chore(deps): bump actions/setup-node from 5 to 7 - #2323
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f712b37137
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| test "$(git rev-parse HEAD)" = "$EXPECTED_SHA" | ||
| test "$(git rev-parse HEAD^{tree})" = "$(git rev-parse "$EXPECTED_SHA^{tree}")" | ||
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 |
There was a problem hiding this comment.
This workflow runs bun test tests-unit/release-workflow-governance-source.test.ts, but that test still hard-codes actions/setup-node to 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e and asserts each uses SHA equals the approved map, so changing this line to 820762... makes the governance CI fail before any release evidence can pass. I also checked the account-deletion and YouTube KPI source-contract tests, and they still assert the old setup-node SHA too, so the approved pin fixtures/contracts need to be updated together with the workflow bump.
Useful? React with 👍 / 👎.
dependabot
Bot
changed the title
f712b37 to
943c6c4
Compare
dependabot
Bot
changed the title
943c6c4 to
9af19de
Compare
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v5...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
9af19de to
80283ad
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 80283ad5c3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
|
||
| - name: Install Node 24 | ||
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # actions/setup-node@v6 | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # actions/setup-node@v6 |
There was a problem hiding this comment.
Changing this pinned action without updating the paired source-contract test leaves the local nightly CI contract failing: apps/web/tests-unit/nightly-regression-workflow.test.ts still asserts actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e for nightly-local-regression.yml, and running that test now fails on this workflow. Refresh the approved pin in the nightly regression contract alongside this bump.
Useful? React with 👍 / 👎.
Bumps actions/setup-node from 5 to 7.
Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)