Skip to content

chore(deps): bump the github-actions group across 1 directory with 6 updates - #10047

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-84bc95e2d3
Open

chore(deps): bump the github-actions group across 1 directory with 6 updates#10047
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-84bc95e2d3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 6 updates in the / directory:

Package From To
actions/checkout 4 7
github/gh-aw-actions/setup 0.79.8 0.89.2
github/gh-aw-actions/setup-cli 0.79.8 0.89.2
actions/cache/restore 5.0.5 6.1.0
actions/cache/save 5.0.5 6.1.0
actions/setup-go 5 7

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Commits

Updates github/gh-aw-actions/setup from 0.79.8 to 0.89.2

Release notes

Sourced from github/gh-aw-actions/setup's releases.

v0.89.2

Sync of actions from gh-aw at v0.89.2.

v0.89.1

Sync of actions from gh-aw at v0.89.1.

v0.89.0

Sync of actions from gh-aw at v0.89.0.

v0.88.8

Sync of actions from gh-aw at v0.88.8.

v0.88.7

Sync of actions from gh-aw at v0.88.7.

v0.88.6

Sync of actions from gh-aw at v0.88.6.

v0.88.5

Sync of actions from gh-aw at v0.88.5.

v0.88.4

Sync of actions from gh-aw at v0.88.4.

v0.88.3

Sync of actions from gh-aw at v0.88.3.

v0.88.2

Sync of actions from gh-aw at v0.88.2.

v0.88.0

Sync of actions from gh-aw at v0.88.0.

v0.87.10

Sync of actions from gh-aw at v0.87.10.

v0.87.9

Sync of actions from gh-aw at v0.87.9.

v0.87.8

Sync of actions from gh-aw at v0.87.8.

v0.87.7

Sync of actions from gh-aw at v0.87.7.

v0.87.6

Sync of actions from gh-aw at v0.87.6.

v0.87.5

Sync of actions from gh-aw at v0.87.5.

... (truncated)

Commits

Updates github/gh-aw-actions/setup-cli from 0.79.8 to 0.89.2

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.89.2

Sync of actions from gh-aw at v0.89.2.

v0.89.1

Sync of actions from gh-aw at v0.89.1.

v0.89.0

Sync of actions from gh-aw at v0.89.0.

v0.88.8

Sync of actions from gh-aw at v0.88.8.

v0.88.7

Sync of actions from gh-aw at v0.88.7.

v0.88.6

Sync of actions from gh-aw at v0.88.6.

v0.88.5

Sync of actions from gh-aw at v0.88.5.

v0.88.4

Sync of actions from gh-aw at v0.88.4.

v0.88.3

Sync of actions from gh-aw at v0.88.3.

v0.88.2

Sync of actions from gh-aw at v0.88.2.

v0.88.0

Sync of actions from gh-aw at v0.88.0.

v0.87.10

Sync of actions from gh-aw at v0.87.10.

v0.87.9

Sync of actions from gh-aw at v0.87.9.

v0.87.8

Sync of actions from gh-aw at v0.87.8.

v0.87.7

Sync of actions from gh-aw at v0.87.7.

v0.87.6

Sync of actions from gh-aw at v0.87.6.

v0.87.5

Sync of actions from gh-aw at v0.87.5.

... (truncated)

Commits

Updates actions/cache/restore from 5.0.5 to 6.1.0

Release notes

Sourced from actions/cache/restore's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache/restore's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates actions/cache/save from 5.0.5 to 6.1.0

Release notes

Sourced from actions/cache/save's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache/save's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates actions/setup-go from 5 to 7

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

New Contributors

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Dependency update (dependabot) github_actions Pull requests that update GitHub Actions code labels Sep 15, 2026
Copilot AI balanced review requested due to automatic review settings September 15, 2026 20:16
@dependabot dependabot Bot added dependencies Dependency update (dependabot) github_actions Pull requests that update GitHub Actions code labels Sep 15, 2026
@microsoft-github-policy-service microsoft-github-policy-service Bot added the customer-reported identify a customer issue label Sep 15, 2026
@microsoft-github-policy-service

microsoft-github-policy-service Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution Dependabot (@dependabot)[bot]! We will review the pull request and get back to you soon.

@azure-pipelines

azure-pipelines Bot commented Sep 15, 2026

Copy link
Copy Markdown
Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI reviewed Sep 15, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Mutable action tags remain, and the generated maintenance workflow’s helper versions are out of sync with its generator.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates GitHub Actions dependencies used by CI and agentic maintenance workflows.

Changes:

  • Upgrades checkout and Go setup actions.
  • Updates gh-aw setup actions.
  • Upgrades cache restore/save actions.
File summaries
File Description
.github/workflows/copilot-setup-steps.yml Refreshes the gh-aw setup action digest.
.github/workflows/cli-ci.yml Upgrades checkout and setup-go to v7.
.github/workflows/agentics-maintenance.yml Upgrades checkout, cache, and gh-aw actions.
Review details

Suppressed comments (1)

.github/workflows/cli-ci.yml:93

  • This remains a mutable major tag while the other actions/setup-go step in this workflow is pinned to the v7.0.0 commit at line 78. Use the same immutable SHA here so the action code cannot change without review. 
      - uses: actions/setup-go@v7
  • Files reviewed: 3/3 changed files
  • Comments generated: 2
  • Review effort level: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/cli-ci.yml
contents: read
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
Comment thread .github/workflows/agentics-maintenance.yml Outdated
steps:
- name: Setup Scripts
uses: github/gh-aw-actions/setup@c0338fef4749d08c21f8f975fb0e37efa17dda47 # v0.79.8
uses: github/gh-aw-actions/setup@5e508589e03a7757a7e05b26e834292f5445bfb6 # v0.88.8
@dependabot
chore(deps): bump the github-actions group across 1 directory with 6 …
86b6d50 
…updates

Bumps the github-actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) | `0.79.8` | `0.89.2` |
| [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) | `0.79.8` | `0.89.2` |
| [actions/cache/restore](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |
| [actions/cache/save](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5` | `7` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v7)

Updates `github/gh-aw-actions/setup` from 0.79.8 to 0.89.2
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@v0.79.8...e67822c)

Updates `github/gh-aw-actions/setup-cli` from 0.79.8 to 0.89.2
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Commits](github/gh-aw-actions@v0.79.8...v0.89.2)

Updates `actions/cache/restore` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5.0.5...55cc834)

Updates `actions/cache/save` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5.0.5...55cc834)

Updates `actions/setup-go` from 5 to 7
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v7)

---
updated-dependencies:
- dependency-name: actions/cache/restore
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache/save
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/gh-aw-actions/setup
  dependency-version: 0.88.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/gh-aw-actions/setup-cli
  dependency-version: 0.88.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI review requested due to automatic review settings September 17, 2026 02:58
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-84bc95e2d3 branch from cc36931 to 86b6d50 Compare September 17, 2026 02:58
Copilot AI reviewed Sep 17, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Generated manifests are stale, and several CI actions remain referenced through mutable tags.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

.github/workflows/cli-ci.yml:93

  • This mutable major tag differs from the SHA-pinned setup-go reference already used by the preceding magefile-tests job. Reuse the resolved v7 commit so this job cannot execute changed action code without a reviewed dependency update. 
      - uses: actions/setup-go@v7

.github/workflows/cli-ci.yml:90

  • This mutable major tag is the only unpinned checkout reference in this workflow; the other jobs already use the resolved v7 SHA. Pinning it prevents a tag move from changing CI code without review. 
      - uses: actions/checkout@v7
  • Files reviewed: 7/7 changed files
  • Comments generated: 4
  • Review effort level: Balanced

Comment thread .github/workflows/lint-ext-azure-ai-evaluations.yml
Comment on lines +34 to +35
- uses: actions/checkout@v7
- uses: actions/setup-go@v7
Comment thread .github/workflows/extension-pr-labeler.lock.yml
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@5e508589e03a7757a7e05b26e834292f5445bfb6 # v0.88.7
uses: github/gh-aw-actions/setup@e67822c8ebaae760c3be935622dbfe343a465306 # v0.89.3
Comment thread .github/workflows/issue-triage.lock.yml
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@5e508589e03a7757a7e05b26e834292f5445bfb6 # v0.88.7
uses: github/gh-aw-actions/setup@e67822c8ebaae760c3be935622dbfe343a465306 # v0.89.3
Comment thread .github/workflows/update-instructions-from-pr-reviews.lock.yml
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@5e508589e03a7757a7e05b26e834292f5445bfb6 # v0.88.7
uses: github/gh-aw-actions/setup@e67822c8ebaae760c3be935622dbfe343a465306 # v0.89.3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@danieljurek Daniel Jurek (danieljurek) Awaiting requested review from danieljurek danieljurek is a code owner
@vhvb1989 Victor Vazquez (vhvb1989) Awaiting requested review from vhvb1989 vhvb1989 is a code owner
@tg-msft tg-msft Awaiting requested review from tg-msft tg-msft is a code owner
@RickWinter Rick Winter (RickWinter) Awaiting requested review from RickWinter RickWinter is a code owner
@richardpark-msft Richard Park (richardpark-msft) Awaiting requested review from richardpark-msft richardpark-msft is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

customer-reported identify a customer issue dependencies Dependency update (dependabot) github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant