Skip to content

ci(deps): bump the github-actions group with 5 updates - #5

Merged
abn merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-0ccdad66b6
Aug 23, 2026
Merged

abn merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-0ccdad66b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 5 updates:

Package From To
actions/checkout 6 7
dorny/paths-filter 3 4
docker/setup-qemu-action 3 4
redhat-actions/podman-login 1 2
redhat-actions/push-to-registry 2 3

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates dorny/paths-filter from 3 to 4

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.0

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3.0.3...v4.0.0

v3.0.4

What's Changed

v3.0.3

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3...v3.0.3

v3.0.2

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3...v3.0.2

v3.0.1

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v3...v3.0.1

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.3

v4.0.2

v4.0.1

v4.0.0

v3.0.4

v3.0.3

v3.0.2

v3.0.1

v3.0.0

v2.11.1

v2.11.0

v2.10.2

... (truncated)

Commits
  • ceb8a2b Update CHANGELOG.md for v4.0.3 and v3.0.4 (#327)
  • ef09b88 Document safe handling of file list outputs in workflows (#326)
  • 44adc5b Merge commit from fork
  • 4711b7a feat: add 'some-with-excludes' predicate quantifier (#322)
  • 93c889f fix: escape multi-line filenames in list-files shell and csv output
  • b41dfa9 docs: add contents permission to PR example (#248)
  • 9af6e5a fix: scope base-ignored warning to API path (#319)
  • cae9006 docs: update outputs in readme to account for the 'every' predicate-quantifie...
  • 7b450ff docs: update changelog for v4.0.2 (#318)
  • 9280377 fix: work around git dubious ownership errors in container jobs (#317)
  • Additional commits viewable in compare view

Updates docker/setup-qemu-action from 3 to 4

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.0.0

Full Changelog: docker/setup-qemu-action@v3.7.0...v4.0.0

v3.7.0

Full Changelog: docker/setup-qemu-action@v3.6.0...v3.7.0

v3.6.0

Full Changelog: docker/setup-qemu-action@v3.5.0...v3.6.0

v3.5.0

Full Changelog: docker/setup-qemu-action@v3.4.0...v3.5.0

v3.4.0

Full Changelog: docker/setup-qemu-action@v3.3.0...v3.4.0

v3.3.0

Full Changelog: docker/setup-qemu-action@v3.2.0...v3.3.0

v3.2.0

Full Changelog: docker/setup-qemu-action@v3.1.0...v3.2.0

v3.1.0

... (truncated)

Commits
  • 96fe6ef Merge pull request #315 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 31f08d3 [dependabot skip] chore: update generated content
  • 4e7017a build(deps): bump @​docker/actions-toolkit from 0.91.0 to 0.92.0
  • 0eca235 Merge pull request #314 from crazy-max/fix-yarn-preapprove-actions-toolkit
  • ea66a41 chore: allow actions-toolkit to bypass yarn age gate
  • 451542b Merge pull request #308 from docker/dependabot/npm_and_yarn/undici-6.27.0
  • 532ae00 [dependabot skip] chore: update generated content
  • b6f5af6 build(deps): bump undici from 6.26.0 to 6.27.0
  • cf96b86 Merge pull request #304 from docker/dependabot/npm_and_yarn/tmp-0.2.7
  • f0ba643 [dependabot skip] chore: update generated content
  • Additional commits viewable in compare view

Updates redhat-actions/podman-login from 1 to 2

Release notes

Sourced from redhat-actions/podman-login's releases.

v2.0

Breaking Changes

  • Upgrade @actions/core 1.x to 3.x, @actions/exec 1.x to 3.x, @actions/io 1.x to 3.x
  • Auth file path is now detected from podman's --verbose output instead of being hardcoded. The fallback path is used only if detection fails.
  • Registry input is now automatically lowercased to comply with OCI spec

Bug Fixes

  • Fix registryLogout() not cleaning up Docker config credentials in the post step (#36)
  • Fix auth file path mismatch with podman 5.x which changed from /tmp/podman-run-<uid> to /tmp/storage-run-<uid> (#47)
  • Fix ENOENT error when ~/.docker directory does not exist (#42)

Features

  • Add tls_verify input to skip TLS certificate verification for self-signed registries
  • Support AWS OIDC temporary credentials for ECR login via AWS_SESSION_TOKEN (#37)
  • Automatically lowercase registry input to prevent OCI naming errors (#44)

Dependency Upgrades

  • TypeScript 5.x to 6.0.3
  • ESLint 8 (EOL) to 10 with flat config
  • @aws-sdk/client-ecr 3.535 to 3.1094
  • @vercel/ncc 0.38 to 0.44
  • Remove unused @aws-sdk/util-base64
  • Resolve all npm audit vulnerabilities

CI & Infrastructure

  • Upgrade actions/checkout v6 to v7, actions/setup-node v6 to v7
  • Add workflow-level permissions: contents: read
  • Add concurrency groups to cancel redundant CI runs
  • Pin runs-on to ubuntu-24.04
  • Add Dependabot for npm and GitHub Actions updates
  • Add SECURITY.md
  • Enable secret scanning and push protection
  • Remove deprecated CRDA vulnerability scan workflow

Full Changelog: redhat-actions/podman-login@v1.7...v2.0

Update action to run on Node20.https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/

v1.6

Update action/core dependency to 1.10.0

Update action to run on Node16

v1.5

v1.4

No release notes provided.

v1.3

No release notes provided.

... (truncated)

Changelog

Sourced from redhat-actions/podman-login's changelog.

podman-login Changelog

v2.0

Breaking Changes

  • Upgrade @actions/core 1.x to 3.x, @actions/exec 1.x to 3.x, @actions/io 1.x to 3.x
  • Auth file path is now detected from podman's --verbose output instead of being hardcoded. The fallback path is used only if detection fails.
  • Registry input is now automatically lowercased to comply with OCI spec

Bug Fixes

  • Fix registryLogout() not cleaning up Docker config credentials in the post step (#36)
  • Fix auth file path mismatch with podman 5.x which changed from /tmp/podman-run-<uid> to /tmp/storage-run-<uid> (#47)
  • Fix ENOENT error when ~/.docker directory does not exist (#42)

Features

  • Add tls_verify input to skip TLS certificate verification for self-signed registries
  • Support AWS OIDC temporary credentials for ECR login via AWS_SESSION_TOKEN (#37)
  • Automatically lowercase registry input to prevent OCI naming errors (#44)

Dependency Upgrades

  • TypeScript 5.x to 6.0.3
  • ESLint 8 (EOL) to 10 with flat config
  • @aws-sdk/client-ecr 3.535 to 3.1094
  • @vercel/ncc 0.38 to 0.44
  • Remove unused @aws-sdk/util-base64
  • Resolve all npm audit vulnerabilities

CI & Infrastructure

  • Upgrade actions/checkout v6 to v7, actions/setup-node v6 to v7
  • Add workflow-level permissions: contents: read
  • Add concurrency groups to cancel redundant CI runs
  • Pin runs-on to ubuntu-24.04
  • Add Dependabot for npm and GitHub Actions updates
  • Add SECURITY.md
  • Enable secret scanning and push protection
  • Remove deprecated CRDA vulnerability scan workflow

v1.8

v1.7

v1.6

  • Update action/core dependency to 1.10.0

v1.5

v1.4

... (truncated)

Commits
  • 50c2d9a Update CHANGELOG.md for v2.0 release
  • 8b1d074 Merge pull request #64 from redhat-actions/fix/remaining-issues
  • 6be3c81 Fix auth file path detection, lowercase registry, and ECR OIDC support
  • b1530e7 Merge pull request #63 from redhat-actions/feature/tls-verify
  • b0eba47 Add tls_verify input to skip TLS certificate verification
  • dff696f Remove CRDA vulnerability scan workflow
  • 20eef96 Merge pull request #62 from redhat-actions/update/types-node-and-dependabot-c...
  • b9e7b01 Update @​types/node to 26.1.1 and exclude TypeScript 7 from Dependabot
  • 07532ea Fix ENOENT error when ~/.docker directory does not exist
  • 36756be Merge pull request #59 from redhat-actions/dependabot/github_actions/redhat-a...
  • Additional commits viewable in compare view

Updates redhat-actions/push-to-registry from 2 to 3

Release notes

Sourced from redhat-actions/push-to-registry's releases.

v3.0.0

Breaking Changes

  • Upgrade action runtime from Node 20 to Node 24. #113
  • Tags are no longer lowercased. Per the OCI distribution spec, only image names and registries are normalized to lowercase; tag case is now preserved. #112, #121

Features

  • Add Sigstore signing support via sigstore-private-key and sign-passphrase inputs. #120
  • Add podman-args input for global podman flags (e.g. --storage-driver=vfs) that apply to all podman invocations, not just push. #102, #121
  • Add remote input for podman remote mode (--remote). When enabled, Docker image storage checks are skipped. #95, #122

Bug Fixes

  • Prefix unqualified source images with localhost/ when pushing to prevent podman from resolving to remote registries. #66, #121
  • Fix default tag fallback when tags input is empty. #109
  • Fix registry input not being lowercased for OCI compliance. #110
  • Fix deprecated fs.rmdir usage, replace with fs.rm. #113

Dependency Updates

  • Upgrade @actions/core 1.x to 3.x, @actions/exec 1.x to 3.x, @actions/io 1.x to 3.x. #113
  • Upgrade TypeScript 5.3 to 6.0, migrate ESLint 8 to 10 with flat config. #113
  • Bump ini from 5.0.0 to 7.0.0. #118

CI & Infrastructure

  • Modernize all CI workflows: ubuntu-24.04, latest action versions, permissions, concurrency groups. #114
  • Enable secret scanning, push protection, and Dependabot. #114
  • Replace archived link checker with maintained fork. Remove defunct CRDA workflow. #123

Documentation

  • Add Required Permissions section, multi-line tag docs, qemu guidance, and podman remote docs to README.

Full Changelog: redhat-actions/push-to-registry@v2...v3.0.0

Update action to run on Node20. https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/

Update action to run on Node16

v2.7

v2.6

No release notes provided.

v2.5.1

No release notes provided.

Image manifest support

  • Allow pushing image manifest.

v2.4.1

No release notes provided.

Allow fully qualified image names in 'tags' input

... (truncated)

Changelog

Sourced from redhat-actions/push-to-registry's changelog.

push-to-registry Changelog

v3.0.0

Breaking Changes

  • Upgrade action runtime from Node 20 to Node 24. #113
  • Tags are no longer lowercased. Per the OCI distribution spec, only image names and registries are normalized to lowercase; tag case is now preserved. #112, #121

Features

  • Add Sigstore signing support via sigstore-private-key and sign-passphrase inputs. #120
  • Add podman-args input for global podman flags (e.g. --storage-driver=vfs) that apply to all podman invocations, not just push. #102, #121
  • Add remote input for podman remote mode (--remote). When enabled, Docker image storage checks are skipped. #95, #122

Bug Fixes

  • Prefix unqualified source images with localhost/ when pushing to prevent podman from resolving to remote registries. #66, #121
  • Fix default tag fallback when tags input is empty. #109
  • Fix registry input not being lowercased for OCI compliance. #110
  • Fix deprecated fs.rmdir usage, replace with fs.rm. #113
  • Fix typo in createDockerPodmanImageStorage function name. #113

Dependency Updates

  • Upgrade @actions/core from 1.x to 3.x. #113
  • Upgrade @actions/exec from 1.x to 3.x. #113
  • Upgrade @actions/io from 1.x to 3.x. #113
  • Upgrade TypeScript from 5.3 to 6.0. #113
  • Migrate ESLint from v8 to v10 with flat config. #113
  • Bump ini from 5.0.0 to 7.0.0. #118

CI & Infrastructure

  • Modernize all CI workflows: update to ubuntu-24.04, latest action versions, add permissions and concurrency groups. #114
  • Enable secret scanning and push protection. #114
  • Add Dependabot configuration for npm and GitHub Actions. #114
  • Add CODEOWNERS and SECURITY.md. #114

Documentation

  • Add Required Permissions section to README. #107, #121
  • Document multi-line tag support using YAML pipe syntax. #101, #121
  • Add qemu version guidance for multi-arch manifest builds. #85, #121
  • Document podman remote mode usage. #122

v2.8

v2.7.1

  • Don't add docker.io prefix to ECR images. #69

v2.7

v2.6

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6` | `7` |
| [dorny/paths-filter](https://github.com/dorny/paths-filter) | `3` | `4` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3` | `4` |
| [redhat-actions/podman-login](https://github.com/redhat-actions/podman-login) | `1` | `2` |
| [redhat-actions/push-to-registry](https://github.com/redhat-actions/push-to-registry) | `2` | `3` |


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

Updates `dorny/paths-filter` from 3 to 4
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](dorny/paths-filter@v3...v4)

Updates `docker/setup-qemu-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@v3...v4)

Updates `redhat-actions/podman-login` from 1 to 2
- [Release notes](https://github.com/redhat-actions/podman-login/releases)
- [Changelog](https://github.com/redhat-actions/podman-login/blob/main/CHANGELOG.md)
- [Commits](redhat-actions/podman-login@v1...v2)

Updates `redhat-actions/push-to-registry` from 2 to 3
- [Release notes](https://github.com/redhat-actions/push-to-registry/releases)
- [Changelog](https://github.com/redhat-actions/push-to-registry/blob/main/CHANGELOG.md)
- [Commits](redhat-actions/push-to-registry@v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dorny/paths-filter
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/setup-qemu-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: redhat-actions/podman-login
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: redhat-actions/push-to-registry
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 23, 2026
@dosubot dosubot Bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Aug 23, 2026
@abn
abn merged commit 28c25df into main Aug 23, 2026
5 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-0ccdad66b6 branch August 23, 2026 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant