chore(deps): update github actions by bootc-bot[bot] · Pull Request #294 · bootc-dev/bcvk

bootc-bot · 2026-07-05T01:07:18Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v4` → `v7`
actions/create-github-app-token	action	major	`v2` → `v3`
actions/deploy-pages	action	major	`v4` → `v5`
actions/download-artifact	action	major	`v4` → `v8`
actions/upload-artifact	action	major	`v4` → `v7`
actions/upload-pages-artifact	action	major	`v3` → `v5`
crazy-max/ghaction-import-gpg	action	major	`v6` → `v7`
peter-evans/create-pull-request	action	major	`v7` → `v8`

Release Notes

actions/checkout (actions/checkout)

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

`v6.0.1`

Compare Source

Add worktree support for persist-credentials includeIf by @ericsciple in #2327

`v6.0.0`

Compare Source

Persist creds to a separate file by @ericsciple in #2286
Update README to include Node.js 24 support details and requirements by @salmanmkc in #2248

`v6`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v5.0.1`

Compare Source

Port v6 cleanup to v5 by @ericsciple in #2301

`v5.0.0`

Compare Source

Update actions checkout to use node 24 by @salmanmkc in #2226

`v5`

Compare Source

Port v6 cleanup to v5 by @ericsciple in #2301

actions/create-github-app-token (actions/create-github-app-token)

`v3.2.0`

Compare Source

Features

add support for enterprise-level GitHub Apps (#263) (952a2a7)
support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

deps: bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
validate private-key input (#376) (f24bbd8)

`v3.1.1`

Compare Source

Bug Fixes

improve error message when app identifier is empty (#362) (07e2b76), closes #249

`v3.1.0`

Compare Source

Bug Fixes

deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

add client-id input and deprecate app-id (#353) (e6bd4e6)
update permission inputs (#358) (076e948)

`v3.0.0`

Compare Source

feat!: node 24 support (#275) (2e564a0)
fix!: require NODE_USE_ENV_PROXY for proxy support (#342) (4451bcb)

Bug Fixes

remove custom proxy handling (#143) (dce0ab0)

BREAKING CHANGES

Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner.

`v3`

Compare Source

actions/deploy-pages (actions/deploy-pages)

`v5.0.0`

Compare Source

Changelog

Update Node.js version to 24.x @salmanmkc (#404)
Add workflow file for publishing releases to immutable action package @Jcambass (#374)
Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group across 1 directory @dependabot (#360)
Make the rebuild dist workflow work nicer with Dependabot @yoannchaudet (#361)
Bump the non-breaking-changes group across 1 directory with 3 updates @dependabot (#358)
Delete repeated sentence @garethsb (#359)
Update README.md @tsusdere (#348)
Bump the non-breaking-changes group with 4 updates @dependabot (#341)
Remove error message for file permissions @TooManyBees (#340)

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

`v5`

Compare Source

actions/download-artifact (actions/download-artifact)

`v8.0.1`

Compare Source

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in #471
Add a regression test for artifact name + content-type mismatches by @danwkennedy in #472

Full Changelog: actions/download-artifact@v8...v8.0.1

`v8.0.0`

Compare Source

v8 - What's new

[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in #460
Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in #461

Full Changelog: actions/download-artifact@v7...v8.0.0

`v8`

Compare Source

`v7.0.0`

Compare Source

v7 - What's new

[!IMPORTANT]
actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in #440
Download Artifact Node24 support by @salmanmkc in #415
fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in #451
prepare release v7.0.0 for Node.js 24 support by @salmanmkc in #452

New Contributors

@patrikpolyak made their first contribution in #440
@salmanmkc made their first contribution in #415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

`v7`

Compare Source

`v6.0.0`

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

Update README for download-artifact v5 changes by @yacaovsnc in #417
Update README with artifact extraction details by @yacaovsnc in #424
Readme: spell out the first use of GHES by @danwkennedy in #431
Bump @actions/artifact to v4.0.0
Prepare v6.0.0 by @danwkennedy in #438

New Contributors

@danwkennedy made their first contribution in #431

Full Changelog: actions/download-artifact@v5...v6.0.0

`v6`

Compare Source

`v5.0.0`

Compare Source

What's Changed

Update README.md by @nebuk89 in #407
BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @GrantBirki in #416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

By name: name: my-artifact → extracted to path/ (direct)
By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

By name: name: my-artifact → extracted to path/ (unchanged)
By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:

You download artifacts by name
You download multiple artifacts by ID
You already use merge-multiple: true as a workaround

⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist

# Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

- uses: actions/download-artifact@v5
  with:
    artifact-ids: 12345
    path: dist/my-artifact  # Explicitly specify the nested path

New Contributors

@nebuk89 made their first contribution in #407

Full Changelog: actions/download-artifact@v4...v5.0.0

`v5`

Compare Source

actions/upload-artifact (actions/upload-artifact)

`v7.0.1`

Compare Source

What's Changed

Update the readme with direct upload details by @danwkennedy in #795
Readme: bump all the example versions to v7 by @danwkennedy in #796
Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in #797

Full Changelog: actions/upload-artifact@v7...v7.0.1

`v7.0.0`

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in #754
Upgrade the module to ESM and bump dependencies by @danwkennedy in #762
Support direct file uploads by @danwkennedy in #764

New Contributors

@Link- made their first contribution in #754

Full Changelog: actions/upload-artifact@v6...v7.0.0

`v7`

Compare Source

`v6.0.0`

Compare Source

v6 - What's new

[!IMPORTANT]
actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in #719
fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in #744
prepare release v6.0.0 for Node.js 24 support by @salmanmkc in #745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

`v6`

Compare Source

`v5.0.0`

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

Update README.md by @GhadimiR in #681
Update README.md by @nebuk89 in #712
Readme: spell out the first use of GHES by @danwkennedy in #727
Update GHES guidance to include reference to Node 20 version by @patrikpolyak in #725
Bump @actions/artifact to v4.0.0
Prepare v5.0.0 by @danwkennedy in #734

New Contributors

@GhadimiR made their first contribution in #681
@nebuk89 made their first contribution in #712
@danwkennedy made their first contribution in #727
@patrikpolyak made their first contribution in #725

Full Changelog: actions/upload-artifact@v4...v5.0.0

`v5`

Compare Source

actions/upload-pages-artifact (actions/upload-pages-artifact)

`v5.0.0`

Compare Source

Changelog

Update upload-artifact action to version 7 @Tom-van-Woudenberg (#139)
feat: add include-hidden-files input @jonchurch (#137)

See details of all code changes since previous release.

`v5`

Compare Source

`v4.0.0`

Compare Source

What's Changed

Potentially breaking change: hidden files (specifically dotfiles) will not be included in the artifact by @tsusdere in #102
If you need to include dotfiles in your artifact: instead of using this action, create your own artifact according to these requirements https://github.com/actions/upload-pages-artifact?tab=readme-ov-file#artifact-validation
Pin actions/upload-artifact to SHA by @heavymachinery in #127

Full Changelog: actions/upload-pages-artifact@v3.0.1...v4.0.0

`v4`

Compare Source

crazy-max/ghaction-import-gpg (crazy-max/ghaction-import-gpg)

`v7.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #241
Switch to ESM and update config/test wiring by @crazy-max in #239
Bump @actions/core from 1.11.1 to 3.0.0 in #232
Bump @actions/exec from 1.1.1 to 3.0.0 in #242
Bump brace-expansion from 1.1.11 to 1.1.12 in #221
Bump minimatch from 3.1.2 to 3.1.5 in #240
Bump openpgp from 6.1.0 to 6.3.0 in #233

Full Changelog: crazy-max/ghaction-import-gpg@v6.3.0...v7.0.0

`v7`

Compare Source

peter-evans/create-pull-request (peter-evans/create-pull-request)

`v8.1.1`: Create Pull Request v8.1.1

Compare Source

What's Changed

build(deps-dev): bump the npm group with 2 updates by @dependabot[bot] in #4305
build(deps): bump minimatch by @dependabot[bot] in #4311
build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #4316
build(deps): bump @tootallnate/once and jest-environment-jsdom by @dependabot[bot] in #4323
build(deps-dev): bump undici from 6.23.0 to 6.24.0 by @dependabot[bot] in #4328
build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #4334
build(deps): bump picomatch by @dependabot[bot] in #4339
build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in #4344
build(deps-dev): bump the npm group with 3 updates by @dependabot[bot] in #4349
fix: retry post-creation API calls on 422 eventual consistency errors by @peter-evans in #4356

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

`v8.1.0`: Create Pull Request v8.1.0

Compare Source

What's Changed

README.md: bump given GitHub actions to their latest versions by @deining in #4265
build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #4273
build(deps-dev): bump the npm group with 2 updates by @dependabot[bot] in #4274
build(deps-dev): bump undici from 6.22.0 to 6.23.0 by @dependabot[bot] in #4284
Update distribution by @actions-bot in #4289
fix: Handle remote prune failures gracefully on self-hosted runners by @peter-evans in #4295
feat: add @octokit/plugin-retry to handle retriable server errors by @peter-evans in #4298

New Contributors

@deining made their first contribution in #4265

Full Changelog: peter-evans/create-pull-request@v8.0.0...v8.1.0

`v8.0.0`: Create Pull Request v8.0.0

Compare Source

What's new in v8

Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner for Node 24 support.

What's Changed

chore: Update checkout action version to v6 by @yonas in #4258
Update actions/checkout references to @v6 in docs by @Copilot in #4259
feat: v8 by @peter-evans in #4260

New Contributors

@yonas made their first contribution in #4258
@Copilot made their first contribution in #4259

Full Changelog: peter-evans/create-pull-request@v7.0.11...v8.0.0

`v8`

Compare Source

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- "on sunday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>

chore(deps): update github actions

6c41ef7

Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>

gursewak1997 enabled auto-merge (squash) July 6, 2026 14:38

gursewak1997 approved these changes Jul 6, 2026

View reviewed changes

gursewak1997 merged commit 4df73be into main Jul 6, 2026
19 checks passed

bootc-bot Bot deleted the bootc-renovate/github-actions branch July 6, 2026 15:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update github actions#294

chore(deps): update github actions#294
gursewak1997 merged 1 commit into
mainfrom
bootc-renovate/github-actions

bootc-bot Bot commented Jul 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

bootc-bot Bot commented Jul 5, 2026

Release Notes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

BREAKING CHANGES

Changelog

What's Changed

v8 - What's new

Direct downloads

Enforced checks (breaking)

ESM

What's Changed

v7 - What's new

Node.js 24

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

v5.0.0

🚨 Breaking Change

What Changed

Migration Guide

✅ No Action Needed If:

⚠️ Action Required If:

New Contributors

What's Changed

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v6 - What's new

Node.js 24

What's Changed

What's Changed

New Contributors

Changelog

What's Changed

v8.1.1: Create Pull Request v8.1.1

What's Changed

v8.1.0: Create Pull Request v8.1.0

What's Changed

New Contributors

v8.0.0: Create Pull Request v8.0.0

What's new in v8

What's Changed

New Contributors

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v8.1.1`: Create Pull Request v8.1.1

`v8.1.0`: Create Pull Request v8.1.0

`v8.0.0`: Create Pull Request v8.0.0