  • b7a5f35 Merge pull request #156 from actions/dependabot/npm_and_yarn/npm_and_yarn-5134b82be1
  • 01f6e1e Be more friendly to Dependabot
  • 4374381 Merge branch 'main' into dependabot/npm_and_yarn/eslint-plugin-github-5.0.1
  • fda53c8 Merge pull request #154 from actions/dependabot/npm_and_yarn/eslint-plugin-github-5.0.1
  • 0c41017 Merge branch 'main' into dependabot-friendly
  • 5775831 Merge pull request #158 from actions/dependabot-friendly
  • d624ed2 Bump eslint-config-prettier from 8.8.0 to 9.1.0
  • a530a34 Bump espree from 9.6.1 to 10.1.0
  • dd21a83 [dependabot skip] Update distributables after Dependabot 🤖
  • dc10386 Merge pull request #143 from actions/dependabot/npm_and_yarn/eslint-config-prettier-9.1.0
  • 0b64e34 Merge branch 'main' into dependabot/npm_and_yarn/espree-10.1.0
  • aabcbc4 Merge pull request #160 from actions/dependabot/npm_and_yarn/espree-10.1.0
  • 3ea1966 pin draft release version
  • 0d7570c Merge pull request #162 from actions/pin-draft-release-verssion
  • 2f4f988 Add workflow file for publishing releases to immutable action package
  • 1dfbcbf Merge pull request #163 from actions/Jcambass-patch-1
  • 35e0ac4 Upgrade IA Publish
  • d560657 Merge pull request #165 from actions/Jcambass-patch-1
  • cb8a1a3 upgrade to node 24
  • d8770c2 Update Node version from 20 to 24 in action.yml
  • 45bfe01 Merge pull request #186 from salmanmkc/node24
    See full diff in compare view.

Dependabot compatibility score

actions/upload-pages-artifact

Updates actions/upload-pages-artifact from 3 to 5 across 1 workflow entry.

Release notes

v5.0.0

Changelog

See details of all code changes since previous release.

v4.0.0

What's Changed

Full Changelog: actions/upload-pages-artifact@v3.0.1...v4.0.0

Changelog

No changelog file was found for actions/upload-pages-artifact.

actions-snitch looked for CHANGELOG.md, changelog.md, CHANGES.md, and HISTORY.md.

Commits

Sourced from actions/upload-pages-artifact's commit history.

  • 39a95da Update README.md to clarify tarball size limit
  • f98d42f Bump release-drafter/release-drafter from 5 to 6
  • 4ee80ee Remove mention of file permissions in README
  • ff11fa5 Merge pull request #99 from actions/remove-permissions-mention
  • b443e1f README tidy up
  • a8628ef Merge pull request #100 from actions/JamesMGreene-patch-2
  • c7522bd Merge branch 'main' into dependabot/github_actions/release-drafter/release-drafter-6
  • bb87865 Merge pull request #96 from actions/dependabot/github_actions/release-drafter/release-drafter-6
  • 36a9e81 Merge branch 'main' into JamesMGreene-patch-1
  • 1780dfc Merge pull request #72 from actions/JamesMGreene-patch-1
  • 7abc80a ignore all hidden files when creating zip
  • aefddd4 Updates from editor
  • b73e0a2 Update test-hosted-runners.yml
  • 68c8fd1 pin release drafter version
  • 2eb9582 Merge pull request #103 from actions/pin-release-drafter-version
  • a5aa90d add hidden files
  • a16f4a0 Update test-hosted-runners.yml
  • b83d5a1 Updates from editor
  • 2219f71 Updates from editor
  • 5ed71ea Updates from editor
  • 717c17d Updates from editor
  • fc056d0 Merge branch 'main' into hidden-files
  • efaad07 Merge pull request #102 from actions/hidden-files
  • 45dc788 Add workflow file for publishing releases to immutable action package
  • 984864e Merge pull request #105 from actions/Jcambass-patch-1
  • a2d6704 doc: updated usage section in readme
  • e59cdfe Update README.md
  • 9605915 Merge pull request #106 from KittyChiu/kittychiu/update-readme-1
  • c704843 fix: linted README
  • 2d163be Merge pull request #107 from KittyChiu/main
  • ... and 9 more commits.
    See full diff in compare view.

Dependabot compatibility score

actions/deploy-pages

Updates actions/deploy-pages from 4 to 5 across 1 workflow entry.

Investigation: Compatibility & Safety Details
  • Caution Detail: Node 24 runtime upgrade.
  • Safety: Safe to upgrade; inputs and usage remain identical.
Release notes

v5.0.0

Changelog

  • Update Node.js version to 24.x @salmanmkc (#404)
  • Add workflow file for publishing releases to immutable action package @Jcambass (#374)
  • Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group across 1 directory @dependabot (#360)
  • Make the rebuild dist workflow work nicer with Dependabot @yoannchaudet (#361)
  • Bump the non-breaking-changes group across 1 directory with 3 updates @dependabot (#358)
  • Delete repeated sentence @garethsb (#359)
  • Update README.md @tsusdere (#348)
  • Bump the non-breaking-changes group with 4 updates @dependabot (#341)
  • Remove error message for file permissions @TooManyBees (#340)

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Changelog

No changelog file was found for actions/deploy-pages.

actions-snitch looked for CHANGELOG.md, changelog.md, CHANGES.md, and HISTORY.md.

Commits

Sourced from actions/deploy-pages's commit history.

  • 12a5abe Remove error message for file permissions
  • f517c44 Merge pull request #340 from actions/remove-permissions-error
  • 4ce84b3 Bump the non-breaking-changes group with 4 updates
  • 808746a Update distributables after Dependabot 🤖
  • 277bb4b Merge pull request #341 from actions/dependabot/npm_and_yarn/non-breaking-changes-a62e391912
  • b8d7a0e Update README.md
  • b352a21 update readme
  • 2e8b6c7 Update README.md
  • 32d96c3 add recommendations
  • 4072571 Update README.md
  • b2d396a Update README.md
  • 199a735 Merge pull request #348 from actions/oidc-doc
  • 479a2d9 Bump the non-breaking-changes group across 1 directory with 3 updates
  • 981e77b Update distributables after Dependabot 🤖
  • 82ccaed Delete repeated sentence
  • b13935c Merge pull request #359 from garethsb/patch-1
  • bce7355 Merge branch 'main' into dependabot/npm_and_yarn/non-breaking-changes-99c12deb21
  • 89f3d10 Merge pull request #358 from actions/dependabot/npm_and_yarn/non-breaking-changes-99c12deb21
  • 51bb29d Make the rebuild dist workflow safer for Dependabot
  • 963791f Merge pull request #361 from actions/dependabot-friendly
  • 7273294 Bump braces in the npm_and_yarn group across 1 directory
  • b742728 Merge pull request #360 from actions/dependabot/npm_and_yarn/npm_and_yarn-5134b82be1
  • 306bb81 Add workflow file for publishing releases to immutable action package
  • 854d7aa Merge pull request #374 from actions/Jcambass-patch-1
  • bbe2a95 Update Node.js version to 24.x
  • cd2ce8f Merge pull request #404 from salmanmkc/node24
    See full diff in compare view.

Dependabot compatibility score

Findings and PR created by actions-snitch.

Copilot AI review requested due to automatic review settings June 24, 2026 21:15

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the GitHub Pages deployment workflow to use newer major versions of official GitHub Actions used for checkout, Node setup, Pages configuration, artifact upload, and Pages deployment.

Changes:

  • Bump actions/checkout from v4 to v7
  • Bump actions/setup-node from v4 to v6 (workflow still pins node-version: 22 and uses cache: npm)
  • Bump Pages-related actions: configure-pages v5→v6, upload-pages-artifact v3→v5, deploy-pages v4→v5

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 19008cfba2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

run: npm run build
- name: Upload artifact
uses: actions/upload-pages-artifact@v3
uses: actions/upload-pages-artifact@v5

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve hidden files in the Pages artifact

Because this repo has static/.nojekyll, the Docusaurus build copies that dotfile into build/, but actions/upload-pages-artifact@v5 defaults include-hidden-files to false. In GitHub Pages deployments that rely on .nojekyll to prevent Jekyll from filtering underscore-prefixed paths, this upgrade strips the sentinel from the artifact; add include-hidden-files: true for this upload step so the existing Pages behavior is preserved.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added include-hidden-files: true, assuming that this is the intended behavior.

Enable uploading hidden files during artifact upload.
@wallentx wallentx requested review from jmhands and thinkmassive June 24, 2026 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants