Skip to content

chore(deps): update github actions major (major)#179

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions-major
Open

chore(deps): update github actions major (major)#179
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions-major

Conversation

@renovate

@renovate renovate Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
actions/checkout action major v4 → 6.0.3 7.0.0
actions/setup-node action major v4 → 6.4.0
googleapis/release-please-action action major v4 → 5.0.0
pnpm/action-setup action major v4 → 6.0.9

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

actions/setup-node (actions/setup-node)

v6.4.0

Compare Source

What's Changed
Dependency updates:
New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

Compare Source

What's Changed
Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:
Bug fixes:
New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

What's Changed
Documentation
Dependency updates:
New Contributors

Full Changelog: actions/setup-node@v6...v6.2.0

v6.1.0

Compare Source

What's Changed
Enhancement:
Dependency updates:
Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Breaking Changes

Dependency Upgrades

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

Compare Source

What's Changed
Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades
New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

googleapis/release-please-action (googleapis/release-please-action)

v5.0.0

Compare Source

⚠ BREAKING CHANGES
Features
Bug Fixes
pnpm/action-setup (pnpm/action-setup)

v6.0.9

Compare Source

What's Changed

Full Changelog: pnpm/action-setup@v6...v6.0.9

v6.0.8

Compare Source

What's Changed
New Contributors

Full Changelog: pnpm/action-setup@v6.0.7...v6.0.8

v6.0.7

Compare Source

What's Changed
New Contributors

Full Changelog: pnpm/action-setup@v6.0.6...v6.0.7

v6.0.6

Compare Source

What's Changed
  • fix: bin_dest output points to self-updated pnpm, not bootstrap by @​zkochan in #​249

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

v6.0.5

Compare Source

What's Changed
  • fix: append (not prepend) action node dir to PATH for npm bootstrap by @​zkochan in #​241

Full Changelog: pnpm/action-setup@v6.0.4...v6.0.5

v6.0.4

Compare Source

What's Changed
New Contributors

Full Changelog: pnpm/action-setup@v6.0.3...v6.0.4

v6.0.3

Compare Source

Updated pnpm to v11.0.0-rc.5

Full Changelog: pnpm/action-setup@v6.0.2...v6.0.3

v6.0.2

Compare Source

What's Changed
New Contributors

Full Changelog: pnpm/action-setup@v6.0.1...v6.0.2

v6.0.1

Compare Source

Update pnpm to v11.0.0-rc.2. pnpm-lock.yaml will not be saved with two documents unless the packageManager is set via devEngines.packageManager. Related issue: #​228

v6.0.0

Compare Source

Added support for pnpm v11.

v5.0.0

Compare Source

Updated the action to use Node.js 24.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "on the 15th day of the month before 12pm"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@greptile-apps

greptile-apps Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Greptile Summary

This PR updates four GitHub Actions dependencies to new major versions across all CI/CD workflow files. All actions remain SHA-pinned with version comments, maintaining the existing security posture.

  • actions/checkout is bumped from v4 to 6.0.3 across all four workflows; v6 migrates credential persistence to a separate file and adds Node 24 support.
  • pnpm/action-setup is bumped from v4 to 6.0.9 (the actual pinned SHA is 6.0.9, one patch ahead of the 6.0.8 described in the PR table); v6 adds pnpm v11 support by default.
  • actions/setup-node is bumped from v4 to 6.4.0 in ci.yml and release.yml; the v6.0.0 breaking change ("Limit automatic caching to npm") applies only to automatic package-manager detection — the explicit cache: pnpm used in both files continues to work.
  • googleapis/release-please-action is bumped from v4 to 5.0.0 in release-please.yml; the only breaking change is an upgrade to Node 24 at runtime.

Confidence Score: 5/5

Safe to merge — all four workflow files receive routine action version bumps with no logic changes and no removed functionality.

All changes are automated version bumps to well-maintained official actions. Every action remains SHA-pinned. The cache: pnpm input in setup-node is unaffected by the v6 breaking change (which only restricts automatic cache detection, not explicit cache configuration). No workflow logic, permissions, secrets usage, or step ordering was modified.

No files require special attention.

Important Files Changed

Filename Overview
.github/workflows/ci.yml Bumps actions/checkout, pnpm/action-setup, and actions/setup-node to new major versions; all pinned to specific SHAs with version comments.
.github/workflows/release-please.yml Bumps googleapis/release-please-action from v4 to 5.0.0, pinned to a new SHA.
.github/workflows/release.yml Bumps the same three actions (checkout, pnpm/action-setup, setup-node) to the same new major versions as ci.yml.
.github/workflows/socket-tier1-analysis.yml Bumps actions/checkout from v4 to 6.0.3, SHA-pinned; only the checkout step is changed.

Flowchart

 
%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push or PR event] --> B[ci.yml]
    B --> C[checkout 6.0.3]
    C --> D[pnpm-setup 6.0.9]
    D --> E[setup-node 6.4.0 with pnpm cache]
    E --> F[install / lint / build / test]

    G[Release PR merged] --> H[release-please.yml]
    H --> I[release-please-action 5.0.0]
    I -->|release_created=true| J[release.yml]
    J --> K[checkout 6.0.3]
    K --> L[pnpm-setup 6.0.9]
    L --> M[setup-node 6.4.0 with pnpm cache]
    M --> N[pnpm publish to npm]

    O[Socket scan dispatch] --> P[socket-tier1-analysis.yml]
    P --> Q[checkout 6.0.3]
    Q --> R[Socket CLI scan]
Loading 
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Push or PR event] --> B[ci.yml]
    B --> C[checkout 6.0.3]
    C --> D[pnpm-setup 6.0.9]
    D --> E[setup-node 6.4.0 with pnpm cache]
    E --> F[install / lint / build / test]

    G[Release PR merged] --> H[release-please.yml]
    H --> I[release-please-action 5.0.0]
    I -->|release_created=true| J[release.yml]
    J --> K[checkout 6.0.3]
    K --> L[pnpm-setup 6.0.9]
    L --> M[setup-node 6.4.0 with pnpm cache]
    M --> N[pnpm publish to npm]

    O[Socket scan dispatch] --> P[socket-tier1-analysis.yml]
    P --> Q[checkout 6.0.3]
    Q --> R[Socket CLI scan]
Loading

Reviews (2): Last reviewed commit: "chore(deps): update github actions major" | Re-trigger Greptile

@renovate renovate Bot force-pushed the renovate/major-github-actions-major branch from b6176a4 to 90d73b7 Compare June 22, 2026 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate/major

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants