Skip to content

Update github-actions (maint) (major) - #11456

Open
renovate-bot wants to merge 1 commit into
erlang:maintfrom
renovate-bot:renovate/maint-major-github-actions
Open

Update github-actions (maint) (major)#11456
renovate-bot wants to merge 1 commit into
erlang:maintfrom
renovate-bot:renovate/maint-major-github-actions

Conversation

@renovate-bot

@renovate-bot renovate-bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
Vampire/setup-wsl action major v6.0.0v7.0.0
actions/attest-sbom action major v3v4
actions/cache action major v4v6
actions/cache action major v5.0.3v6.1.0
actions/checkout action major v6.0.2v7.0.1
actions/create-github-app-token action major v2.2.1v3.2.0
actions/github-script action major v8.0.0v9.0.0
docker/login-action action major v3.7.0v4.6.0
dorny/paths-filter action major v3.0.2v4.0.3
github/codeql-action action major v3.29.7v4.37.8
macos github-runner major 1526

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

Vampire/setup-wsl (Vampire/setup-wsl)

v7.0.0

Compare Source

Breaking Changes

  • Updated Node.js to 24 (#​83)
  • Changed default distributon to Debian-13
  • Changed Alpine-3.17 wslId to contain the version
  • Changed Ubuntu-20.04 wslId to contain the version
  • Changed Ubuntu-22.04 wslId to contain the version
  • Removed deprecated Debian distributon
  • Removed deprecated Alpine distributon

Details

  • Use Debian-11 instead of Debian in tests [953e6c3]
  • Increase version to 7.0.0 [efe0179]
  • Update Node.js to 24 (#​83) [04ef237]
  • Change default distributon to Debian-13 [b67c897]
  • Remove deprecated Debian [ab5ed27]
  • Remove deprecated Alpine [0dc99a1]
  • Change Alpine-3.17 wslId to contain the version [4e9c3b1]
  • Use wsl-file distribution for Ubuntu 20.04+ [9928f17]
  • Change Ubuntu-20.04 and Ubuntu-22.04 wslIds to contain the version [f9577ca]
  • Continue tests for specific wrapper script on installation failure [cf87199]

v6.1.0

Compare Source

Highlights

  • Alpine (3.17) support fixed (#​82)
  • Debian (11) support fixed (#​76)
  • Alpine 3.18 - 3.23 support added
  • Debian 12 - 13 support added

Deprecations

  • Using Alpine is deprecated, Alpine-3.17 is almost a drop-in replacement
  • Using Debian explicitly or as default is deprecated, Debian-11 is almost a drop-in replacement

Details

  • Fix verify-release workflow generation [6819906]
  • Disable testing on Alpine for the time being [1462529]
  • Fix apt update on Debian (#​76) [6eb7639]
  • Update snakeyaml to 2.6 [90a7832]
  • Update release Gradle plugin to 3.1.0 [44828e1]
  • Update versions Gradle plugin to 0.51.0 [168ff3d]
  • Update Wooga GitHub Gradle plugin to 4.0.0 [47d527f]
  • Update Grgit to 5.3.3 [6391a34]
  • Update Gradle to 8.14.4 [6f851d3]
  • Get version update notifications for refresh versions plugin [01972ad]
  • Update refreshVersions Gradle plugin to 0.60.6 [b00071d]
  • Update github-api to 1.330 [b38a1f9]
  • Update Dependency Analysis Gradle plugin to 3.1.0 [25def4e]
  • Update Gradle to 9.4.1 [0f597b6]
  • Allow newer wrapper versions in validateGradleWrapperJar [0e1d30d]
  • Update versions Gradle plugin to 0.53.0 [8632db7]
  • Update Dependency Analysis Gradle plugin to 3.6.1 [df43e2e]
  • Update kotlinx-serialization to 1.10.0 [0261a4f]
  • Update Kotlin for workflow preprocessing to 2.3.20 [685f117]
  • Increase daemon max heap [f103acb]
  • Update Kotlin to 2.3.20 [7bab382]
  • Remove obsolete ktor work-around [857582f]
  • Update ktor to 3.4.2 [b0a9492]
  • Remove obsolete IDE helper comments [14f968f]
  • Update github-workflows-kt to 3.7.0 [2a205c6]
  • Update actions/checkout to v6 [9e3e4a6]
  • Update gradle/actions to v6 [0507b3e]
  • Update actions/cache to v5 [f96ebd2]
  • Update actions/setup-java to v5 [e491558]
  • Update kotlin wrappers to 2026.4.5 [24fd3b7]
  • Increase version to 6.1.0 [648c2a1]
  • Deprecate Debian and add Debian-11 as almost drop-in replacement [9c2948a]
  • Replace dynamic Microsoft store download by wsl --import (#​82) [d5fc1c9]
  • Deprecate Alpine and add Alpine-3.17 as almost drop-in replacement [9d61a27]
  • Add support for Alpine 3.18 - 3.23 [d859bad]
  • Improve test conditions when overwriting wsl.conf file [818d233]
  • Add support for Debian 12 using wsl --install --from-file [a0d3bcd]
  • Add support for Debian 13 [e8092cd]
  • Add a readme that explains the workflow files handling [7d4bd70]
  • Update common-custom-user-data-gradle-plugin to 2.6.0 [ade4ee0]
  • Update kotlinx-serialization to 1.11.0 [02217b0]
actions/attest-sbom (actions/attest-sbom)

v4.1.0

Compare Source

[!WARNING]
As of version 4.0.0 this action is being deprecated in favor of actions/attest. actions/attest-sbom will continue to function as a wrapper on top of actions/attest for some period of time, but applications should make plans to migrate.

All of the existing action inputs are compatible with the actions/attest interface.

What's Changed

Full Changelog: actions/attest-sbom@v4.0.0...v4.1.0

v4.0.0

Compare Source

[!WARNING]
As of version 4.0.0 this action is being deprecated in favor of actions/attest. actions/attest-sbom will continue to function as a wrapper on top of actions/attest for some period of time, but applications should make plans to migrate.

All of the existing action inputs are compatible with the actions/attest interface.

What's Changed

Full Changelog: actions/attest-sbom@v3...v4.0.0

v4

Compare Source

actions/cache (actions/cache)

v6.1.0

Compare Source

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v6

Compare Source

v5.1.0

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

Compare Source

What's Changed
New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

Compare Source

What's Changed

Full Changelog: actions/cache@v5...v5.0.3

v5.0.2: v.5.0.2

Compare Source

v5.0.2
What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

Compare Source

[!IMPORTANT]
actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.


v5.0.1
What's Changed
v5.0.0
What's Changed

Full Changelog: actions/cache@v5...v5.0.1

v5.0.0

Compare Source

[!IMPORTANT]
actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.


What's Changed

Full Changelog: actions/cache@v4.3.0...v5.0.0

v5

Compare Source

actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

v7

Compare Source

v6.1.0

Compare Source

v6.0.3

Compare Source

actions/create-github-app-token (actions/create-github-app-token)

v3.2.0

Compare Source

Features
Bug Fixes

v3.1.1

Compare Source

Bug Fixes

v3.1.0

Compare Source

Bug Fixes
Features

v3.0.0

Compare Source

Bug Fixes
BREAKING CHANGES
  • Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
  • Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner.

v3

Compare Source

v2.2.2

Compare Source

Bug Fixes
actions/github-script (actions/github-script)

v9.0.0

Compare Source

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.
What's Changed
New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v9

Compare Source

docker/login-action (docker/login-action)

v4.6.0

Compare Source

v4.5.2

Compare Source

v4.5.1

Compare Source

v4.5.0

Compare Source

v4.4.0

Compare Source

v4.3.0

Compare Source

Full Changelog: docker/login-action@v4.2.0...v4.3.0

v4.2.0

Compare Source

Full Changelog: docker/login-action@v4.1.0...v4.2.0

v4.1.0

Compare Source

Full Changelog: docker/login-action@v4.0.0...v4.1.0

v4.0.0

Compare Source

Full Changelog: docker/login-action@v3.7.0...v4.0.0

v4

Compare Source

dorny/paths-filter (dorny/paths-filter)

v4.0.3

Compare Source

v4.0.2

Compare Source

v4.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: dorny/paths-filter@v4.0.0...v4.0.1

v4.0.0

Compare Source

v4

Compare Source

v3.0.4

Compare Source

v3.0.3

Compare Source

github/codeql-action (github/codeql-action)

v4.37.8

Compare Source

v4.37.7

Compare Source

v4.37.6

Compare Source

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

Compare Source

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #​4061

v4.37.4

Compare Source

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v4.37.1

Compare Source

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
  • Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

  • Update default CodeQL bundle version to 2.26.0. #​3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

v4.36.3

Compare Source

No user facing changes.

v4.36.2

Compare Source

  • Cache CodeQL CLI version information across Actions steps. #​3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #​3937
  • Update default CodeQL bundle version to 2.25.6. #​3948

v4.36.1

Compare Source

No user facing changes.

v4.36.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #​3894
  • Add support for SHA-256 Git object IDs. #​3893
  • Update default CodeQL bundle version to 2.25.5. #​3926

v4.35.5

Compare Source

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #​3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #​3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #​3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #​3880

v4.35.4

Compare Source

v4.35.3

[Compare Source](https://redirect.gi

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "after 2am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate forking-renovate Bot added the team:VM Assigned to OTP team VM label Aug 10, 2026
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@renovate-bot renovate-bot changed the title Update github-actions (maint) (major) chore(deps): update github-actions (maint) (major) Aug 11, 2026
@renovate-bot
renovate-bot force-pushed the renovate/maint-major-github-actions branch from bb95473 to 93b8106 Compare August 11, 2026 14:48
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

CT Test Results

  1 files   11 suites   6m 31s ⏱️
 96 tests  92 ✅ 4 💤 0 ❌
112 runs  108 ✅ 4 💤 0 ❌

Results for commit b6663e8.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

@kikofernandez
kikofernandez self-requested a review August 12, 2026 10:35
kikofernandez
kikofernandez previously approved these changes Aug 12, 2026
@renovate-bot
renovate-bot force-pushed the renovate/maint-major-github-actions branch from 93b8106 to cdf61c7 Compare August 14, 2026 20:38
@renovate-bot renovate-bot changed the title chore(deps): update github-actions (maint) (major) Update github-actions (maint) (major) Aug 17, 2026
@renovate-bot
renovate-bot force-pushed the renovate/maint-major-github-actions branch from cdf61c7 to b6663e8 Compare August 21, 2026 13:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

team:VM Assigned to OTP team VM

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants