build(deps): bump the github-actions group across 1 directory with 7 updates by dependabot[bot] · Pull Request #120 · ROCm/rocm-cli

dependabot · 2026-07-15T20:48:57Z

Bumps the github-actions group with 7 updates in the / directory:

Package	From	To
actions/checkout	`6.0.3`	`7.0.1`
dorny/paths-filter	`3.0.3`	`4.0.2`
taiki-e/install-action	`2.82.6`	`2.84.0`
j178/prek-action	`dec4adcd2fa1db9d50a39668b22112a37235e730`	`5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16`
actions/cache	`5.1.0`	`6.1.0`
actions/upload-artifact	`4.6.2`	`7.0.1`
actions/download-artifact	`4.3.0`	`8.0.1`

Updates actions/checkout from 6.0.3 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in actions/checkout#2500

backport fixes to releases-v6 by @aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates dorny/paths-filter from 3.0.3 to 4.0.2

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.2

What's Changed

fix warning message by @cgundy in dorny/paths-filter#282

chore: fix GitHub spelling in logs by @squat in dorny/paths-filter#278

fix: use rev-parse instead of branch --show-current for older git compat by @saschabratton in dorny/paths-filter#303

fix: work around git dubious ownership errors in container jobs by @saschabratton in dorny/paths-filter#317

docs: update changelog for v4.0.2 by @saschabratton in dorny/paths-filter#318

New Contributors

@cgundy made their first contribution in dorny/paths-filter#282

@squat made their first contribution in dorny/paths-filter#278

Full Changelog: dorny/paths-filter@v4.0.1...v4.0.2

v4.0.1

What's Changed

Support merge queue by @masaru-iritani in dorny/paths-filter#255

New Contributors

@masaru-iritani made their first contribution in dorny/paths-filter#255

Full Changelog: dorny/paths-filter@v4.0.0...v4.0.1

v4.0.0

What's Changed

feat: update action runtime to node24 by @saschabratton in dorny/paths-filter#294

New Contributors

@saschabratton made their first contribution in dorny/paths-filter#294

Full Changelog: dorny/paths-filter@v3.0.3...v4.0.0

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.2

Work around git dubious ownership errors in container jobs

Use rev-parse instead of branch --show-current for older git compat

Fix warning message

v4.0.1

Support merge queue

v4.0.0

Update action runtime to node24

v3.0.3

Add missing predicate-quantifier

v3.0.2

Add config parameter for predicate quantifier

v3.0.1

Compare base and ref when token is empty

v3.0.0

Update to Node.js 20

Update all dependencies

v2.11.1

Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output

Document need for pull-requests: read permission

Updating to actions/checkout@v3

v2.11.0

Set list-files input parameter as not required

Update Node.js

Fix incorrect handling of Unicode characters in exec()

Use Octokit pagination

Updates real world links

v2.10.2

Fix getLocalRef() returns wrong ref

v2.10.1

Improve robustness of change detection

v2.10.0

Add ref input parameter

Fix change detection in PR when pullRequest.changed_files is incorrect

v2.9.3

Fix change detection when base is a tag

... (truncated)

Commits

7b450ff docs: update changelog for v4.0.2 (#318)
9280377 fix: work around git dubious ownership errors in container jobs (#317)
f3ceefd fix: use rev-parse instead of branch --show-current for older git compat (#303)
61f87a1 chore: fix GitHub spelling in logs (#278)
b82ff81 fix warning message (#282)
fbd0ab8 feat: add merge_group event support
efb1da7 feat: add dist/ freshness check to PR workflow
d8f7b06 Merge pull request #302 from dorny/issue-299
addbc14 Update README for v4
9d7afb8 Update CHANGELOG for v4.0.0
Additional commits viewable in compare view

Updates taiki-e/install-action from 2.82.6 to 2.84.0

Release notes

Sourced from taiki-e/install-action's releases.

2.84.0

Support d2. (#1944)

Support protoc-gen-connect-openapi. (#1922, thanks @JasterV)

Update convco@latest to 0.7.0. (#1941, thanks @graelo)

Update just@latest to 1.57.0.

Update cargo-semver-checks@latest to 0.49.0.

Update tombi@latest to 1.2.4.

Update cosign@latest to 3.1.2.

2.83.4

Update vacuum@latest to 0.29.10.

Update uv@latest to 0.11.29.

Update syft@latest to 1.48.0.

Update prek@latest to 0.4.10.

Update mise@latest to 2026.7.7.

Update cargo-shear@latest to 1.13.2.

2.83.3

Update release-plz@latest to 0.3.160.

Update prek@latest to 0.4.9.

Update mise@latest to 2026.7.6.

Update dprint@latest to 0.55.2.

Update cargo-dinghy@latest to 0.8.5.

Update cargo-binstall@latest to 1.21.0.

Update biome@latest to 2.5.4.

2.83.2

Update parse-dockerfile@latest to 0.1.8.

Update mise@latest to 2026.7.5.

Update just@latest to 1.56.0.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.84.0] - 2026-07-20

Support d2. (#1944)

Support protoc-gen-connect-openapi. (#1922, thanks @JasterV)

Update convco@latest to 0.7.0. (#1941, thanks @graelo)

Update just@latest to 1.57.0.

Update cargo-semver-checks@latest to 0.49.0.

Update tombi@latest to 1.2.4.

Update cosign@latest to 3.1.2.

[2.83.4] - 2026-07-17

Update vacuum@latest to 0.29.10.

Update uv@latest to 0.11.29.

Update syft@latest to 1.48.0.

Update prek@latest to 0.4.10.

Update mise@latest to 2026.7.7.

Update cargo-shear@latest to 1.13.2.

[2.83.3] - 2026-07-16

Update release-plz@latest to 0.3.160.

Update prek@latest to 0.4.9.

Update mise@latest to 2026.7.6.

... (truncated)

Commits

a6b2e2d Release 2.84.0
fbdd9c5 Update cargo-neat manifest
424c5f9 Update changelog
a1fa02c Support protoc-gen-connect-openapi (#1922)
9e22773 Update DEVELOPMENT.md
8d5009f Support d2
5193316 Update tombi@latest to 1.2.4
4c740c7 Update tombi@latest to 1.2.3
de240ff Update just@latest to 1.57.0
dfca854 Update cargo-semver-checks@latest to 0.49.0
Additional commits viewable in compare view

Updates j178/prek-action from dec4adcd2fa1db9d50a39668b22112a37235e730 to 5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16

Commits

5337cb9 Disable color in prek cache dir output (#168)
6368183 Update known versions for prek 0.4.10 (#167)
c4fa771 Update pre-commit hook biomejs/pre-commit to v2.5.1 (#164)
99728f0 Update zizmorcore/zizmor-action action to v0.5.7 (#165)
55aa53f Update actions/checkout action to v7 (#166)
e191cc3 Update dependency semver to v7.8.5 (#147)
6017a0f Update dependency @actions/cache to v6.1.0 (#148)
5b6c2d6 Update npm dev dependencies (#151)
6757ec2 Update known versions for prek 0.4.9 (#163)
1cd265e Update known versions for prek 0.4.8 (#162)
Additional commits viewable in compare view

Updates actions/cache from 5.1.0 to 6.1.0

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

Bump @actions/cache to v6.1.0 - handle read-only cache access by @jasongin in actions/cache#1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Update packages, migrate to ESM by @Samirat in actions/cache#1760

Full Changelog: actions/cache@v5...v6.0.0

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

Bump @actions/cache to v6.1.0 to pick up actions/toolkit#2435 Handle cache write error due to read-only token

Switch redundant "Cache save failed" warning to debug log in save-only

6.0.0

Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2

Migrated to ESM module system

Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

... (truncated)

Commits

55cc834 Merge pull request #1768 from jasongin/readonly-cache
d8cd72f Bump @actions/cache to v6.1.0 - handle cache write error due to RO token
2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
e9b91fd Prettier fixes
e4884b8 Rebuild dist
10baf01 Fixed licenses
e39b386 Fix test mock return order
b692820 PR feedback
6074912 Rebuild dist bundles as ESM to match type:module
5a912e8 Fix lint and jest issues
Additional commits viewable in compare view

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in actions/upload-artifact#754

Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762

Support direct file uploads by @danwkennedy in actions/upload-artifact#764

New Contributors

@Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in actions/upload-artifact#719

fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in actions/upload-artifact#744

prepare release v6.0.0 for Node.js 24 support by @salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
bbbca2d Support direct file uploads (#764)
589182c Upgrade the module to ESM and bump dependencies (#762)
47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
02a8460 Add proxy integration test
b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
e516bc8 docs: correct description of Node.js 24 support in README
Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in actions/download-artifact#471

Add a regression test for artifact name + content-type mismatches by @danwkennedy in actions/download-artifact#472

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in actions/download-artifact#460

Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/download-artifact#440

Download Artifact Node24 support by @salmanmkc in actions/download-artifact#415

fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in actions/download-artifact#451

prepare release v7.0.0 for Node.js 24 support by @salmanmkc in actions/download-artifact#452

... (truncated)

Commits

3e5f45b Add regression tests for CJK characters (#471)
e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
f258da9 Add change docs
ccc058e Fix linting issues
bd7976b Add a setting to specify what to do on hash mismatch and default it to error
ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
15999bf Add note about package bumps
974686e Bump the version to v8 and add release notes
fbe48b1 Update test names to make it clearer what they do
Additional commits viewable in compare view

rominf

Automated review: Approve. I verified all seven updated action SHAs directly against upstream refs rather than relying on Dependabot labels. The pins and compatibility-relevant usage are sound, including dereferencing the annotated checkout v6.0.3 tag correctly.

Two non-blocking comment-accuracy notes:

.github/workflows/ci.yml:94 still labels dorny/paths-filter as v3.0.2; the new pin is v4.0.2 (and the old pin was v3.0.3). Please consider updating it to # v4.0.2.
.github/workflows/ci.yml:372 labels the j178/prek-action pin as prek 0.4.5 checksums, while the pinned commit updates known versions through prek 0.4.10. The cumulative manifest still includes 0.4.5, so the configured version remains valid; updating the comment would make the rationale accurate.

Follow-up, not introduced here: six actions/checkout@v7 uses remain moving tags rather than SHA pins, unlike the other checkout call sites. Worth normalizing separately.

…updates Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `7.0.1` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `3.0.3` | `4.0.2` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.82.6` | `2.84.0` | | [j178/prek-action](https://github.com/j178/prek-action) | `dec4adcd2fa1db9d50a39668b22112a37235e730` | `5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16` | | [actions/cache](https://github.com/actions/cache) | `5.1.0` | `6.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | Updates `actions/checkout` from 6.0.3 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...3d3c42e) Updates `dorny/paths-filter` from 3.0.3 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@d1c1ffe...7b450ff) Updates `taiki-e/install-action` from 2.82.6 to 2.84.0 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@9bcaee1...a6b2e2d) Updates `j178/prek-action` from dec4adcd2fa1db9d50a39668b22112a37235e730 to 5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 - [Release notes](https://github.com/j178/prek-action/releases) - [Commits](j178/prek-action@dec4adc...5337cb9) Updates `actions/cache` from 5.1.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@caa2961...55cc834) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...043fb46) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...3e5f45b) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: j178/prek-action dependency-version: c4fa77110131e365aa6c7c78641ec120ccb1762a dependency-type: direct:production dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.83.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

The Dependabot group bump moved the dorny/paths-filter pin to 7b450fff (which is the v4.0.2 tag) but left the trailing comment reading v3.0.2, so the SHA and its version comment disagreed. The SHA is correct; only the comment was stale. Align the comment with the pinned commit so the pin remains auditable. Signed-off-by: Roman Inflianskas <Roman.Inflianskas@amd.com>

rominf · 2026-07-21T10:50:44Z

Review fix applied — `dorny/paths-filter` version comment

Independently re-verified all seven updated action SHA pins against upstream refs (not the Dependabot labels or prior approval). Six pins have SHA + comment in agreement. One had a stale comment introduced by this bump:

dorny/paths-filter — the pin moved to 7b450fff21473bca461d4b92ce414b9d0420d706, which is the v4.0.2 tag (v3.0.2 is de90cc6f…), but the trailing comment still read # v3.0.2. The SHA is correct and matches the intended v3→v4 bump; only the comment was stale. Per the repo convention (AGENTS.md §6: "bump the SHA and comment together when upgrading"), the SHA and its version comment must agree so the pin stays auditable.

Fixed in 3abcc91: ci: correct dorny/paths-filter version comment to v4.0.2 (comment-only change; SHA untouched).

Verification notes

j178/prek-action pin 5337cb91… resolves to tag v2.0.6 and its version-manifest.json at that commit still contains prek 0.4.5 — the # prek 0.4.5 checksums comment is accurate.
The major bumps (checkout v6→v7, upload-artifact v4→v7, download-artifact v4→v8, cache v5→v6) were checked against upstream changelogs for breaking changes affecting this repo's usage; none apply. upload-artifact v7 ↔ download-artifact v8 remain compatible for the pattern: '*-report' multi-artifact consolidation flow (all uploads use the default zip mode).

Non-blocking (pre-existing, out of scope for this bump)

.github/workflows/release.yml pins actions-rust-lang/setup-rust-toolchain@v1 (a moving tag) while every other workflow pins it to a SHA # v1.17.0. Not introduced by this PR and not tracked by Dependabot's github-actions updater; worth a follow-up manual SHA-pin to satisfy AGENTS.md §6.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 15, 2026

dependabot Bot changed the title ~~build(deps): bump the github-actions group with 7 updates~~ build(deps): bump the github-actions group across 1 directory with 7 updates Jul 17, 2026

dependabot Bot force-pushed the dependabot/github_actions/github-actions-9a65d7344f branch from 450eeeb to 450f3db Compare July 17, 2026 09:31

rominf approved these changes Jul 17, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/github-actions-9a65d7344f branch from 450f3db to c344708 Compare July 21, 2026 10:02

rominf enabled auto-merge July 21, 2026 10:56

rominf mentioned this pull request Jul 21, 2026

build(deps): pin release Rust toolchain action #137

Merged

rominf added this pull request to the merge queue Jul 21, 2026

Merged via the queue into main with commit 0562703 Jul 21, 2026
18 of 19 checks passed

rominf deleted the dependabot/github_actions/github-actions-9a65d7344f branch July 21, 2026 18:16

rominf mentioned this pull request Aug 3, 2026

build(deps): bump the github-actions group across 1 directory with 2 updates #147

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the github-actions group across 1 directory with 7 updates - #120

build(deps): bump the github-actions group across 1 directory with 7 updates#120
rominf merged 2 commits into
mainfrom
dependabot/github_actions/github-actions-9a65d7344f

dependabot Bot commented on behalf of github Jul 15, 2026 •

edited

Loading

Uh oh!

rominf left a comment

Uh oh!

rominf commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.1

What's Changed

v7.0.0

What's Changed

New Contributors

v6.1.0

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.0.2

What's Changed

New Contributors

v4.0.1

What's Changed

New Contributors

v4.0.0

What's Changed

New Contributors

Changelog

v4.0.2

v4.0.1

v4.0.0

v3.0.3

v3.0.2

v3.0.1

v3.0.0

v2.11.1

v2.11.0

v2.10.2

v2.10.1

v2.10.0

v2.9.3

2.84.0

2.83.4

2.83.3

2.83.2

Changelog

[Unreleased]

[2.84.0] - 2026-07-20

[2.83.4] - 2026-07-17

[2.83.3] - 2026-07-16

v6.1.0

What's Changed

v6.0.0

What's Changed

Releases

How to prepare a release

Changelog

6.1.0

6.0.0

5.0.4

5.0.3

5.0.2

v7.0.1

What's Changed

v7.0.0

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v6.0.0

v6 - What's new

Node.js 24

What's Changed

dependabot Bot commented on behalf of github Jul 15, 2026 •

edited

Loading

Review fix applied — `dorny/paths-filter` version comment