Skip to content

build(deps): bump the github-actions group with 2 updates - #1750

Merged
Changyong Gong (chagong) merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-202779b4ef
Sep 7, 2026
Merged

build(deps): bump the github-actions group with 2 updates#1750
Changyong Gong (chagong) merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-202779b4ef

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 2 updates: actions/setup-java and azure/login.

Updates actions/setup-java from 5.7.0 to 6.0.0

Release notes

Sourced from actions/setup-java's releases.

v6.0.0

What's Changed

... (truncated)

Commits

Updates azure/login from 3.0.1 to 3.0.2

Release notes

Sourced from azure/login's releases.

Azure Login Action v3.0.2

What's Changed

Security & hardening

  • Refactor PowerShell login to a static param()-bound script — eliminates string-interpolation in the AzPS login path so credential/config values can never be re-parsed as PowerShell (injection-safe by construction) by @​MaddyMicrosoft in Azure/login#607
  • Pin third-party GitHub Actions to commit SHAs — supply-chain hardening for the CI/release workflows by @​MaddyMicrosoft in Azure/login#615
  • Add admin-gated Release workflow — reproducible, approval-gated release + rollback pipeline by @​MaddyMicrosoft in Azure/login#610

Telemetry

  • Emit the real action ref in telemetry via GITHUB_ACTION_REF — corrects the previously stale hard-coded value so usage reports the version consumers actually pin by @​MaddyMicrosoft in Azure/login#614

Dependencies

Maintenance & docs

Full Changelog: Azure/login@v3.0.1...v3.1.0

Commits
  • 7ddb5af prepare release v3.0.2
  • d90bae5 Cap @​actions/exec and @​actions/core below the ESM-only 3.x majors (#628)
  • ff48d59 Bump uuid and @​actions/core (#589)
  • a26a331 Bump brace-expansion from 1.1.12 to 1.1.18 (#616)
  • ca06f43 Refactor PS login to use a static param()-bound script (#607)
  • 905554e Add admin-gated Release workflow (#610)
  • 1029b1a Bump the github-actions group across 1 directory with 7 updates (#621)
  • ae37a0d Harden Dependabot config for the CommonJS ncc build (#622)
  • 43c6847 Docs uplift (#620)
  • cf887bb Bump picomatch from 2.3.1 to 2.3.2 (#582)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 2 updates: [actions/setup-java](https://github.com/actions/setup-java) and [azure/login](https://github.com/azure/login).


Updates `actions/setup-java` from 5.7.0 to 6.0.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@b6effb0...dd06d9c)

Updates `azure/login` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/azure/login/releases)
- [Commits](Azure/login@f5d393a...7ddb5af)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: azure/login
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 4, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 4, 2026

@wenytang-ms wenyt (wenytang-ms) left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed: the PR only updates pinned GitHub Action SHAs for actions/setup-java and azure/login, and the required CI checks are green, including E2E AutoTest.

@chagong Changyong Gong (chagong) left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependency update and compatibility evidence reviewed; current-head CI is green.

@chagong
Changyong Gong (chagong) merged commit cf5d4d8 into main Sep 7, 2026
56 checks passed
@chagong
Changyong Gong (chagong) deleted the dependabot/github_actions/github-actions-202779b4ef branch September 7, 2026 07:50
@chagong

Copy link
Copy Markdown
Contributor

Decision: MERGED

Dependabot PR Manager result

  • Repository: microsoft/vscode-java-pack
  • Pull request: microsoft/vscode-java-pack#1750build(deps): bump the github-actions group with 2 updates
  • Update: Grouped update: actions/setup-java 5.7.0 -> 6.0.0 (major); azure/login 3.0.1 -> 3.0.2 (security-related patch).
  • Safety assessment: Bot-only provenance; immutable SHAs match release tags. Compatibility Remediation Gate passed without changes. Both actions have required workflow roles, existing inputs remain supported, and upstream release/build/integration evidence is green. Risk: low-to-moderate due to the setup-java major update.
  • Final state: Head 073f8594c99018e428cd9c5a084ecc7b37a0812f; merged at 2026-09-07T07:50:28Z; review decision APPROVED; CI: 55 successful, 1 skipped, 0 failed or non-terminal.
  • Actions taken: No rebase, recreation, rerun, or remediation needed. Approved the unchanged head, refreshed reviews and unresolved threads, reconfirmed base ancestry, then squash-merged successfully.
  • Reason: None.
  • Next action: None.
  • Workflow run: https://github.com/chagong/JavaForge/actions/runs/34094631101

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants