Update GitHub Actions dependencies (major)#85
Conversation
|
Renovate Jira issue ID: SONARJAVA-6324 |
Summary
This PR updates GitHub Actions to major versions across four workflows:
All references use pinned commit SHAs with version tags for reproducibility. What reviewers should knowCritical review point: SonarSource/gh-action_release v7.0.0 introduces breaking changes:
Routine checks:
|
|
![sonar-review-alpha[bot]](https://avatars.githubusercontent.com/in/3025063?s=60&v=4){kind=small}
| id-token: write | ||
| contents: write | ||
| uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v6 | ||
| uses: SonarSource/gh-action_release/.github/workflows/main.yaml@d9c158044abff69356475ff82b1f99b78dbd9d93 # 7.0.0 |
There was a problem hiding this comment.
gh-action_release v7.0.0 requires the version input — it is now mandatory and missing from the with: block below. Without it the workflow will error immediately on invocation.
Additionally, v7.0.0's breaking change states the action must not be triggered by the release: published event — the action now owns GitHub release publication itself (reusing an existing draft). The trigger at the top of this file needs to change from release: published to workflow_dispatch. See the v6→v7 migration guide: https://github.com/SonarSource/gh-action_release/tree/7.0.0#migrating-from-v6-to-v7-draft-first-workflow_dispatch
- Mark as noise
|
|
||
| - name: Checkout Sources | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 |
There was a problem hiding this comment.
SHA comment says # v6 but build.yml and unified-dogfooding.yml annotate the same SHA (de0fac2e) as # v6.0.2. Update the comment to match so the pinned version is unambiguous at a glance.
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
- Mark as noise
This PR contains the following updates:
v6→7.0.0v5.0.1→v6.0.2v4→v6v3.6.3→v4.0.1Release Notes
SonarSource/gh-action_release (SonarSource/gh-action_release)
v7.0.0Compare Source
What's Changed
The v7 generation complies with release and tag immutability.
Improvements
Breaking Change
versioninput is now requiredFull Changelog: SonarSource/gh-action_release@6.8.1...7.0.0
actions/checkout (actions/checkout)
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
jdx/mise-action (jdx/mise-action)
v4.0.1: : Documentation and Internal CleanupCompare Source
A small maintenance release that updates the README documentation to reflect v4 and cleans up internal code. There are no functional changes to the action itself.
Changed
jdx/mise-action@v4,actions/checkout@v6, and current tool versions by @deining in #407 and #408getCwd()helper to deduplicate working directory resolution logic (internal refactor, no behavior change) by @altendky in #403New Contributors
Full Changelog: jdx/mise-action@v4.0.0...v4.0.1
v4.0.0Compare Source
What's Changed
53b8394by @renovate[bot] in #396820e316by @renovate[bot] in #397New Contributors
Full Changelog: jdx/mise-action@v3...v4.0.0
v4Compare Source
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.