From 2ad06c5bad6f902737b1aff86c4414d89d122af7 Mon Sep 17 00:00:00 2001 From: Tim Gossrau Date: Fri, 18 Sep 2026 14:09:37 +0200 Subject: [PATCH] ci: bump checkout, setup-node and changelog-builder to current majors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supersedes the three separate Dependabot PRs (#13, #15, #20). Doing them in one commit avoids each rebasing onto the others, since all three touch the same workflow file. - actions/checkout 4.4.0 -> 7.0.1 - actions/setup-node 4.4.0 -> 7.0.0 - mikepenz/release-changelog-builder-action 4.2.2 -> 6.3.0 The majors are runtime bumps (node24) plus, for checkout v7, a guard against checking out fork PRs on pull_request_target and workflow_run — triggers this repo does not use. setup-node v6 narrowed automatic caching to npm, which ci.yml already requests explicitly. The changelog builder's v5 breaking changes are in regex transformers, which this configuration does not set. commitMode is deprecated there in favour of mode: COMMIT but still supported, so the config is left alone. Each SHA was verified against the upstream tag rather than taken from the Dependabot diff. Refs #13, #15, #20 Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build-release-changelog.yml | 8 ++++---- .github/workflows/ci.yml | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-release-changelog.yml b/.github/workflows/build-release-changelog.yml index f838e80..f59f2fd 100644 --- a/.github/workflows/build-release-changelog.yml +++ b/.github/workflows/build-release-changelog.yml @@ -16,9 +16,9 @@ jobs: id-token: write steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' registry-url: 'https://registry.npmjs.org' @@ -38,10 +38,10 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build Changelog id: build_changelog - uses: mikepenz/release-changelog-builder-action@32e3c96f29a6532607f638797455e9e98cfc703d # v4.2.2 + uses: mikepenz/release-changelog-builder-action@cb021f9b36a51a7c6f18e4679b6fa2cb77a1260c # v6.3.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5034601..e15cb25 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,9 +16,9 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' cache: npm