From 76d440c6eb8364ff5fa05249135b50482ebcd6cb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 4 Oct 2026 15:12:45 +0000 Subject: [PATCH] build(deps): bump the github-actions group across 1 directory with 13 updates Bumps the github-actions group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `7` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4` | `6` | | [actions/setup-node](https://github.com/actions/setup-node) | `4` | `7` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` | | [docker/login-action](https://github.com/docker/login-action) | `3` | `4` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `5` | `6` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` | | [google-github-actions/auth](https://github.com/google-github-actions/auth) | `2` | `3` | | [google-github-actions/setup-gcloud](https://github.com/google-github-actions/setup-gcloud) | `2` | `3` | | [changesets/action](https://github.com/changesets/action) | `1` | `2` | | [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `8.2.1` | `8.3.0` | Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v4...v7) Updates `pnpm/action-setup` from 4 to 6 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/v4...v6) Updates `actions/setup-node` from 4 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4...v7) Updates `docker/setup-buildx-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4) Updates `docker/login-action` from 3 to 4 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v4) Updates `docker/metadata-action` from 5 to 6 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/v5...v6) Updates `docker/build-push-action` from 6 to 7 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v6...v7) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v7) Updates `actions/download-artifact` from 4 to 8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v8) Updates `google-github-actions/auth` from 2 to 3 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](https://github.com/google-github-actions/auth/compare/v2...v3) Updates `google-github-actions/setup-gcloud` from 2 to 3 - [Release notes](https://github.com/google-github-actions/setup-gcloud/releases) - [Changelog](https://github.com/google-github-actions/setup-gcloud/blob/main/CHANGELOG.md) - [Commits](https://github.com/google-github-actions/setup-gcloud/compare/v2...v3) Updates `changesets/action` from 1 to 2 - [Release notes](https://github.com/changesets/action/releases) - [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md) - [Commits](https://github.com/changesets/action/compare/v1...v2) Updates `SonarSource/sonarqube-scan-action` from 8.2.1 to 8.3.0 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/22918119ff8e1ca75a623e15c8296b6ea4fbe28f...d209202bc7d53ff1cc128f7f907dac145c9d6ae9) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: changesets/action dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: google-github-actions/auth dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: google-github-actions/setup-gcloud dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: pnpm/action-setup dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 40 ++++++++++++++-------------- .github/workflows/docker-publish.yml | 12 ++++----- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 16 +++++------ .github/workflows/sonarqube.yaml | 4 +-- 5 files changed, 37 insertions(+), 37 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6f1f935..6b7c5aa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: name: cargo-deny (license policy) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: EmbarkStudios/cargo-deny-action@v2 with: command: check licenses @@ -58,7 +58,7 @@ jobs: REDIS_URL: redis://localhost:6379 SQLX_OFFLINE: "true" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install pinned toolchain (rust-toolchain.toml) run: rustup toolchain install - uses: Swatinem/rust-cache@v2 @@ -76,11 +76,11 @@ jobs: runs-on: ubuntu-latest steps: # Full history: changeset status diffs against the base branch. - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: 24 cache: pnpm @@ -110,17 +110,17 @@ jobs: contents: read packages: write steps: - - uses: actions/checkout@v4 - - uses: docker/setup-buildx-action@v3 + - uses: actions/checkout@v7 + - uses: docker/setup-buildx-action@v4 - name: Log in to GHCR if: github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ghcr.io/${{ github.repository }} tags: | @@ -128,7 +128,7 @@ jobs: type=ref,event=pr type=sha - name: Build the image for the smoke test - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . load: true @@ -149,7 +149,7 @@ jobs: grep -q "DATABASE_URL is required" <<<"$out" || { echo "::error::chimely did not reach config validation"; exit 1; } docker run --rm --network none --entrypoint /bin/sleep "$SMOKE_IMAGE" 1 test "$(docker image inspect -f '{{.Config.User}}' "$SMOKE_IMAGE")" = "65532:65532" - - uses: docker/build-push-action@v6 + - uses: docker/build-push-action@v7 with: context: . push: ${{ github.event_name != 'pull_request' }} @@ -182,16 +182,16 @@ jobs: contents: read packages: write steps: - - uses: actions/checkout@v4 - - uses: docker/setup-buildx-action@v3 + - uses: actions/checkout@v7 + - uses: docker/setup-buildx-action@v4 - name: Log in to GHCR - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - id: build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . platforms: ${{ matrix.platform }} @@ -203,7 +203,7 @@ jobs: mkdir -p "${RUNNER_TEMP}/digests" digest='${{ steps.build.outputs.digest }}' touch "${RUNNER_TEMP}/digests/${digest#sha256:}" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: digest-${{ matrix.arch }} path: ${{ runner.temp }}/digests/* @@ -219,20 +219,20 @@ jobs: contents: read packages: write steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: path: ${{ runner.temp }}/digests pattern: digest-* merge-multiple: true - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@v4 - name: Log in to GHCR - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ghcr.io/${{ github.repository }} tags: | diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 619e422..e196454 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -36,7 +36,7 @@ jobs: REGION: ${{ vars.REGION }} PRERELEASE: ${{ github.event.release.prerelease }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Extract release tag run: echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> "$GITHUB_ENV" @@ -48,18 +48,18 @@ jobs: # Auth precedes the build so the registry cache can be read from GAR. - name: Google Auth - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@v3 with: workload_identity_provider: projects/1042125736866/locations/global/workloadIdentityPools/github-pool/providers/github-provider service_account: github-actions@dodopayments.iam.gserviceaccount.com - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v2 + uses: google-github-actions/setup-gcloud@v3 - name: Docker auth run: gcloud auth configure-docker "${REGION}-docker.pkg.dev" - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@v4 # `latest` tracks the newest stable release, so a pre-release publishes its # own tag but never moves `latest`. @@ -71,7 +71,7 @@ jobs: echo "tags=$TAGS" >> "$GITHUB_OUTPUT" - name: Build the image for the smoke test - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . load: true @@ -97,7 +97,7 @@ jobs: # Durable registry cache in GAR. The cargo-chef dependency layer is # compiled once and reused across releases. - name: Build and push chimely image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . push: true diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 76b852d..e0210e0 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -21,7 +21,7 @@ jobs: env: SQLX_OFFLINE: "true" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install pinned toolchain (rust-toolchain.toml) run: rustup toolchain install - uses: Swatinem/rust-cache@v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 915e523..b31721e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,15 +41,15 @@ jobs: contents: write pull-requests: write steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: 24 cache: pnpm - run: pnpm install --frozen-lockfile - name: Open or update the Version Packages PR - uses: changesets/action@v1 + uses: changesets/action@v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -64,9 +64,9 @@ jobs: # OIDC token for npm provenance (NPM_CONFIG_PROVENANCE on the publish step). id-token: write steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: 24 cache: pnpm @@ -88,7 +88,7 @@ jobs: *) echo "provenance=false" >> "$GITHUB_OUTPUT" ;; esac - name: Publish to npm - uses: changesets/action@v1 + uses: changesets/action@v2 with: publish: pnpm changeset publish createGithubReleases: false diff --git a/.github/workflows/sonarqube.yaml b/.github/workflows/sonarqube.yaml index e41c844..c060d53 100644 --- a/.github/workflows/sonarqube.yaml +++ b/.github/workflows/sonarqube.yaml @@ -44,7 +44,7 @@ jobs: timeout-minutes: 20 steps: - name: Checkout repository - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # full history: SonarQube needs it for blame attribution and to # compute the new-code period @@ -56,7 +56,7 @@ jobs: # Pinned to a commit SHA, not a tag: this step receives SONAR_TOKEN, so # a retargeted or compromised release tag would hand credentials to # replacement action code. - uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1 + uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}