Skip to content

Update GitHub Actions - #654

Open
oep-renovate[bot] wants to merge 1 commit into
masterfrom
renovate/github-actions
Open

Update GitHub Actions#654
oep-renovate[bot] wants to merge 1 commit into
masterfrom
renovate/github-actions

Conversation

@oep-renovate

@oep-renovate oep-renovate Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/create-github-app-token action minor v3.2.0 → v3.3.0
actions/download-artifact (changelog) action digest 3e5f45b → 9000827
actions/setup-python action minor v7.0.0 → v7.1.0
actions/upload-artifact action patch v7.0.1 → v7.0.2
astral-sh/setup-uv action major v9.0.0 → v10.3.2
ghcr.io/renovatebot/renovate (source) minor 44.17.1 → 44.178.4
github/codeql-action action minor v4.37.6 → v4.39.1
ossf/scorecard-action action minor v2.4.4 → v2.5.0
pypa/gh-action-pypi-publish action patch v1.14.2 → v1.14.3
renovatebot/github-action action minor v46.2.2 → v46.3.9
renovatebot/renovate minor 44.17.1 → 44.178.4
step-security/harden-runner action minor v2.20.1 → v2.22.2

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
actions/setup-python (actions/setup-python)

v7.1.0

Compare Source

What's Changed
Enhancements
Dependency Upgrade
New Contributors

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

actions/upload-artifact (actions/upload-artifact)

v7.0.2

Compare Source

What's Changed
  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.
New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

astral-sh/setup-uv (astral-sh/setup-uv)

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes
🧰 Maintenance
📚 Documentation

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in #​984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
renovatebot/renovate (ghcr.io/renovatebot/renovate)

v44.178.4

Compare Source

Bug Fixes

v44.178.3

Compare Source

Build System
  • deps: update dependency google-auth-library to v11.3.1 (main) (#​47325) (2fb5da1)

v44.178.2

Compare Source

Build System

v44.178.1

Compare Source

Bug Fixes
  • deps: update dependency github/gh-actions-lock to v0.3.0 (main) (#​47315) (985282b)
Miscellaneous Chores

v44.178.0

Compare Source

Features
Miscellaneous Chores

v44.177.0

Compare Source

Features
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v14.50.0 (main) (#​47305) (3383372)

v44.176.4

Compare Source

Bug Fixes
Miscellaneous Chores
Build System

v44.176.3

Compare Source

Bug Fixes
  • config/validation: allow patterns for allowedValues of patternMatch options (#​47297) (c11b614)
  • dependency-dashboard: ignore dashboard checkboxes when mode=silent (#​47271) (8b2ff8b)
  • manager/github-actions: relock when regenerating actions.lock (#​47294) (64aa649), closes #​47292

v44.176.2

Compare Source

Bug Fixes

v44.176.1

Compare Source

Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v14.49.0 (main) (#​47278) (2413b2b)
Build System

v44.176.0

Compare Source

Features
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v14.48.0 (main) (#​47272) (6924b7b)
  • deps: update github/codeql-action action to v4.39.1 (main) (#​47273) (43af5fa)

v44.175.5

Compare Source

Bug Fixes

v44.175.4

Compare Source

Bug Fixes

v44.175.3

Compare Source

Bug Fixes
  • workers/repository/lookup: warn when a tag is missing its v prefix (#​47155) (b91f928)
Documentation
  • mend-hosted: Enterprise users can specify forkProcessing and onboardingNoDeps (#​47246) (bd4ba3b)
Build System

v44.175.2

Compare Source

Bug Fixes
  • manager/kustomize: handle helm charts without repo (#​47255) (06d7f77)
  • manager/npm: omit unresolved npmrc from extracted package files (#​47258) (25d7295)
  • workers: keep absent registry URLs absent when detaching credentials (#​47256) (571a269)

v44.175.1

Compare Source

Bug Fixes
  • config/validation: remove custom validation for allowedValues (#​43833) (e6cdac8)
  • config/validation: validate allowedValues for arrays (#​39076) (e5ae141)
  • config/validation: validate customDatasources generically (#​47195) (b4de4ca)
  • config/validation: validate the entries of arrays of strings (#​47194) (e49ca6a)
  • config: document all valid customDatasources[].formats (#​47204) (a19c6bc)
  • workers/repository/init: massage inherited config before validating (#​47201) (2a3a481)
  • workers/repository/init: massage static repo config before validating (#​47202) (fea2346)
Miscellaneous Chores
Code Refactoring
  • util/exec: use isContainerbase from the base image package directly (#​47247) (dff2bd5)
Tests
  • workers/repository/init: document validation of unmassaged config (#​47200) (de17a09)
Build System

v44.175.0

Compare Source

Features
Bug Fixes
  • config/validation: correct misleading message for non-string customDatasources values (#​47184) (b7feac6)
  • config/validation: don't throw for invalid types of enabledManagers and schedule (#​47193) (ba23989)
  • config/validation: require hostRules[].headers to be an object (#​47185) (a01e305)
  • config/validation: validate templates in global config (#​47186) (e98ddc3)
  • config: allow lockfileUpdate in matchUpdateTypes (#​47182) (d2d9f17)
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v14.46.0 (main) (#​47243) (61d2fc7)
Tests
  • config/validation: document existing validation behaviour (#​47183) (e857db2)

v44.174.0

Compare Source

Features
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v14.45.0 (main) (#​47240) (da3366e)

v44.173.1

Compare Source

Bug Fixes

v44.173.0

Compare Source

Features

v44.172.2

Compare Source

Bug Fixes
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v14.44.4 (main) (#​47231) (fc2a9d0)

v44.172.1

Compare Source

Bug Fixes
Miscellaneous Chores

v44.172.0

Compare Source

Features
  • workarounds: add helm-docs workaround for old tags from 2019 (#​46838) (33483f9)

v44.171.9

Compare Source

Bug Fixes
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v14.44.3 (main) (#​47217) (32306c6)
  • deps: update linters to v1.88.0 (main) (#​47222) (6e01ad1)

v44.171.8

Compare Source

Bug Fixes
  • vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts (#​47211) (dc71c78)
Build System
  • deps: update dependency google-auth-library to v11.3.0 (main) (#​47213) (85acb08)

v44.171.7

Compare Source

Bug Fixes

v44.171.6

Compare Source

Build System

v44.171.5

Compare Source

Bug Fixes
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v14.44.2 (main) (#​47207) (b0abab7)

v44.171.4

Compare Source

Bug Fixes
Miscellaneous Chores

v44.171.3

Compare Source

Miscellaneous Chores
Build System

v44.171.2

Compare Source

Bug Fixes
  • cache: hash URL credentials in cache keys (320f770)
  • extract: resolve npmrc again instead of caching it with package files (061e9ba)
  • http: persist only an allow-list of response headers in the http caches (9e46e31)
  • workers: keep URL credentials of dependencies out of the repository cache and generated texts (71d4f95)

v44.171.1

Compare Source

Build System

v44.171.0

Compare Source

Features
Bug Fixes
Miscellaneous Chores
Code Refactoring

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • On day 1 of the month (* * 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@oep-renovate
oep-renovate Bot requested a review from a team as a code owner October 1, 2026 02:33
@github-actions github-actions Bot added the build Related to build scripts label Oct 1, 2026
@oep-renovate
oep-renovate Bot force-pushed the renovate/github-actions branch 7 times, most recently from bbdc535 to 79dfb59 Compare October 8, 2026 02:22
@oep-renovate
oep-renovate Bot force-pushed the renovate/github-actions branch 8 times, most recently from 749bd9b to 408d17d Compare October 16, 2026 02:13
@oep-renovate
oep-renovate Bot force-pushed the renovate/github-actions branch 6 times, most recently from 8823c29 to ab57588 Compare October 22, 2026 02:14
@oep-renovate
Update GitHub Actions
ceb4e28 
Signed-off-by: oep-renovate[bot] <212772560+oep-renovate[bot]@users.noreply.github.com>
Signed-off-by: oep-renovate[bot] <212772560+oep-renovate[bot]@users.noreply.github.com>
@oep-renovate
oep-renovate Bot force-pushed the renovate/github-actions branch from ab57588 to ceb4e28 Compare October 23, 2026 02:14

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

build Related to build scripts

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants