Skip to content

ci(deps): bump the github-actions group across 1 directory with 13 updates#13614

Merged
wochinge merged 2 commits into
mainfrom
dependabot/github_actions/github-actions-fbe0ecf9a4
May 15, 2026
Merged

ci(deps): bump the github-actions group across 1 directory with 13 updates#13614
wochinge merged 2 commits into
mainfrom
dependabot/github_actions/github-actions-fbe0ecf9a4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 13, 2026 •
edited
Loading

Bumps the github-actions group with 13 updates in the / directory:

Package From To
actions/checkout 4.3.1 6.0.2
aws-actions/configure-aws-credentials 6.1.0 6.1.1
aws-actions/amazon-ecr-login 2.1.2 2.1.5
aws-actions/amazon-ecs-render-task-definition 1.8.4 1.8.5
aws-actions/amazon-ecs-deploy-task-definition 2.6.1 2.6.2
github/codeql-action 4.35.1 4.35.3
actions/setup-node 6.3.0 6.4.0
pnpm/action-setup 5.0.0 6.0.5
actions/cache 5.0.4 5.0.5
slackapi/slack-github-action 3.0.1 3.0.3
useblacksmith/setup-docker-builder 1.6.0 1.8.0
useblacksmith/build-push-action 2.1.0 2.2.0
astral-sh/setup-uv 8.0.0 8.1.0

Updates actions/checkout from 4.3.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits

Updates aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.1.1

What's Changed

Full Changelog: aws-actions/configure-aws-credentials@v6...v6.1.1

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

6.1.1 (2026-05-05)

Miscellaneous Chores

  • various dependency updates

6.1.0 (2026-04-06)

Features

6.0.0 (2026-02-04)

⚠ BREAKING CHANGES

Features

Bug Fixes

  • properly output aws-account-id and authenticated-arn when using role-chaining (#1633) (7ceaf96)

5.1.1 (2025-11-24)

Miscellaneous Chores

5.1.0 (2025-10-06)

Features

... (truncated)

Commits
  • d979d5b chore: release 6.1.1 (#1757)
  • d4a9acd chore: Update dist
  • fc44f4a chore(deps): bump @​aws-sdk/client-sts from 3.1033.0 to 3.1038.0 (#1749)
  • 0b8336f chore: Update dist
  • 8c5bf33 chore(deps-dev): bump @​aws-sdk/credential-provider-env (#1751)
  • 53df0c1 chore: Update dist
  • c2c5582 chore(deps): bump @​smithy/node-http-handler from 4.6.0 to 4.6.1 (#1750)
  • bd0031d chore(deps): bump postcss from 8.5.6 to 8.5.12 (#1752)
  • 6ab499a chore(deps-dev): bump @​biomejs/biome from 2.4.12 to 2.4.13 (#1747)
  • bc94895 chore(deps-dev): bump @​biomejs/biome from 2.4.11 to 2.4.12 (#1739)
  • Additional commits viewable in compare view

Updates aws-actions/amazon-ecr-login from 2.1.2 to 2.1.5

Release notes

Sourced from aws-actions/amazon-ecr-login's releases.

v2.1.5

See the changelog for details about the changes included in this release.

v2.1.4

See the changelog for details about the changes included in this release.

v2.1.3

See the changelog for details about the changes included in this release.

Changelog

Sourced from aws-actions/amazon-ecr-login's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.1.5 (2026-05-06)

2.1.4 (2026-04-22)

2.1.3 (2026-04-15)

2.1.2 (2026-04-01)

2.1.1 (2026-03-24)

Bug Fixes

  • prefer explicit env var credentials over Pod Identity (#953) (ecbbdc7)

2.1.0 (2026-03-19)

Features

2.0.2 (2026-03-13)

Bug Fixes

2.0.1 (2023-10-02)

2.0.0 (2023-10-02)

⚠ BREAKING CHANGES

  • The default value of the 'mask-password' input has been updated from false to true.

  • Treat maskPassword as false only if explicitly set to false

  • Add new-v2-release to README

Features

... (truncated)

Commits
  • fa648b4 chore(release): 2.1.5
  • 3dfe08d chore: Update dist (#1052)
  • 5607af0 chore(deps-dev): bump globals from 17.5.0 to 17.6.0 (#1044)
  • dca3c95 chore(deps): bump @​aws-sdk/client-ecr-public from 3.1038.0 to 3.1043.0 (#1041)
  • 0d5643a chore: Update dist (#1048)
  • 4555c24 chore(deps): bump @​aws-sdk/credential-providers (#1043)
  • 7d5c14d chore(deps-dev): bump eslint from 10.2.1 to 10.3.0 (#1042)
  • e7f36a1 chore(deps): bump @​aws-sdk/client-ecr from 3.1038.0 to 3.1043.0 (#1040)
  • 9e3a847 chore: Update dist (#1038)
  • 827d1a8 chore(deps): bump @​aws-sdk/client-ecr-public from 3.1034.0 to 3.1038.0 (#1032)
  • Additional commits viewable in compare view

Updates aws-actions/amazon-ecs-render-task-definition from 1.8.4 to 1.8.5

Release notes

Sourced from aws-actions/amazon-ecs-render-task-definition's releases.

v1.8.5

See the changelog for details about the changes included in this release.

Changelog

Sourced from aws-actions/amazon-ecs-render-task-definition's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

1.8.5 (2026-04-30)

Bug Fixes

  • allow secrets to render without environment-variables (#464) (46a24f1)

1.8.4 (2026-03-20)

Bug Fixes

1.8.3 (2026-01-16)

1.8.2 (2025-12-18)

1.8.1 (2025-10-16)

1.8.0 (2025-08-14)

Features

  • add possibility to add more than one container in container-name (#229) (ce1d739)

1.7.5 (2025-08-04)

1.7.4 (2025-06-23)

1.7.3 (2025-05-28)

1.7.2 (2025-04-22)

1.7.1 (2025-03-24)

1.7.0 (2025-03-03)

Features

1.6.2 (2025-01-14)

... (truncated)

Commits

Updates aws-actions/amazon-ecs-deploy-task-definition from 2.6.1 to 2.6.2

Release notes

Sourced from aws-actions/amazon-ecs-deploy-task-definition's releases.

v2.6.2

See the changelog for details about the changes included in this release.

Changelog

Sourced from aws-actions/amazon-ecs-deploy-task-definition's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.6.2 (2026-04-30)

Bug Fixes

  • Detect deployment rollback after service stabilization (#860) (d46c585)

2.6.1 (2026-03-25)

Bug Fixes

  • add optional wait-max-delay-seconds input to configure waiter polling (#839) (5fda33a)
  • upgrade Node.js runtime to node24 (#852) (8f67c1a)

2.6.0 (2026-01-16)

Features

  • Add support for maxAttempts to allow retrying after failure (#750) (ede1821)

2.5.1 (2025-12-18)

2.5.0 (2025-11-24)

Features

  • Set url to deployments instead of events (#809) (2b13337)

Bug Fixes

2.4.0 (2025-09-09)

Features

2.3.4 (2025-07-24)

... (truncated)

Commits

Updates github/codeql-action from 4.35.1 to 4.35.3

Release notes

Sourced from github/codeql-action's releases.

v4.35.3

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
  • Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
  • Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
  • Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
  • Update default CodeQL bundle version to 2.25.3. #3865

v4.35.2

  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
  • Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
  • Update default CodeQL bundle version to 2.25.2. #3823
Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

  • Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
  • Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
  • Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
  • Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
  • Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
  • Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
  • Update default CodeQL bundle version to 2.25.2. #3823

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

4.34.1 - 20 Mar 2026

  • Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

  • Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
  • We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
  • Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

... (truncated)

Commits
  • e46ed2c Merge pull request #3867 from github/update-v4.35.3-8c6e48dbe
  • b73d1d1 Add changelog entry for #3853
  • 24e0bb0 Reorder changelog entries
  • ec298da Update changelog for v4.35.3
  • 8c6e48d Merge pull request #3865 from github/update-bundle/codeql-bundle-v2.25.3
  • 7190983 Add changelog note
  • 2bb2095 Update default bundle to codeql-bundle-v2.25.3
  • 7851e55 Merge pull request #3850 from github/mbg/private-registry/cloudsmith-gcp
  • 262a15f Add generic non-printable chars test for OIDC configs
  • a6109b1 Merge pull request #3853 from github/mbg/start-proxy/improved-checks
  • Additional commits viewable in compare view

Updates actions/setup-node from 6.3.0 to 6.4.0

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

Commits

Updates pnpm/action-setup from 5.0.0 to 6.0.5

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.5

What's Changed

Full Changelog: pnpm/action-setup@v6.0.4...v6.0.5

v6.0.4

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v6.0.3...v6.0.4

v6.0.3

Updated pnpm to v11.0.0-rc.5

Full Changelog: pnpm/action-setup@v6.0.2...v6.0.3

v6.0.2

What's Changed

New Contributors

Full Changelog: pnpm/action-setup@v6.0.1...v6.0.2

v6.0.1

Update pnpm to v11.0.0-rc.2. pnpm-lock.yaml will not be saved with two documents unless the packageManager is set via devEngines.packageManager. Related issue: pnpm/action-setup#228

v6.0.0

Added support for pnpm v11.

Commits
  • 8912a91 fix: append (not prepend) action node dir to PATH for npm bootstrap (#241)
  • 26f6d4f fix: use npm co-located with the action node binary (#239)
  • 903f9c1 fix: update pnpm to 11.0.0-rc.5
  • bdf0af2 test: add strict version-match jobs to reproduce #225 / #227
  • 71c9247 fix: pnpm self-update binary shadowed by bootstrap on PATH (#230)
  • Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 13, 2026
@dosubot dosubot Bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label May 13, 2026
github-advanced-security[bot]
github-advanced-security AI found potential problems May 13, 2026
View reviewed changes
Comment thread .github/workflows/pipeline.yml Fixed
Comment thread .github/workflows/pipeline.yml Fixed
Comment thread .github/workflows/pipeline.yml Fixed
Comment thread .github/workflows/pipeline.yml Fixed
Comment thread .github/workflows/pipeline.yml Fixed
Comment thread .github/workflows/pipeline.yml Fixed
Comment thread .github/workflows/pipeline.yml Fixed
Comment thread .github/workflows/pipeline.yml Fixed
Comment thread .github/workflows/pipeline.yml Fixed
Comment thread .github/workflows/pipeline.yml Fixed
claude[bot]
claude Bot reviewed May 13, 2026
View reviewed changes
Comment thread .github/workflows/pipeline.yml Outdated
@dependabot
ci(deps): bump the github-actions group across 1 directory with 13 up…
7f2c118 
…dates

Bumps the github-actions group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.1.0` | `6.1.1` |
| [aws-actions/amazon-ecr-login](https://github.com/aws-actions/amazon-ecr-login) | `2.1.2` | `2.1.5` |
| [aws-actions/amazon-ecs-render-task-definition](https://github.com/aws-actions/amazon-ecs-render-task-definition) | `1.8.4` | `1.8.5` |
| [aws-actions/amazon-ecs-deploy-task-definition](https://github.com/aws-actions/amazon-ecs-deploy-task-definition) | `2.6.1` | `2.6.2` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.3` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `6.4.0` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `5.0.0` | `6.0.5` |
| [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` |
| [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `3.0.1` | `3.0.3` |
| [useblacksmith/setup-docker-builder](https://github.com/useblacksmith/setup-docker-builder) | `1.6.0` | `1.8.0` |
| [useblacksmith/build-push-action](https://github.com/useblacksmith/build-push-action) | `2.1.0` | `2.2.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.0.0` | `8.1.0` |



Updates `actions/checkout` from 4.3.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.3.1...de0fac2)

Updates `aws-actions/configure-aws-credentials` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@ec61189...d979d5b)

Updates `aws-actions/amazon-ecr-login` from 2.1.2 to 2.1.5
- [Release notes](https://github.com/aws-actions/amazon-ecr-login/releases)
- [Changelog](https://github.com/aws-actions/amazon-ecr-login/blob/main/CHANGELOG.md)
- [Commits](aws-actions/amazon-ecr-login@f2e9fc6...fa648b4)

Updates `aws-actions/amazon-ecs-render-task-definition` from 1.8.4 to 1.8.5
- [Release notes](https://github.com/aws-actions/amazon-ecs-render-task-definition/releases)
- [Changelog](https://github.com/aws-actions/amazon-ecs-render-task-definition/blob/master/CHANGELOG.md)
- [Commits](aws-actions/amazon-ecs-render-task-definition@77954e2...6853cfa)

Updates `aws-actions/amazon-ecs-deploy-task-definition` from 2.6.1 to 2.6.2
- [Release notes](https://github.com/aws-actions/amazon-ecs-deploy-task-definition/releases)
- [Changelog](https://github.com/aws-actions/amazon-ecs-deploy-task-definition/blob/master/CHANGELOG.md)
- [Commits](aws-actions/amazon-ecs-deploy-task-definition@fc8fc60...a310a83)

Updates `github/codeql-action` from 4.35.1 to 4.35.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c10b806...e46ed2c)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...48b55a0)

Updates `pnpm/action-setup` from 5.0.0 to 6.0.5
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@fc06bc1...8912a91)

Updates `actions/cache` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@6682284...27d5ce7)

Updates `slackapi/slack-github-action` from 3.0.1 to 3.0.3
- [Release notes](https://github.com/slackapi/slack-github-action/releases)
- [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md)
- [Commits](slackapi/slack-github-action@af78098...45a88b9)

Updates `useblacksmith/setup-docker-builder` from 1.6.0 to 1.8.0
- [Release notes](https://github.com/useblacksmith/setup-docker-builder/releases)
- [Commits](useblacksmith/setup-docker-builder@5241b2e...722e97d)

Updates `useblacksmith/build-push-action` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/useblacksmith/build-push-action/releases)
- [Commits](useblacksmith/build-push-action@cbd1f60...fb9e3e6)

Updates `astral-sh/setup-uv` from 8.0.0 to 8.1.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@cec2083...0880764)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: aws-actions/amazon-ecr-login
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: aws-actions/amazon-ecs-deploy-task-definition
  dependency-version: 2.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: aws-actions/amazon-ecs-render-task-definition
  dependency-version: 1.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: slackapi/slack-github-action
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: useblacksmith/build-push-action
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: useblacksmith/setup-docker-builder
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/github_actions/github-actions-fbe0ecf9a4 branch from 18ddc57 to 7f2c118 Compare May 14, 2026 23:02
@dependabot dependabot Bot requested a review from a team as a code owner May 14, 2026 23:02
@wochinge wochinge self-assigned this May 15, 2026
@wochinge @claude
ci: remove stale action version comments
fbcd793 
Co-Authored-By: Codex Opus 4.6 (1M context) <noreply@anthropic.com>
@dosubot dosubot Bot added the lgtm This PR has been approved by a maintainer label May 15, 2026
@wochinge
Copy link
Copy Markdown
Contributor

wochinge commented May 15, 2026

@claude review

claude[bot]
claude Bot reviewed May 15, 2026
View reviewed changes
Copy link
Copy Markdown

@claude claude Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mismatch I flagged on the prior revision has been resolved (the stale / comments on the zizmor-suffixed lines were stripped; cache-disabled variants kept and bumped their version comments). Dependabot group bump on CI workflows only — LGTM.

Extended reasoning...

Overview

Pure CI/CD dependency bump touching 8 workflow files under .github/workflows/ — 13 grouped updates ranging from patch bumps (aws-actions/*, codeql-action, setup-uv, setup-node, actions/cache) to major bumps (actions/checkout v4→v6, pnpm/action-setup v5→v6, useblacksmith/setup-docker-builder v1.6→v1.8). All actions are SHA-pinned. No production code, application config, or release/publishing logic semantics are changed by this PR — only the SHAs/comments referencing third-party action versions.

Security risks

The supply-chain hygiene mechanism here is SHA-pinning + a human-verifiable # vX.Y.Z comment. On the prior revision, several SHAs on pipeline.yml lines that also carried trailing # zizmor: ignore[cache-poisoning] ... directives were bumped but the version comment was left at the old value, producing 11+ zizmor "pin has mismatched or missing version comment" findings. The current revision resolves these by removing the now-stale # v6.3.0 / # v5.0.4 comment on those specific lines (leaving just SHA # zizmor: ignore[...] ...); the cache-disabled variants kept the version comment and bumped it correctly to # v6.4.0. All 11+ zizmor alerts are now marked resolved on the PR. Resolution is comment-only and runtime-equivalent.

Level of scrutiny

Low — config-only PR limited to .github/workflows/, no application or release code is altered. Major-version bumps (actions/checkout v4→v6, pnpm/action-setup v5→v6) are notable but: actions/checkout v5/v6 are Node-24-runtime updates + a credentials-storage refactor (not used in an interactive way here), and pnpm/action-setup v6 adds pnpm v11 support but the workflows pin pnpm 10.33.0 explicitly via version: 10.33.0, so the major bump is binary-only and version-pinned. useblacksmith/* bumps are minor.

Other factors

PR carries the lgtm label, size:XS, and was raised by Dependabot. CI checks are running. The user (wochinge) explicitly requested re-review after the prior version-comment fix landed. My prior bug-report inline comment is marked resolved and the underlying zizmor findings are no longer flagged.

@wochinge wochinge merged commit 2306e86 into main May 15, 2026
36 checks passed
@wochinge wochinge deleted the dependabot/github_actions/github-actions-fbe0ecf9a4 branch May 15, 2026 07:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claude claude[bot] claude[bot] left review comments

@wochinge wochinge wochinge approved these changes

+1 more reviewer

@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@wochinge wochinge

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code lgtm This PR has been approved by a maintainer size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@wochinge @github-advanced-security