Skip to content

ci(deps)(deps): bump the actions group across 1 directory with 5 updates - #67

Merged
sumitake merged 2 commits into
mainfrom
dependabot/github_actions/actions-c1735b5799
Aug 4, 2026
Merged

ci(deps)(deps): bump the actions group across 1 directory with 5 updates#67
sumitake merged 2 commits into
mainfrom
dependabot/github_actions/actions-c1735b5799

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited by sumitake
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 5 updates in the / directory:

Package From To
actions/checkout 5.0.1 7.0.1
actions/setup-python 6.3.0 7.0.0
actions/upload-artifact 4.6.2 7.0.1
actions/download-artifact 4.3.0 8.0.1
gitleaks/gitleaks-action 2.3.9 3.0.0

Updates actions/checkout from 5.0.1 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-python from 6.3.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

Commits

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates gitleaks/gitleaks-action from 2.3.9 to 3.0.0

Release notes

Sourced from gitleaks/gitleaks-action's releases.

v3.0.0

What's changed

gitleaks-action v3 migrates the runtime from Node 20 to Node 24. No changes to inputs, outputs, or behavior. Update your workflow from gitleaks/gitleaks-action@v2 to gitleaks/gitleaks-action@v3.

Migration

# Before
- uses: gitleaks/gitleaks-action@v2
After

uses: gitleaks/gitleaks-action@v3

Why

GitHub is deprecating the Node 20 runtime for Actions:

  • June 2, 2026: GitHub flips the runner default to Node 24. Workflows using gitleaks-action@v2 (Node 20) will still run, but only if ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true is set as an environment variable.
  • September 16, 2026: Node 20 is removed from GitHub-hosted runners entirely. gitleaks-action@v2 stops working regardless of any opt-out flag.

Changes

  • action.yml: runtime node20 → node24
  • @actions/core: 1.10.0 → 1.11.1
  • dist/ rebuilt
  • Example workflows updated to actions/checkout@v6 and gitleaks-action@v3
  • README updated with v3 migration guide

Self-hosted runners

If you use self-hosted runners, ensure your runner version is >= v2.327.1 (required for Node 24 support).

Commits

Adjudication (claude, 2026-08-04)

Grouped bump of 5 pinned actions, workflows only. Reviewed per the Tier-2 dependency contract:

  • Provenance: every new SHA equals the dereferenced official upstream release tag (checkout 3d3c42e5=v7.0.1/v7; setup-python 5fda3b95=v7.0.0; upload-artifact 043fb46d=v7.0.1; download-artifact 3e5f45b2=v8.0.1; gitleaks-action e0c47f4f=v3.0.0), verified via GitHub API.
  • Compatibility: checkout v7, setup-python v7, and gitleaks v3 executed live in this PR's post-rebase CI (all non-trace checks green). upload-artifact v7 / download-artifact v8 run only at release time: all workflow-passed inputs exist at the pinned SHAs; the v7-upload → v8-download same-run pair is supported upstream (only v3-and-below artifacts are unsupported); v8's breaking change (digest-mismatch now errors) is fail-closed and desirable in the release path. Hosted-runner-only repo (tested invariant) — no self-hosted firewall concern.
  • Fix pushed: Dependabot left the bare-major # v5 comment stale on all 16 checkout lines despite the v5.0.1→v7.0.1 jump; corrected to # v7.0.1 (2fb949c). Note: this stops Dependabot maintaining the branch — merge is imminent.
  • Residual (accepted): release-time artifact behavior is first exercised at the next operator-run release cut.
  • contributor_rights rationale: machine-generated pin bumps from this repo's own Dependabot config; no third-party expressive content; the comment-fix commit is owner-authored via agent.

author: dependabot (adjudicated by claude, claude-fable-5, effort default)
standing_directives: operator-instructed (2026-08-04, "review PR #67, add the trace, merge"); per-PR adjudication path chosen over gate exemption/auto-fill (operator decision 2026-08-04); dependabot.yml Tier-2 cross-check policy honored
tier: 2
cross_check: PROCEED after integration (codex gpt-5.5, effort low, hardened codex_exec wrapper prompt-only; verdict DISAGREE-MINOR confidence M; concerns integrated with evidence: upload-v7/download-v8 pair compatibility confirmed from upstream README/release notes, v8 digest-enforcement assessed fail-closed-positive, runner baseline confirmed hosted-only, stale checkout comments fixed in 2fb949c as reviewer endorsed)
post_condition: post-rebase CI green on 2f15c5c except validate-trace (this edit supplies the trace); provenance SHA=tag verified for all 5 actions; comment-fix 2fb949c pushed, checks re-running
mcp_coverage_gap: NONE
contributor_rights: OWNER-AUTHORED
operator_reserved: no
plugin_affected: NONE — CI workflow pins only, no distributed plugin content
readme_refresh_status: README unaffected (no release, no version bump)

@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from sumitake as a code owner July 27, 2026 13:25
@dependabot dependabot Bot changed the title ci(deps)(deps): bump the actions group with 5 updates ci(deps)(deps): bump the actions group across 1 directory with 5 updates Jul 29, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-c1735b5799 branch 2 times, most recently from 35e75bb to 67759e8 Compare August 3, 2026 13:27
@sumitake sumitake mentioned this pull request Aug 4, 2026
Merged
7 tasks
sumitake added a commit that referenced this pull request Aug 4, 2026
@sumitake @claude
tests: property-based action-pin assertions (unbreak Dependabot bumps) (
7b6c7e8 
#90)

Replace the four frozen action-pin fixtures (exact gitleaks SHA; three
'# v4' major-version regexes for codeql init/analyze and upload-artifact)
with anchored property assertions: a real 'uses:' line, a full 40-hex
commit SHA, and a version comment (dotted forms accepted). Every
Dependabot actions-group PR (#9/#29/#67) failed CI by construction
because Dependabot cannot update fixtures that mirror the workflow it
bumps. Full-SHA pinning stays enforced repo-wide by
test_every_external_action_is_pinned_to_a_full_commit; WHICH SHA runs is
governed by CODEOWNERS review of workflow diffs. Anchoring to uses:
lines is a strictness increase over the old substring assertions (Codex
cross-family review, DISAGREE-MINOR H, both concerns integrated; its
proposed regex was corrected empirically to accept dotted version
comments, which Dependabot writes).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
@sumitake

sumitake commented Aug 4, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
ci(deps)(deps): bump the actions group across 1 directory with 5 updates
2f15c5c 
Bumps the actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `5.0.1` | `7.0.1` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` |
| [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2.3.9` | `3.0.0` |



Updates `actions/checkout` from 5.0.1 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@93cb6ef...3d3c42e)

Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@ece7cb0...5fda3b9)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...043fb46)

Updates `actions/download-artifact` from 4.3.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...3e5f45b)

Updates `gitleaks/gitleaks-action` from 2.3.9 to 3.0.0
- [Release notes](https://github.com/gitleaks/gitleaks-action/releases)
- [Commits](gitleaks/gitleaks-action@ff98106...e0c47f4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: gitleaks/gitleaks-action
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-c1735b5799 branch from 67759e8 to 2f15c5c Compare August 4, 2026 06:30
@sumitake @claude
ci(deps): correct stale checkout version comments (v5 -> v7.0.1)
2fb949c 
Dependabot bumped actions/checkout v5.0.1 -> v7.0.1 (SHA 3d3c42e5 =
official v7.0.1/v7 tag, verified via API) but left the bare-major
'# v5' comment unchanged on all 16 lines. The pin comment is audit
metadata; correct it to the exact release the SHA points at.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@sumitake
sumitake merged commit 721d165 into main Aug 4, 2026
16 of 17 checks passed
@sumitake
sumitake deleted the dependabot/github_actions/actions-c1735b5799 branch August 4, 2026 06:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sumitake sumitake Awaiting requested review from sumitake sumitake is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sumitake