Skip to content

chore(deps): bump the github-actions group across 1 directory with 4 updates - #3512

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-09ea70933c
Open

chore(deps): bump the github-actions group across 1 directory with 4 updates#3512
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-09ea70933c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 4 updates in the / directory: actions/checkout, actions/setup-node, actions/setup-python and dawidd6/action-download-artifact.

Updates actions/checkout from 6.0.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-node from 6.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates actions/setup-python from 6.2.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

Commits

Updates dawidd6/action-download-artifact from 23 to 24

Release notes

Sourced from dawidd6/action-download-artifact's releases.

v24

What's Changed

Full Changelog: dawidd6/action-download-artifact@v23...v24

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026
@dependabot
dependabot Bot requested review from a team, gashcrumb and kadel as code owners September 1, 2026 21:04
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026
@openshift-ci

openshift-ci Bot commented Sep 1, 2026

Copy link
Copy Markdown

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 9:05 PM UTC · Completed 9:16 PM UTC

Commit: 8fde228 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $1.95

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Review — approve

Scope: CI dependency bump — 4 GitHub Actions across 3 workflow files.

Changes reviewed

Action Old New Files
actions/checkout v6.0.2 v7.0.1 catalog-index-sanity.yaml, notify-3rd-party-owners.yaml
actions/setup-node v6.4.0 v7.0.0 catalog-index-sanity.yaml
actions/setup-python v6.2.0 v7.0.0 catalog-index-sanity.yaml
dawidd6/action-download-artifact v23 v24 workspace-tests.yaml

Analysis

Correctness: All four are major version bumps. Breaking changes were assessed against actual usage:

  • actions/checkout v7 blocks fork-PR checkouts on pull_request_target / workflow_run triggers. None of the 3 modified workflows use these triggers (schedule and workflow_dispatch only) — no impact. The persist-credentials: false option used in catalog-index-sanity.yaml remains supported.
  • actions/setup-node v7 drops official Node 16/18 support. The workflow specifies node-version: 24 — no impact.
  • actions/setup-python v7 drops Python 3.7/3.8 support. The workflow specifies python-version: "3.12" — no impact.
  • dawidd6/action-download-artifact v24 — all input parameters used (name, workflow, workflow_conclusion, workflow_search, search_artifacts, allow_forks, if_no_artifact_found) are carried forward from v23. No breaking input changes affect this usage.

Consistency: These 3 files were the last holdouts on v6. The rest of the repo's workflows already use v7.0.1 / v7.0.0. After this PR, all workflow files will use consistent action versions across the repository.

Security: All actions are pinned to full commit SHAs (not mutable tags). actions/checkout v7's fork-PR blocking is a security improvement, though not exercised by these specific workflows.

No findings. Standard Dependabot dependency maintenance with no functional risk.

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

  • .github/workflows/catalog-index-sanity.yaml
  • .github/workflows/notify-3rd-party-owners.yaml
  • .github/workflows/workspace-tests.yaml
Previous run

Review

No code-level concerns. All modified files (.github/workflows/) fall under protected paths — human approval is required regardless of automated authorization. Changes are consistent with the repository's dependabot.yml configuration for github-actions updates.

@fullsend-ai-review fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Sep 1, 2026
@github-actions github-actions Bot added the non-workspace-changes PR changes files outside workspace directories label Sep 2, 2026
@dependabot
chore(deps): bump the github-actions group across 1 directory with 4 …
1ae4273 
…updates

Bumps the github-actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-node](https://github.com/actions/setup-node), [actions/setup-python](https://github.com/actions/setup-python) and [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact).


Updates `actions/checkout` from 6.0.2 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6.0.2...3d3c42e)

Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6.4.0...8207627)

Updates `actions/setup-python` from 6.2.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v6.2.0...5fda3b9)

Updates `dawidd6/action-download-artifact` from 23 to 24
- [Release notes](https://github.com/dawidd6/action-download-artifact/releases)
- [Commits](dawidd6/action-download-artifact@57aa996...d63b86a)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dawidd6/action-download-artifact
  dependency-version: '24'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-09ea70933c branch from 8fde228 to 1ae4273 Compare September 2, 2026 14:28
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 2:30 PM UTC · Ended 2:35 PM UTC

Commit: 1ae4273 · View workflow run →

@sonarqubecloud

sonarqubecloud Bot commented Sep 2, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 2, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:30 PM UTC · Completed 2:35 PM UTC

Commit: 1ae4273 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $0.48

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gashcrumb gashcrumb Awaiting requested review from gashcrumb gashcrumb is a code owner
@kadel kadel Awaiting requested review from kadel kadel is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code needs-ok-to-test non-workspace-changes PR changes files outside workspace directories requires-manual-review Review requires human judgment

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants