build(github-actions): 📦 major github-actions (major)

[renovate]

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

---

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
actions/checkout	action	major	v4 -> v5
actions/stale	action	major	v9 -> v10
amannn/action-semantic-pull-request	action	major	v5 -> v6
aquaproj/aqua-installer	action	major	v3.1.0 -> v4.0.3

---

Release Notes

actions/checkout (actions/checkout)

v5

Compare Source

actions/stale (actions/stale)

v10

Compare Source

amannn/action-semantic-pull-request (amannn/action-semantic-pull-request)

v6

Compare Source

aquaproj/aqua-installer (aquaproj/aqua-installer)

v4.0.3

Compare Source

🛡️ Starting from this release, Immutable Release is enabled!

SHA256 Checksum

d76bb5c3a23025e9d344aeba04c0a4d4ed6c9fb05e85530c8c3be2ef8e8f3a6a  aqua-installer

#​867 Update the bootstrap aqua version to v2.53.10

v4.0.2

Compare Source

SHA256 Checksum

98b883756cdd0a6807a8c7623404bfc3bc169275ad9064dc23a6e24ad398f43d  aqua-installer

Improvement

#​839 Use curl's --retry option: curl --retry 5

v4.0.1

Compare Source

SHA256 Checksum

42d5b4496020dc97856f5694cfb592ba80949d4918661fd062a5b0bb05d570ce  aqua-installer

Improvement

#​835 Update the bootstrap version of aqua to v2.53.3

As of aqua v2.53.0, aqua supported retrying download of assets.
This update enables aqua-installer to retry download of aqua.

v4.0.0

Compare Source

SHA256 Checksum

f7fa69dacb234ce9648f3008cef9120a1e59d96c37971e747668c0fada7bec68  aqua-installer

⚠️ Breaking Changes

#​822 If you pass a GitHub Access token via environment variable env, it would be overridden by the input github_token.

uses: aquaproj/aqua-installer@v2.0.0
env:
  GITHUB_TOKEN: ${{secrets.PAT}} # This is overridden by ${{github.token}}

How to migrate

Pass a GitHub access token by the input github_token.

uses: aquaproj/aqua-installer@v2.0.0
with:
  github_token: ${{secrets.PAT}}

Why is this breaking change required?

Recently, GitHub updated rate limits for unauthenticated requests.

https://github.blog/changelog/2025-05-08-updated-rate-limits-for-unauthenticated-requests/

As a result, aqua-installer often hits the API rate limit if a GitHub access token isn't passed via environment variable.

e.g. https://github.com/szksh-lab/.github/actions/runs/15082243052/job/42400373723

time="2025-05-17T05:48:24Z" level=error msg="install the registry" aqua_version=2.51.2 env=linux/amd64 error="get a file by Get GitHub Content API: status code 429" program=aqua registry_name=standard
time="2025-05-17T05:48:24Z" level=fatal msg="aqua failed" aqua_version=2.51.2 env=linux/amd64 error="it failed to install some registries" program=aqua

It failed to download the standard registry by GitHub content API.

To resolve the issue, we pass a GitHub actions token by default.
And we add the input github_token to allow you to change the access token.

Features

#​822 The input github_token is added.
You can pass a GitHub access token by input.
By default, GitHub Actions token ${{github.token}} is passed.

Others

#​823 chore: update the bootstrap version to v2.51.2

v3.1.2

Compare Source

SHA256 Checksum

9a5afb16da7191fbbc0c0240a67e79eecb0f765697ace74c70421377c99f0423  aqua-installer

Fixes

#​801 Update the bootstrap version of aqua to v2.48.1

aquaproj/aqua#3744

[!CAUTION]
To install aqua v2.48.2-0 or later, please aqua-installer v3.1.2 or later

v3.1.1

Compare Source

SHA256 Checksum

e9d4c99577c6b2ce0b62edf61f089e9b9891af1708e88c6592907d2de66e3714  aqua-installer

🐛 Bug Fixes

#​750 Fix a bug that aqua-installer doesn't work using Darwin's built-in sha256sum @​Takashi-kun

aqua-installer worked well using GNU sha256sum, but it didn't work using Darwin's built-in sha256sum.

$ ./aqua-installer
[INFO] Installing aqua v2.37.2 for bootstrapping...
[INFO] Downloading https://github.com/aquaproj/aqua/releases/download/v2.37.2/aqua_darwin_arm64.tar.gz ...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100 6716k  100 6716k    0     0  1227k      0  0:00:05  0:00:05 --:--:-- 1706k
[INFO] Verifying checksum of aqua v2.37.2 ...
usage: sha256sum [-bctwz] [files ...]
$ echo $?
1

---

Configuration

📅 Schedule: Branch creation - "after 10pm,before 3am" in timezone America/Chicago, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

This PR was generated by Mend Renovate. View the repository job log.

[snyk-io]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

✅ code/snyk check is complete. No issues have been found. (View Details)

[sheldonhull]

Mostly node updates. No breaking changes detected in my review with how these are used.