Repository navigation
build(deps): bump the github-actions group across 2 directories with 5 updates - #22413
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
…5 updates Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.7.0` | `4.8.0` | | [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) | `0.89.21` | `1.2.0` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.325.0` | `1.336.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | Bumps the github-actions group with 5 updates in the /.github/workflows directory: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.7.0` | `4.8.0` | | [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) | `0.89.21` | `1.2.0` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.325.0` | `1.336.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | Updates `docker/login-action` from 4.7.0 to 4.8.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@81c6f93...8aa5831) Updates `github/gh-aw-actions/setup` from 0.89.21 to 1.2.0 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](github/gh-aw-actions@924af5f...4607d46) Updates `ruby/setup-ruby` from 1.325.0 to 1.336.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@e8944e8...de492cf) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) Updates `docker/login-action` from 4.7.0 to 4.8.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@81c6f93...8aa5831) Updates `github/gh-aw-actions/setup` from 0.89.21 to 1.2.0 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](github/gh-aw-actions@924af5f...4607d46) Updates `ruby/setup-ruby` from 1.325.0 to 1.336.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@e8944e8...de492cf) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/gh-aw-actions/setup dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: ruby/setup-ruby dependency-version: 1.336.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/gh-aw-actions/setup dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: ruby/setup-ruby dependency-version: 1.336.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
github_actions
Contributor
🤖 GitHub commentsJust comment with:
|
Contributor
|
This pull request does not have a backport label. Could you fix it @dependabot[bot]? 🙏
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The generated action updates leave compiler and action pins, shared workflow inputs, and the manifest unchanged, so recompilation would restore older references and cause the drift check to fail.
1 open issue
What changed in this PR
Updates five SHA-pinned GitHub Actions used by APM Server’s CI, benchmarks, compose updates, and automated failure reporting. Application code is unchanged.
Changes:
- Bumps Docker login from v4.7.0 to v4.8.0 across three workflows.
- Updates the failure-report workflow’s gh-aw setup, Ruby setup, artifact download, and Node.js setup actions.
| File | Description |
|---|---|
.github/workflows/updatecli-failure-report.lock.yml |
Updates four action dependencies in the generated failure-report workflow. |
.github/workflows/update-compose.yml |
Updates Docker login for compose automation. |
.github/workflows/ci.yml |
Updates Docker login for CI registry access. |
.github/workflows/benchmarks.yml |
Updates Docker login for benchmark registry access. |
Review effort: Balanced
| - name: Setup Scripts | ||
| id: setup | ||
| uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 | ||
| uses: github/gh-aw-actions/setup@4607d462dc213dbe54d02f77ec31215776fd5554 # v1.2.0 |
Contributor
Dependency Update AnalysisSummary: This PR updates 5 SHA-pinned GitHub Actions. Most updates look low-risk and compatible, but overall risk is moderate because Dependency 1:
|
| Check | Result |
|---|---|
| Breaking changes | ✅ None found |
| Testable in PR | ci.yml and non-PR workflows |
| Commit verified | ✅ Yes |
| Pin format | ✅ SHA-pinned |
Changelog highlights (v4.7.0 → v4.8.0)
- Docker Hub OIDC token lifetime default changed to 1 hour.
- Internal dependency bumps (
@aws-sdk/client-ecr,@docker/actions-toolkit,vite). - No CVE/GHSA entry in the release notes.
Usage in this repository
.github/workflows/benchmarks.yml:145(manual/scheduled benchmark runs).github/workflows/ci.yml:197(CI job with registry login).github/workflows/update-compose.yml:33(scheduled/manual updatecli compose flow)- Inputs used:
registry,username,password; no action outputs consumed.
Compatibility assessment
Current usage is straightforward registry auth and does not depend on changed internals. No consumed inputs were removed/renamed.
Dependency 2: github/gh-aw-actions/setup v0.89.21 → v1.2.0
Ecosystem: GitHub Actions
| Check | Result |
|---|---|
| Breaking changes | ✅ None found in local usage |
| Testable in PR | schedule/workflow_dispatch only |
| Commit verified | ✅ Yes |
| Pin format | ✅ SHA-pinned |
Changelog highlights (v0.89.21 → v1.2.0)
- Exact
v1.2.0GitHub Release body was unavailable via MCP (tag exists and maps to SHA4607d462...). - Local tag metadata indicates:
Sync from gh-aw@v1.2.0. - Compare reference from PR metadata:
github/gh-aw-actions/compare/924af5f...4607d46.
Usage in this repository
.github/workflows/updatecli-failure-report.lock.yml(Setup Scriptssteps at lines 121, 452, 1537, 1809, 2118)- Inputs:
destination,job-name,safe-output-artifact-client; used to bootstrap local gh-aw scripts.
Compatibility assessment
The workflow still invokes the same setup step shape and downstream script paths; no direct interface break observed in this repo.
Dependency 3: ruby/setup-ruby v1.325.0 → v1.336.0
Ecosystem: GitHub Actions
| Check | Result |
|---|---|
| Breaking changes | ✅ None found in local usage |
| Testable in PR | schedule/workflow_dispatch only |
| Commit verified | verified: false, reason: unsigned) |
| Pin format | ✅ SHA-pinned |
Changelog highlights (v1.325.0 → v1.336.0)
- Release entry exists for
v1.336.0but contains only compare link (v1.335.0...v1.336.0) and no detailed notes. - No explicit CVE/GHSA/security-fix note in the retrieved release metadata.
Usage in this repository
.github/workflows/updatecli-failure-report.lock.yml:492- Inputs used:
ruby-version: '3.3'; no outputs consumed.
Compatibility assessment
Usage is minimal and likely compatible, but commit-signature verification failed for this pinned SHA per the provided facts file, which is a supply-chain concern.
Dependency 4: actions/download-artifact v8.0.1 → v8.0.2
Ecosystem: GitHub Actions
| Check | Result |
|---|---|
| Breaking changes | ✅ None found |
| Testable in PR | schedule/workflow_dispatch only |
| Commit verified | ✅ Yes |
| Pin format | ✅ SHA-pinned |
Changelog highlights (v8.0.1 → v8.0.2)
- Improved download retries for HTTP 429 responses (including
Retry-Afterhandling). - Internal update to
@actions/artifact6.3.1. - No breaking-change or CVE/GHSA note in release text.
Usage in this repository
.github/workflows/updatecli-failure-report.lock.ymllines 502, 507, 1552, 1569, 1577, 1823, 1830, 2135- Inputs used:
name,path,pattern,merge-multiple. - Follow-on shell logic already handles single-artifact flatten behavior explicitly.
Compatibility assessment
Patch-level retry improvements are compatible with current usage; existing post-download validation/workaround logic remains valid.
Dependency 5: actions/setup-node v7.0.0 → v7.1.0
Ecosystem: GitHub Actions
| Check | Result |
|---|---|
| Breaking changes | ✅ None found |
| Testable in PR | schedule/workflow_dispatch only |
| Commit verified | ✅ Yes |
| Pin format | ✅ SHA-pinned |
Changelog highlights (v7.0.0 → v7.1.0)
- Added
mise.tomlsupport and absolute path support fornode-version-file. - Added Node version validation and manifest fetch retry logic.
- No CVE/GHSA/security-fix entries in release notes.
Usage in this repository
.github/workflows/updatecli-failure-report.lock.yml:1913- Inputs used:
node-version: '24',package-manager-cache: false.
Compatibility assessment
No consumed interface changes for this usage; update appears compatible.
Labels Applied
No labels applied. oblt-aw/ai/merge-ready was not added because ecosystem checks failed for one updated Action pin (ruby/setup-ruby commit verification reported verified: false).
What is this? | From workflow: Observability Agentic Workflow — Pull Request
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 5 updates in the / directory:
4.7.04.8.00.89.211.2.01.325.01.336.08.0.18.0.27.0.07.1.0Bumps the github-actions group with 5 updates in the /.github/workflows directory:
4.7.04.8.00.89.211.2.01.325.01.336.08.0.18.0.27.0.07.1.0Updates
docker/login-actionfrom 4.7.0 to 4.8.0Release notes
Sourced from docker/login-action's releases.
Commits
8aa5831Merge pull request #1105 from docker/dependabot/npm_and_yarn/docker/actions-t...043f81d[dependabot skip] chore: update generated content3ff6998build(deps): bump@docker/actions-toolkitfrom 0.107.0 to 0.109.0694ef6aMerge pull request #1103 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...7c6e412[dependabot skip] chore: update generated contentaa2441fbuild(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...d6c10b0Merge pull request #1106 from docker/dependabot/github_actions/codeql-actions...319f1eeMerge pull request #1104 from docker/dependabot/github_actions/actions/setup-...b483b7fMerge pull request #1101 from docker/dependabot/npm_and_yarn/vite-7.3.7dc7d67cMerge pull request #1070 from crazy-max/increase-oidc-default-expiryUpdates
github/gh-aw-actions/setupfrom 0.89.21 to 1.2.0Release notes
Sourced from github/gh-aw-actions/setup's releases.
... (truncated)
Commits
4607d46chore: sync actions from gh-aw@v1.2.0 (#296)221ba4fchore: sync actions from gh-aw@v1.0.1 (#295)9b62390chore: sync actions from gh-aw@v0.93.6 (#294)de9d416chore: sync actions from gh-aw@v0.93.5 (#293)40fb427chore: sync actions from gh-aw@v0.93.4 (#292)e89a567chore: sync actions from gh-aw@v0.93.3 (#291)d9128ebchore: sync actions from gh-aw@v0.93.2 (#290)a9e8b9fchore: sync actions from gh-aw@v0.93.1 (#289)7177a79fix: remove setup JS test tooling and data during sync (#288)e7519e6chore: sync actions from gh-aw@v0.93.0 (#287)Updates
ruby/setup-rubyfrom 1.325.0 to 1.336.0Release notes
Sourced from ruby/setup-ruby's releases.
... (truncated)
Commits
de492cfasan and asan-release are now available on ubuntu-26.047f79781Update CRuby releases on Windows26e5b7dAdd ruby-3.3.13,ruby-3.4.12,ruby-4.0.9e1bd614Add ruby-4.0.8b1da480Update CRuby releases on Windows824c0e2Use ruby'sGem::Versioninstead of npm'ssemverto parse rubygems versiona89e929Tweak wording in the README, update link and simplifyfbbff8dSuggest the latest patch release when a version is unavailable651ff0dAdd ruby-4.1.0-preview1e81a8faFix windows msys1 setupUpdates
actions/download-artifactfrom 8.0.1 to 8.0.2Release notes
Sourced from actions/download-artifact's releases.
Commits
9000827Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2e455989Prepare download-artifact v8.0.2a00b90cMerge pull request #492 from actions/tunc-d-download-artifact-package-bump29bb7ceUpdate@actions/artifactto 6.3.1484a0b5Update the readme (#473)Updates
actions/setup-nodefrom 7.0.0 to 7.1.0Release notes
Sourced from actions/setup-node's releases.
Commits
949feb2Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)7207c4fchore: update dependencies and add license files (#1642)54337e0Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)fb54fa8Bump jest-each from 30.4.1 to 30.5.2 (#1636)7f84f1dBump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)0c54c7bBump@typescript-eslint/parserfrom 8.62.0 to 8.70.0 (#1615)a829419Bump@types/semverfrom 7.7.1 to 7.8.0 (#1616)680d1e4Support absolute paths in node-version-file (#1633)db0fb3aBump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)94196eeBump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)Updates
docker/login-actionfrom 4.7.0 to 4.8.0Release notes
Sourced from docker/login-action's releases.
Commits
8aa5831Merge pull request #1105 from docker/dependabot/npm_and_yarn/docker/actions-t...043f81d[dependabot skip] chore: update generated content3ff6998build(deps): bump@docker/actions-toolkitfrom 0.107.0 to 0.109.0694ef6aMerge pull request #1103 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...7c6e412[dependabot skip] chore: update generated contentaa2441fbuild(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...d6c10b0Merge pull request #1106 from docker/dependabot/github_actions/codeql-actions...319f1eeMerge pull request #1104 from docker/dependabot/github_actions/actions/setup-...b483b7fMerge pull request #1101 from docker/dependabot/npm_and_yarn/vite-7.3.7dc7d67cMerge pull request #1070 from crazy-max/increase-oidc-default-expiryUpdates
github/gh-aw-actions/setupfrom 0.89.21 to 1.2.0Release notes
Sourced from github/gh-aw-actions/setup's releases.
... (truncated)
Commits
4607d46chore: sync actions from gh-aw@v1.2.0 (#296)221ba4fchore: sync actions from gh-aw@v1.0.1 (#295)9b62390chore: sync actions from gh-aw@v0.93.6 (#294)de9d416chore: sync actions from gh-aw@v0.93.5 (#293)40fb427chore: sync actions from gh-aw@v0.93.4 (#292)e89a567chore: sync actions from gh-aw@v0.93.3 (#291)d9128ebchore: sync actions from gh-aw@v0.93.2 (#290)a9e8b9fchore: sync actions from gh-aw@v0.93.1 (#289)7177a79fix: remove setup JS test tooling and data during sync (#288)e7519e6chore: sync actions from gh-aw@v0.93.0 (#287)Updates
ruby/setup-rubyfrom 1.325.0 to 1.336.0Release notes
Sourced from ruby/setup-ruby's releases.
... (truncated)
Commits
de492cfasan and asan-release are now available on ubuntu-26.047f79781Update CRuby releases on Windows26e5b7dAdd ruby-3.3.13,ruby-3.4.12,ruby-4.0.9e1bd614Add ruby-4.0.8b1da480Update CRuby releases on Windows824c0e2Use ruby'sGem::Versioninstead of npm'ssemverto parse rubygems versiona89e929Tweak wording in the README, update link and simplifyfbbff8dSuggest the latest patch release when a version is unavailable651ff0dAdd ruby-4.1.0-preview1e81a8faFix windows msys1 setupUpdates
actions/download-artifactfrom 8.0.1 to 8.0.2Release notes
Sourced from actions/download-artifact's releases.
Commits
9000827Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2e455989Prepare download-artifact v8.0.2a00b90cMerge pull request #492 from actions/tunc-d-download-artifact-package-bump29bb7ceUpdate@actions/artifactto 6.3.1484a0b5Update the readme (#473)Updates
actions/setup-nodefrom 7.0.0 to 7.1.0Release notes
Sourced from actions/setup-node's releases.
Commits
949feb2Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)7207c4fchore: update dependencies and add license files (#1642)54337e0Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)fb54fa8Bump jest-each from 30.4.1 to 30.5.2 (#1636)7f84f1dBump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)0c54c7bBump@typescript-eslint/parserfrom 8.62.0 to 8.70.0 (#1615)a829419Bump@types/semverfrom 7.7.1 to 7.8.0 (#1616)680d1e4Support absolute paths in node-version-file (#1633)db0fb3aBump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)94196eeBump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions