Skip to content

chore(deps): update github actions major (major)#179

Merged
gjtorikian merged 1 commit into
mainfrom
renovate/major-github-actions-major
Jun 25, 2026
Merged

chore(deps): update github actions major (major)#179
gjtorikian merged 1 commit into
mainfrom
renovate/major-github-actions-major

Conversation

@renovate

@renovate renovate Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/checkout action major v4 → 7.0.0
actions/setup-node action major v4 → 6.4.0
googleapis/release-please-action action major v4 → 5.0.0
pnpm/action-setup action major v4 → 6.0.9

Release Notes

actions/checkout (actions/checkout)

v7.0.0

Compare Source

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

actions/setup-node (actions/setup-node)

v6.4.0

Compare Source

What's Changed
Dependency updates:
New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

Compare Source

What's Changed
Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:
Bug fixes:
New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

What's Changed
Documentation
Dependency updates:
New Contributors

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

Compare Source

What's Changed
Enhancement:
Dependency updates:
Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Breaking Changes

Dependency Upgrades

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

Compare Source

What's Changed
Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades
New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

googleapis/release-please-action (googleapis/release-please-action)

v5.0.0

Compare Source

⚠ BREAKING CHANGES
Features
Bug Fixes
pnpm/action-setup (pnpm/action-setup)

v6.0.9

Compare Source

What's Changed

Full Changelog: pnpm/action-setup@v6...v6.0.9

v6.0.8

Compare Source

What's Changed
New Contributors

Full Changelog: pnpm/action-setup@v6.0.7...v6.0.8

v6.0.7

Compare Source

What's Changed
New Contributors

Full Changelog: pnpm/action-setup@v6.0.6...v6.0.7

v6.0.6

Compare Source

What's Changed
  • fix: bin_dest output points to self-updated pnpm, not bootstrap by @​zkochan in #​249

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

v6.0.5

Compare Source

What's Changed
  • fix: append (not prepend) action node dir to PATH for npm bootstrap by @​zkochan in #​241

Full Changelog: pnpm/action-setup@v6.0.4...v6.0.5

v6.0.4

Compare Source

What's Changed
New Contributors

Full Changelog: pnpm/action-setup@v6.0.3...v6.0.4

v6.0.3

Compare Source

Updated pnpm to v11.0.0-rc.5

Full Changelog: pnpm/action-setup@v6.0.2...v6.0.3

v6.0.2

Compare Source

What's Changed
New Contributors

Full Changelog: pnpm/action-setup@v6.0.1...v6.0.2

v6.0.1

Compare Source

Update pnpm to v11.0.0-rc.2. pnpm-lock.yaml will not be saved with two documents unless the packageManager is set via devEngines.packageManager. Related issue: #​228

v6.0.0

Compare Source

Added support for pnpm v11.

v5.0.0

Compare Source

Updated the action to use Node.js 24.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "on the 15th day of the month before 12pm"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@greptile-apps

greptile-apps Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Greptile Summary

This PR updates four GitHub Actions to new major versions across all workflow files, with all actions pinned to full commit SHAs for supply-chain security.

  • actions/checkout: pinned SHA resolves to 7.0.0, though the PR description table lists the target as 6.0.3 (with 7.0.0 shown as "Pending") — reviewers should be aware they are actually adopting 7.0.0.
  • actions/setup-node (v4→6.4.0) and pnpm/action-setup (v4→6.0.9): both skip intermediate major versions; the explicit cache: pnpm configuration in CI and release workflows is unaffected by the setup-node v6 breaking change, which only limits automatic (packageManager-field) caching to npm.
  • googleapis/release-please-action (v4→5.0.0): straightforward upgrade, SHA and version comment are consistent.

Confidence Score: 4/5

Safe to merge once reviewers confirm they intend to adopt actions/checkout 7.0.0 rather than 6.0.3

All changes are GitHub Actions version bumps pinned to full SHA hashes. The only concern is that Renovate's PR description states the actions/checkout target is 6.0.3, but the pinned SHA resolves to 7.0.0 — meaning the team may be inadvertently adopting a version they haven't evaluated. The rest of the upgrades (setup-node 6.4.0, pnpm/action-setup 6.0.9, release-please-action 5.0.0) have consistent SHA/version comments and no functional regressions expected.

ci.yml, release.yml, and socket-tier1-analysis.yml — the actions/checkout SHA in all three resolves to 7.0.0, one major version ahead of what the PR description advertises

Important Files Changed

Filename Overview
.github/workflows/ci.yml Bumps actions/checkout (v4→7.0.0), pnpm/action-setup (v4→6.0.9), and actions/setup-node (v4→6.4.0); the checkout SHA resolves to 7.0.0 while the PR description claims 6.0.3
.github/workflows/release-please.yml Bumps googleapis/release-please-action from v4 to 5.0.0; version and SHA comment match the PR description
.github/workflows/release.yml Same action version bumps as ci.yml; same actions/checkout 7.0.0 vs 6.0.3 discrepancy applies
.github/workflows/socket-tier1-analysis.yml Bumps actions/checkout only; same 7.0.0 SHA discrepancy vs the 6.0.3 target in the PR description

Flowchart

 
%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push / PR event] --> B[ci.yml]
    B --> C[checkout v7.0.0]
    C --> D[pnpm-setup v6.0.9]
    D --> E[setup-node v6.4.0 with pnpm cache]
    E --> F[install, lint, format, typecheck, build, test]

    G[release-please.yml] --> H[release-please-action v5.0.0]
    H --> I{release created?}
    I -- yes --> J[release.yml]
    J --> K[checkout v7.0.0]
    K --> L[pnpm-setup v6.0.9]
    L --> M[setup-node v6.4.0 with pnpm cache]
    M --> N[build and publish to npm]

    O[socket-tier1-analysis.yml] --> P[checkout v7.0.0]
    P --> Q[Socket CLI tier-1 scan]
Loading 
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Push / PR event] --> B[ci.yml]
    B --> C[checkout v7.0.0]
    C --> D[pnpm-setup v6.0.9]
    D --> E[setup-node v6.4.0 with pnpm cache]
    E --> F[install, lint, format, typecheck, build, test]

    G[release-please.yml] --> H[release-please-action v5.0.0]
    H --> I{release created?}
    I -- yes --> J[release.yml]
    J --> K[checkout v7.0.0]
    K --> L[pnpm-setup v6.0.9]
    L --> M[setup-node v6.4.0 with pnpm cache]
    M --> N[build and publish to npm]

    O[socket-tier1-analysis.yml] --> P[checkout v7.0.0]
    P --> Q[Socket CLI tier-1 scan]
Loading
Prompt To Fix All With AI 
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
.github/workflows/ci.yml:16
**`actions/checkout` pinned to `7.0.0`, not `6.0.3` as described**

The PR description's table lists the target version for `actions/checkout` as `6.0.3` (with `7.0.0` as "Pending"), but the SHA `9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` corresponds to `7.0.0` per the inline comment. Renovate appears to have updated the pinned SHA after generating the PR description. The same discrepancy exists in `release.yml` and `socket-tier1-analysis.yml`. This means merging this PR will actually adopt `actions/checkout@7.0.0`, not `6.0.3` — reviewers should evaluate the `7.0.0` changelog (not just `6.0.3`) before approving.

Reviews (3): Last reviewed commit: "chore(deps): update github actions major" | Re-trigger Greptile

@renovate renovate Bot force-pushed the renovate/major-github-actions-major branch from b6176a4 to 90d73b7 Compare June 22, 2026 13:59
@renovate renovate Bot force-pushed the renovate/major-github-actions-major branch from 90d73b7 to c922e20 Compare June 25, 2026 15:50
greptile-apps[bot]
greptile-apps Bot reviewed Jun 25, 2026
View reviewed changes
Comment thread .github/workflows/ci.yml
node: [20, 22, 24]
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0

@greptile-apps greptile-apps Bot Jun 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 actions/checkout pinned to 7.0.0, not 6.0.3 as described

The PR description's table lists the target version for actions/checkout as 6.0.3 (with 7.0.0 as "Pending"), but the SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 corresponds to 7.0.0 per the inline comment. Renovate appears to have updated the pinned SHA after generating the PR description. The same discrepancy exists in release.yml and socket-tier1-analysis.yml. This means merging this PR will actually adopt actions/checkout@7.0.0, not 6.0.3 — reviewers should evaluate the 7.0.0 changelog (not just 6.0.3) before approving.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 16

Comment:
**`actions/checkout` pinned to `7.0.0`, not `6.0.3` as described**

The PR description's table lists the target version for `actions/checkout` as `6.0.3` (with `7.0.0` as "Pending"), but the SHA `9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` corresponds to `7.0.0` per the inline comment. Renovate appears to have updated the pinned SHA after generating the PR description. The same discrepancy exists in `release.yml` and `socket-tier1-analysis.yml`. This means merging this PR will actually adopt `actions/checkout@7.0.0`, not `6.0.3` — reviewers should evaluate the `7.0.0` changelog (not just `6.0.3`) before approving.

How can I resolve this? If you propose a fix, please make it concise.

@gjtorikian gjtorikian merged commit 530242e into main Jun 25, 2026
8 checks passed
@gjtorikian gjtorikian deleted the renovate/major-github-actions-major branch June 25, 2026 17:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments

Assignees

No one assigned

Labels

renovate/major

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gjtorikian