Thanks to visit codestin.com
Credit goes to github.com

Skip to content

chore(deps): update github-actions (maint-28) (major) #9957

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: maint-28
Choose a base branch
from
Open

chore(deps): update github-actions (maint-28) (major) #9957

wants to merge 1 commit into from

Conversation

@renovate-bot
Copy link
Contributor

@renovate-bot renovate-bot commented Jun 17, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
Vampire/setup-wsl action major v5.0.1 -> v6.0.0
actions/attest-sbom action major v2 -> v3
actions/checkout action major v4.2.2 -> v5.0.0
actions/checkout action major v4 -> v5
actions/download-artifact action major v4.3.0 -> v6.0.0
actions/download-artifact action major v4 -> v6
actions/github-script action major v7.0.1 -> v8.0.0
actions/upload-artifact action major v4.6.2 -> v5.0.0
actions/upload-artifact action major v4 -> v5
github/codeql-action action major v3.29.7 -> v4.31.0
windows github-runner major 2022 -> 2025

Release Notes

Vampire/setup-wsl (Vampire/setup-wsl)

v6.0.0

Compare Source

Highlights

Update of Debian distribution if configured is now retried up to 4 times, as the package servers became less stable.

Breaking Changes

The action now always uses WSLv2 as the default WSL
version. Before it used WSLv1 if only that was available
whcih mainly was for the decommissioned windows-2019 runner images.

Details

  • Make Gradle Wrapper scripts executable [af172e2]
  • Remove tests on windows-2019 which was decommissioned [cbf3871]
  • Increase version to 6.0.0 [c0fd238]
  • Always use WSLv2 as default WSL version [e840292]
  • Install zstd before restoring cache on windows-11-arm to get same cache version [b87f2eb]
  • Run WSL update only on windows-2022, not windows-11-arm [c498099]
  • Retry up to 4 times to update Debian packages (#​75) [442f98c]
actions/attest-sbom (actions/attest-sbom)

v3

Compare Source

actions/checkout (actions/checkout)

v5.0.0

Compare Source

What's Changed
⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

actions/download-artifact (actions/download-artifact)

v6.0.0

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

New Contributors

Full Changelog: actions/download-artifact@v5...v6.0.0

v5.0.0

Compare Source

What's Changed

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

  • By name: name: my-artifact → extracted to path/ (direct)
  • By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

  • By name: name: my-artifact → extracted to path/ (unchanged)
  • By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)
Migration Guide
✅ No Action Needed If:
  • You download artifacts by name
  • You download multiple artifacts by ID
  • You already use merge-multiple: true as a workaround
⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist

### Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

- uses: actions/download-artifact@v5
  with:
    artifact-ids: 12345
    path: dist/my-artifact  # Explicitly specify the nested path

New Contributors

Full Changelog: actions/download-artifact@v4...v5.0.0

actions/github-script (actions/github-script)

v8.0.0

Compare Source

v7.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/github-script@v7...v7.1.0

actions/upload-artifact (actions/upload-artifact)

v5.0.0

Compare Source

github/codeql-action (github/codeql-action)

v4.31.0

Compare Source

v4.30.9

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.9 - 17 Oct 2025
  • Update default CodeQL bundle version to 2.23.3. #​3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #​3204

See the full CHANGELOG.md for more information.

v4.30.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.30.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.7 - 06 Oct 2025

  • [v4+ only] The CodeQL Action now runs on Node.js v24. #​3169

See the full CHANGELOG.md for more information.

v3.31.0

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.0 - 24 Oct 2025
  • Bump minimum CodeQL bundle version to 2.17.6. #​3223
  • When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #​3222

See the full CHANGELOG.md for more information.

v3.30.9

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.9 - 17 Oct 2025
  • Update default CodeQL bundle version to 2.23.3. #​3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #​3204

See the full CHANGELOG.md for more information.

v3.30.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.7 - 06 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025

  • Update default CodeQL bundle version to 2.23.2. #​3168

See the full CHANGELOG.md for more information.

v3.30.5

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.5 - 26 Sep 2025

  • We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #​3160

See the full CHANGELOG.md for more information.

v3.30.4

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.4 - 25 Sep 2025

  • We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #​3099 and #​3100
  • We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #​3107
  • You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #​3130
  • Update default CodeQL bundle version to 2.23.1. #​3118

See the full CHANGELOG.md for more information.

v3.30.3

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.3 - 10 Sep 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.2

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.2 - 09 Sep 2025

  • Fixed a bug which could cause language autodetection to fail. #​3084
  • Experimental: The quality-queries input that was added in 3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new analysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. #​3064

See the full CHANGELOG.md for more information.

v3.30.1

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.1 - 05 Sep 2025

  • Update default CodeQL bundle version to 2.23.0. #​3077

See the full CHANGELOG.md for more information.

v3.30.0

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.0 - 01 Sep 2025

  • Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. #​3054

See the full CHANGELOG.md for more information.

v3.29.11

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.11 - 21 Aug 2025

  • Update default CodeQL bundle version to 2.22.4. #​3044

See the full CHANGELOG.md for more information.

v3.29.10

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.10 - 18 Aug 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.29.9

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.9 - 12 Aug 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.29.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.8 - 08 Aug 2025

  • Fix an issue where the Action would autodetect unsupported languages such as HTML. #​3015

See the full CHANGELOG.md for more information.

Configuration

📅 Schedule: Branch creation - "after 2am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate forking-renovate bot added the team:VM Assigned to OTP team VM label Jun 17, 2025
@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@garazdawi garazdawi removed their assignment Jun 17, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Jun 17, 2025 •
edited
Loading

CT Test Results

  1 files   11 suites   4m 3s ⏱️
 95 tests  91 ✅ 4 💤 0 ❌
111 runs  107 ✅ 4 💤 0 ❌

Results for commit 4ffca5a.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

kikofernandez
kikofernandez previously approved these changes Jun 18, 2025
View reviewed changes
@paulo-ferraz-oliveira
Copy link
Contributor

@kikofernandez, will this mean that you'll start publishing for Windows 2025, too? I can't remember what the issue was but we weren't able to support that version next to https://github.com/erlef/setup-beam.

@renovate-bot renovate-bot changed the title chore(deps): update dependency windows to v2025 (maint-28) chore(deps): update github-actions (maint-28) (major) Jul 3, 2025
@renovate-bot renovate-bot force-pushed the renovate/maint-28-major-github-actions branch 2 times, most recently from 9ead5ad to ca0a027 Compare July 3, 2025 15:23
@renovate-bot renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from ca0a027 to 073fd2a Compare July 28, 2025 14:04
@renovate-bot renovate-bot force-pushed the renovate/maint-28-major-github-actions branch 4 times, most recently from dbd1556 to f40a998 Compare August 11, 2025 11:37
@kikofernandez kikofernandez mentioned this pull request Aug 11, 2025
Open
@renovate-bot renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from f40a998 to 850cca7 Compare August 11, 2025 13:28
@renovate-bot renovate-bot force-pushed the renovate/maint-28-major-github-actions branch 2 times, most recently from 5b68c73 to c14de24 Compare September 4, 2025 17:27
@renovate-bot renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from c14de24 to cfaf8d0 Compare September 17, 2025 07:37
@renovate-bot renovate-bot force-pushed the renovate/maint-28-major-github-actions branch 2 times, most recently from dff636e to 8b3efb3 Compare October 10, 2025 18:16
@renovate-bot renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from 8b3efb3 to 0138442 Compare October 17, 2025 21:57
@kikofernandez
Copy link
Contributor

@kikofernandez, will this mean that you'll start publishing for Windows 2025, too? I can't remember what the issue was but we weren't able to support that version next to https://github.com/erlef/setup-beam.

Sorry for the huge delay. If possible, yes, simply because we want to use an up-to-date GH Action.

@renovate-bot renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from 0138442 to 4ffca5a Compare October 24, 2025 19:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kikofernandez kikofernandez kikofernandez left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@kikofernandez kikofernandez

Labels

team:VM Assigned to OTP team VM

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@renovate-bot @CLAassistant @paulo-ferraz-oliveira @kikofernandez @garazdawi