Skip to content

Bump actions/checkout v5→v6 and actions/cache v4→v5#929

Merged
dgee2 merged 2 commits into
mainfrom
dependabot/combined-actions-updates
Mar 28, 2026
Merged

Bump actions/checkout v5→v6 and actions/cache v4→v5#929
dgee2 merged 2 commits into
mainfrom
dependabot/combined-actions-updates

Conversation

@dgee2

@dgee2 dgee2 commented Mar 28, 2026

Copy link
Copy Markdown
Owner

Combined GitHub Actions Dependabot Updates

This PR combines the following dependabot PRs into a single update:

Changes

  • actions/checkout@v5actions/checkout@v6
  • actions/cache@v4actions/cache@v5

Breaking Change Assessment

  • actions/checkout v6: Credentials now stored in \ instead of .git/config (security improvement). No impact on this workflow since we don't manipulate git credentials directly.
  • actions/cache v5: Uses Node.js 24 runtime and new cache service APIs. Backward compatible — no YAML parameter changes required. Requires runner ≥2.327.1 (GitHub-hosted runners meet this).

No additional configuration changes are needed.

Combines dependabot PRs #782, #783, #807, #808 into a single update.

- actions/checkout v6: credential storage moved to RUNNER_TEMP (security improvement)
- actions/cache v5: uses Node.js 24 runtime and new cache service APIs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings March 28, 2026 19:16

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s CI workflow to use the latest major versions of commonly used GitHub Actions, keeping the pipeline current with upstream security/runtime updates.

Changes:

  • Bump actions/checkout from v5 to v6 in the main build workflow.
  • Bump actions/cache from v4 to v5 in the main build workflow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Replace manual actions/cache step (which used non-existent ~/.pnpm-store path)
with actions/setup-node's built-in cache: 'pnpm' which auto-detects the
correct pnpm store directory.

Reorder steps so corepack enables pnpm before setup-node runs, allowing
setup-node to discover the pnpm store path for caching.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@sonarqubecloud

Copy link
Copy Markdown

@dgee2 dgee2 merged commit bbe6dea into main Mar 28, 2026
9 checks passed
@dgee2 dgee2 deleted the dependabot/combined-actions-updates branch March 28, 2026 19:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants