Repository navigation
chore(deps): update github-actions - #590
Conversation
Code Metrics Report
Details | | main (331e50f) | #590 (626a68d) | +/- |
|---------------------|----------------|----------------|---------|
| Coverage | 88.6% | 88.6% | 0.0% |
| Files | 208 | 208 | 0 |
| Lines | 6263 | 6263 | 0 |
| Covered | 5552 | 5552 | 0 |
+ | Test Execution Time | 16m34s | 2m17s | -14m17s |Reported by octocov |
b67f083 to
bcd023a
Compare
|
@copilot fix the CI error |
bcd023a to
3ac1c76
Compare
Co-authored-by: IzumiSy <982850+IzumiSy@users.noreply.github.com>
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Fixed in 05cdc7e. The e2e container used Playwright 1.64.0 while the tests require 1.63.0, causing browser launch failures. Restored the matching digest-pinned image. Formatting, version/digest checks, secret scanning, review, and CodeQL passed; authenticated e2e tests still need the CI run. |
|
@copilot Can we ignore changes in ".github/workflows/code-review.lock.yml" which should be auto-generated and should not touched. I would like Renovate to ignore it. |
Co-authored-by: IzumiSy <982850+IzumiSy@users.noreply.github.com>
Done in a8c6d51. Renovate now ignores |
|
@copilot I would like to specify "".github/workflows/*.lock.yml" for candidate files to ignore |
Co-authored-by: IzumiSy <982850+IzumiSy@users.noreply.github.com>
This PR contains the following updates:
e622436→1e89736v4.2.2→v4.4.0v7.0.0→v7.0.1v3.2.0→v3.3.0v8.0.1→v8.0.2v7.0.0→v7.1.0v6.4.0→v6.5.0v7.0.1→v7.0.2v2.62.3→v2.64.0v4.0.5→v4.1.0v2.1.0→v2.1.2v4.37.7→v4.38.3v0.89.21→v0.91.9v1.63.0-noble→v1.64.0-noble24→24.21.0v4.1.0→v4.4.0v6.0.9→v6.1.0v1.6.0→v1.7.0Release Notes
actions/checkout (actions/checkout)
v4.4.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v4 by @aiqiaoy in #2502https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v4.3.1...v4.4.0
v4.3.1Compare Source
v4.3.0Compare Source
actions/create-github-app-token (actions/create-github-app-token)
v3.3.0Compare Source
Features
Bug Fixes
actions/download-artifact (actions/download-artifact)
v8.0.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/download-artifact@v8.0.1...v8.0.2
actions/setup-node (actions/setup-node)
v7.1.0Compare Source
What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v7.0.0...v7.1.0
actions/upload-artifact (actions/upload-artifact)
v7.0.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2
aquaproj/aqua (aqua)
v2.64.0Compare Source
Features
#5364 Support installing only specified packages by command or package names
aqua installnow accepts command names or package names as positional arguments. Only packages matching them are installed.If any of the given names isn't found in the configuration files, the command fails:
#5279 Add a settings file
${XDG_CONFIG_HOME:-$HOME/.config}/aquaproj-aqua/config.yamlchecksum.enabledAQUA_CHECKSUMchecksum.requireAQUA_REQUIRE_CHECKSUMchecksum.enforceAQUA_ENFORCE_CHECKSUMchecksum.enforce_requireAQUA_ENFORCE_REQUIRE_CHECKSUMlazy_installAQUA_DISABLE_LAZY_INSTALL(inverted)policy.enabledAQUA_DISABLE_POLICY(inverted)policy.configAQUA_POLICY_CONFIGtrackingAQUA_DISABLE_TRACKING(inverted)progress_barAQUA_PROGRESS_BARlog.levelAQUA_LOG_LEVELlog.colorAQUA_LOG_COLORmax_parallelismAQUA_MAX_PARALLELISMglobal_configAQUA_GLOBAL_CONFIGroot_dirAQUA_ROOT_DIRkeyringAQUA_KEYRING_ENABLEDPrecedence:
Environment variable > settings file > defaultPerformance Improvement
#5283 Detect glibc by its loader instead of by running ldd
Bug Fixes
#5284 gr: Don't take a build for particular hardware as the ordinary one
#5285 gr: shorter isn't the point, the same name with less on it is
#5287 Say what cosign said, and wait long enough for it to matter
#5310 gr: Don't claim a provenance that is another artifact's
v2.63.0Compare Source
Security
Fix a path traversal vulnerability GHSA-286g-rf2x-cv99.
When a package archive contained a GNU sparse file, aqua re-extracted the whole archive with the host
tar, applying none of its own path or symlink containment. On hosts whosetarfollows symlinks during extraction (e.g. BusyBox tar), a crafted archive could plant a symlink escaping the install directory and write a regular file through it. aqua now keeps the systemtarout of the install directory: it validates the sparse member names, extracts them into a staging directory, and moves each to its verified destination itself.Features
#5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR
#5115 Support AQUA_DISABLE_TRACKING to disable the tracking of last used date times
Fixes
#5237 Skip minisign verification if the host platform doesn't support minisign
#5188 Ignore incomplete release assets in aqua gr
#5178 Support files[].src in go_install packages
#5171 Extract 7z archives that use the ARM64 filter
#5161 signer_workflow is a literal path, not a regex
Others
#5239 Fix Dockerfile build failure caused by a stale apt package index
aquaproj/aqua-installer (aquaproj/aqua-installer)
v4.1.0Compare Source
SHA256 Checksum
Features
#951 Add the packages input to install only specified packages
aqua >= v2.64.0 is required.
By default, aqua-installer runs
aqua i -l, so tools are installed by lazy install when they are first run.This has some problems:
A common workaround is to run each command with
--versionfirst to trigger lazy install, but the token is still passed to the command, it's hard to understand why the command is run, and you have to add a step for every command.With the
packagesinput, only the specified packages are installed up front rather than by lazy install, so you don't need to pass a GitHub access token when running them.#are ignoredpackagesis set andaqua_optsis the default value-l,-lisn't passed toaqua i, because-lskips installing packagesOthers
#954 Update the bootstrap version to v2.64.0
changesets/action (changesets/action)
v2.1.2Compare Source
Patch Changes
#735
8833883Thanks @bluwy! - Handle error when pushing git tags with the git CLI#724
36f529fThanks @bluwy! - Improve log messages#724
36f529fThanks @bluwy! - Fix root action double error logs#729
ca85897Thanks @bluwy! - Always switch and reset branch when generating version commits, similar to ifpush-with-git-cliis enabledv2.1.1Compare Source
Patch Changes
da1ea29Thanks @KEBABSELLER6! - Fixed typo in renamed inputs from v1 to v2github/codeql-action (github/codeql-action)
v4.38.3Compare Source
v4.38.2Compare Source
v4.38.1Compare Source
v4.38.0Compare Source
linux-arm64CodeQL bundle when available. #4072v4.37.9Compare Source
v4.37.8Compare Source
No user facing changes.
github/gh-aw-actions (github/gh-aw-actions)
v0.91.9Compare Source
Sync of actions from gh-aw at
v0.91.9.v0.91.8Compare Source
Sync of actions from gh-aw at
v0.91.8.v0.91.7Compare Source
Sync of actions from gh-aw at
v0.91.7.v0.91.6Compare Source
Sync of actions from gh-aw at
v0.91.6.v0.91.5Compare Source
Sync of actions from gh-aw at
v0.91.5.v0.91.4Compare Source
Sync of actions from gh-aw at
v0.91.4.v0.91.2Compare Source
Sync of actions from gh-aw at
v0.91.2.v0.91.1Compare Source
Sync of actions from gh-aw at
v0.91.1.v0.91.0Compare Source
Sync of actions from gh-aw at
v0.91.0.v0.90.4Compare Source
Sync of actions from gh-aw at
v0.90.4.v0.90.3Compare Source
Sync of actions from gh-aw at
v0.90.3.v0.90.1Compare Source
Sync of actions from gh-aw at
v0.90.1.v0.90.0Compare Source
Sync of actions from gh-aw at
v0.90.0.v0.89.22Compare Source
Sync of actions from gh-aw at
v0.89.22.actions/node-versions (node)
v24.21.0: 24.21.0Compare Source
Node.js 24.21.0
v24.20.0: 24.20.0Compare Source
Node.js 24.20.0
v24.19.0: 24.19.0Compare Source
Node.js 24.19.0
v24.18.1: 24.18.1Compare Source
Node.js 24.18.1
v24.18.0: 24.18.0Compare Source
Node.js 24.18.0
v24.17.0: 24.17.0Compare Source
Node.js 24.17.0
v24.16.0: 24.16.0Compare Source
Node.js 24.16.0
v24.15.0: 24.15.0Compare Source
Node.js 24.15.0
v24.14.1: 24.14.1Compare Source
Node.js 24.14.1
v24.14.0: 24.14.0Compare Source
Node.js 24.14.0
v24.13.1: 24.13.1Compare Source
Node.js 24.13.1
v24.13.0: 24.13.0Compare Source
Node.js 24.13.0
v24.12.0: 24.12.0Compare Source
Node.js 24.12.0
v24.11.1: 24.11.1Compare Source
Node.js 24.11.1
v24.11.0: 24.11.0Compare Source
Node.js 24.11.0
v24.10.0: 24.10.0Compare Source
Node.js 24.10.0
v24.9.0: 24.9.0Compare Source
Node.js 24.9.0
v24.8.0: 24.8.0Compare Source
Node.js 24.8.0
v24.7.0: 24.7.0Compare Source
Node.js 24.7.0
v24.6.0: 24.6.0Compare Source
Node.js 24.6.0
v24.5.0: 24.5.0Compare Source
Node.js 24.5.0
v24.4.1: 24.4.1Compare Source
Node.js 24.4.1
v24.4.0: 24.4.0Compare Source
Node.js 24.4.0
v24.3.0: 24.3.0Compare Source
Node.js 24.3.0
v24.2.0: 24.2.0Compare Source
Node.js 24.2.0
v24.1.0: 24.1.0Compare Source
Node.js 24.1.0
v24.0.2: 24.0.2Compare Source
Node.js 24.0.2
v24.0.1: 24.0.1Compare Source
Node.js 24.0.1
pnpm/action-setup (pnpm/action-setup)
v4.4.0Compare Source
Updated the action to use Node.js 24.
v4.3.0Compare Source
What's Changed
@types/node-fetchdependency by @silverwind in #186New Contributors
Full Changelog: pnpm/action-setup@v4.2.0...v4.3.0
v4.2.0Compare Source
When there's a
.npmrcfile at the root of the repository, pnpm will be fetched from the registry that is specified in that.npmrcfile #179tailor-platform/actions (tailor-platform/actions)
v1.7.0Compare Source
What's Changed
Full Changelog: tailor-platform/actions@v1...v1.7.0
Configuration
📅 Schedule: (in timezone Asia/Tokyo)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.