Skip to content

chore(deps): bump the github-actions group across 1 directory with 7 updates - #254

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-72f33c95e9
Closed

chore(deps): bump the github-actions group across 1 directory with 7 updates#254
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-72f33c95e9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 7 updates in the / directory:

Package From To
github/gh-aw-actions/setup 0.81.6 0.88.8
actions/github-script 8.0.0 9.0.0
actions/checkout 6.0.3 7.0.1
github/gh-aw-actions/setup-cli 0.81.6 0.88.8
actions/cache/restore 5.0.5 6.1.0
actions/cache/save 5.0.5 6.1.0
actions/setup-node 4.4.0 7.0.0

Updates github/gh-aw-actions/setup from 0.81.6 to 0.88.8

Release notes

Sourced from github/gh-aw-actions/setup's releases.

v0.88.8

Sync of actions from gh-aw at v0.88.8.

v0.88.7

Sync of actions from gh-aw at v0.88.7.

v0.88.6

Sync of actions from gh-aw at v0.88.6.

v0.88.5

Sync of actions from gh-aw at v0.88.5.

v0.88.4

Sync of actions from gh-aw at v0.88.4.

v0.88.3

Sync of actions from gh-aw at v0.88.3.

v0.88.2

Sync of actions from gh-aw at v0.88.2.

v0.88.0

Sync of actions from gh-aw at v0.88.0.

v0.87.10

Sync of actions from gh-aw at v0.87.10.

v0.87.9

Sync of actions from gh-aw at v0.87.9.

v0.87.8

Sync of actions from gh-aw at v0.87.8.

v0.87.7

Sync of actions from gh-aw at v0.87.7.

v0.87.6

Sync of actions from gh-aw at v0.87.6.

v0.87.5

Sync of actions from gh-aw at v0.87.5.

v0.87.4

Sync of actions from gh-aw at v0.87.4.

v0.87.2

Sync of actions from gh-aw at v0.87.2.

v0.87.1

Sync of actions from gh-aw at v0.87.1.

... (truncated)

Commits

Updates actions/github-script from 8.0.0 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Updates actions/checkout from 6.0.3 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates github/gh-aw-actions/setup-cli from 0.81.6 to 0.88.8

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.88.8

Sync of actions from gh-aw at v0.88.8.

v0.88.7

Sync of actions from gh-aw at v0.88.7.

v0.88.6

Sync of actions from gh-aw at v0.88.6.

v0.88.5

Sync of actions from gh-aw at v0.88.5.

v0.88.4

Sync of actions from gh-aw at v0.88.4.

v0.88.3

Sync of actions from gh-aw at v0.88.3.

v0.88.2

Sync of actions from gh-aw at v0.88.2.

v0.88.0

Sync of actions from gh-aw at v0.88.0.

v0.87.10

Sync of actions from gh-aw at v0.87.10.

v0.87.9

Sync of actions from gh-aw at v0.87.9.

v0.87.8

Sync of actions from gh-aw at v0.87.8.

v0.87.7

Sync of actions from gh-aw at v0.87.7.

v0.87.6

Sync of actions from gh-aw at v0.87.6.

v0.87.5

Sync of actions from gh-aw at v0.87.5.

v0.87.4

Sync of actions from gh-aw at v0.87.4.

v0.87.2

Sync of actions from gh-aw at v0.87.2.

v0.87.1

Sync of actions from gh-aw at v0.87.1.

... (truncated)

Commits

Updates actions/cache/restore from 5.0.5 to 6.1.0

Release notes

Sourced from actions/cache/restore's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache/restore's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates actions/cache/save from 5.0.5 to 6.1.0

Release notes

Sourced from actions/cache/save's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

Changelog

Sourced from actions/cache/save's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates actions/setup-node from 4.4.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 31, 2026
@dependabot dependabot Bot changed the title chore(deps): bump the github-actions group with 7 updates chore(deps): bump the github-actions group across 1 directory with 7 updates Sep 8, 2026
Copilot AI balanced review requested due to automatic review settings September 8, 2026 14:10
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-72f33c95e9 branch from 190dd09 to 32056b7 Compare September 8, 2026 14:10
Copilot AI reviewed Sep 8, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Several gh-aw “.lock.yml” workflows were edited without regenerating their embedded metadata/manifests (and one checkout line comment is inconsistent), which can trigger stale-lock/guardrail failures and should be corrected before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates pinned GitHub Actions SHAs across the repository’s workflows to newer upstream releases (checkout v7.0.1, setup-node v7.0.0, github-script v9.0.0, cache v6.1.0, and gh-aw-actions v0.88.0), primarily affecting CI and issue/agentic automation workflows.

Changes:

  • Bump actions/checkout, actions/setup-node, and actions/github-script pins across multiple workflows.
  • Update cache action pins (actions/cache/restore and actions/cache/save) to v6.1.0 where used.
  • Update github/gh-aw-actions pins in agentic/lock workflows and maintenance workflows.
File summaries
File Description
.github/workflows/test-round-trip.yml Bumps checkout/setup-node pins for integration test workflow.
.github/workflows/test-redact-secrets.yml Bumps checkout/setup-node pins for integration test workflow.
.github/workflows/squad-release.yml Bumps checkout/setup-node pins for release workflow.
.github/workflows/squad-heartbeat.yml Bumps checkout and github-script pins used for triage automation.
.github/workflows/issue-triage.lock.yml Updates pinned action SHAs inside a gh-aw generated lock workflow.
.github/workflows/issue-remove-stale.yml Bumps github-script pins used for stale issue automation.
.github/workflows/issue-labels-sync.yml Bumps checkout/setup-node/github-script pins used for label sync.
.github/workflows/issue-labels-migrate.yml Bumps github-script pins used for label migration.
.github/workflows/issue-labels-enforce-unique.yml Bumps checkout/github-script pins used for label enforcement.
.github/workflows/issue-label-fixed-on-merge.yml Bumps github-script pins used for post-merge labeling.
.github/workflows/issue-go-yes.lock.yml Updates pinned action SHAs inside a gh-aw generated lock workflow.
.github/workflows/issue-go-no.yml Bumps github-script pins used for go:no automation.
.github/workflows/issue-go-clarify.lock.yml Updates pinned action SHAs inside a gh-aw generated lock workflow.
.github/workflows/doc-freshness.lock.yml Updates pinned action SHAs inside a gh-aw generated lock workflow.
.github/workflows/codeql.yml Bumps checkout pin for CodeQL workflow.
.github/workflows/ci.yml Bumps checkout/setup-node pins for CI workflow.
.github/workflows/agentics-maintenance.yml Bumps gh-aw-actions/setup(+setup-cli), checkout, cache, and github-script pins for maintenance automation.
Review details

Suppressed comments (4)

.github/workflows/agentics-maintenance.yml:322

  • This setup-cli step pins the action at v0.88.0 but continues to install gh-aw CLI v0.81.6; that makes the bump effectively incomplete and can be confusing when debugging. Consider aligning the version: input with the action version (or documenting why it must stay at v0.81.6).
      - name: Install gh-aw
        uses: github/gh-aw-actions/setup-cli@afc709f45ed6a3f756eb4551856c6a9c42e15b2c # v0.88.0
        with:
          version: v0.81.6

.github/workflows/agentics-maintenance.yml:368

  • github/gh-aw-actions/setup-cli is bumped to v0.88.0 here, but the installed gh-aw CLI version is still set to v0.81.6. If the goal is to upgrade gh-aw, update the version: input to match.
      - name: Install gh-aw
        uses: github/gh-aw-actions/setup-cli@afc709f45ed6a3f756eb4551856c6a9c42e15b2c # v0.88.0
        with:
          version: v0.81.6

.github/workflows/agentics-maintenance.yml:473

  • This step uses the v0.88.0 setup-cli action but requests gh-aw CLI v0.81.6. Unless intentionally pinned, align the version: input with v0.88.0 so the workflow actually runs the upgraded CLI.
      - name: Install gh-aw
        uses: github/gh-aw-actions/setup-cli@afc709f45ed6a3f756eb4551856c6a9c42e15b2c # v0.88.0
        with:
          version: v0.81.6

.github/workflows/agentics-maintenance.yml:602

  • The setup-cli action is updated to v0.88.0, but the installed gh-aw CLI remains pinned to v0.81.6 via version:. If the intent is to bump gh-aw, update version: accordingly (or document the rationale for keeping the older CLI).
      - name: Install gh-aw
        uses: github/gh-aw-actions/setup-cli@afc709f45ed6a3f756eb4551856c6a9c42e15b2c # v0.88.0
        with:
          version: v0.81.6
  • Files reviewed: 17/17 changed files
  • Comments generated: 6
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/agentics-maintenance.yml
uses: github/gh-aw-actions/setup-cli@ba6380cc6e5be5d21677bebe04d52fb48e3abec7 # v0.81.6
uses: github/gh-aw-actions/setup-cli@afc709f45ed6a3f756eb4551856c6a9c42e15b2c # v0.88.0
with:
version: v0.81.6
Comment thread .github/workflows/doc-freshness.lock.yml
Comment on lines 96 to 99
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@ba6380cc6e5be5d21677bebe04d52fb48e3abec7 # v0.81.6
uses: github/gh-aw-actions/setup@afc709f45ed6a3f756eb4551856c6a9c42e15b2c # v0.88.0
with:
Comment thread .github/workflows/issue-go-clarify.lock.yml
Comment on lines 101 to 104
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@ba6380cc6e5be5d21677bebe04d52fb48e3abec7 # v0.81.6
uses: github/gh-aw-actions/setup@afc709f45ed6a3f756eb4551856c6a9c42e15b2c # v0.88.0
with:
Comment thread .github/workflows/issue-go-yes.lock.yml
Comment on lines 103 to 106
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@ba6380cc6e5be5d21677bebe04d52fb48e3abec7 # v0.81.6
uses: github/gh-aw-actions/setup@afc709f45ed6a3f756eb4551856c6a9c42e15b2c # v0.88.0
with:
Comment thread .github/workflows/issue-triage.lock.yml
Comment on lines 94 to 97
- name: Setup Scripts
id: setup
uses: github/gh-aw-actions/setup@ba6380cc6e5be5d21677bebe04d52fb48e3abec7 # v0.81.6
uses: github/gh-aw-actions/setup@afc709f45ed6a3f756eb4551856c6a9c42e15b2c # v0.88.0
with:
Comment thread .github/workflows/issue-go-yes.lock.yml
GH_HOST="${GH_HOST#http://}"
echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 (source v6)
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.3 (source v6)
@dependabot
chore(deps): bump the github-actions group across 1 directory with 7 …
85c77da 
…updates

Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) | `0.81.6` | `0.88.8` |
| [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `7.0.1` |
| [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) | `0.81.6` | `0.88.8` |
| [actions/cache/restore](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |
| [actions/cache/save](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` |



Updates `github/gh-aw-actions/setup` from 0.81.6 to 0.88.8
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@ba6380c...5e50858)

Updates `actions/github-script` from 8.0.0 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v8...3a2844b)

Updates `actions/checkout` from 6.0.3 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6.0.3...3d3c42e)

Updates `github/gh-aw-actions/setup-cli` from 0.81.6 to 0.88.8
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@ba6380c...5e50858)

Updates `actions/cache/restore` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@27d5ce7...55cc834)

Updates `actions/cache/save` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@27d5ce7...55cc834)

Updates `actions/setup-node` from 4.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4.4.0...8207627)

---
updated-dependencies:
- dependency-name: actions/cache/restore
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache/save
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/gh-aw-actions/setup
  dependency-version: 0.87.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/gh-aw-actions/setup-cli
  dependency-version: 0.87.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI review requested due to automatic review settings September 15, 2026 14:09
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-72f33c95e9 branch from 32056b7 to 85c77da Compare September 15, 2026 14:09
Copilot AI reviewed Sep 15, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Generated gh-aw workflows are inconsistent with their authoritative sources and will lose upgrades when recompiled.

Review details

Suppressed comments (5)

.github/workflows/issue-go-clarify.lock.yml:103

  • This is a generated DO NOT EDIT workflow, but its embedded manifest and .github/aw/actions-lock.json still pin github/gh-aw-actions/setup to v0.81.6. Recompiling will therefore restore the old SHA and discard this upgrade; update the authoritative lock/compiler version and regenerate the workflow.
        uses: github/gh-aw-actions/setup@5e508589e03a7757a7e05b26e834292f5445bfb6 # v0.88.8

.github/workflows/issue-triage.lock.yml:96

  • This is a generated DO NOT EDIT workflow, but its embedded manifest and .github/aw/actions-lock.json still pin github/gh-aw-actions/setup to v0.81.6. Recompiling will therefore restore the old SHA and discard this upgrade; update the authoritative lock/compiler version and regenerate the workflow.
        uses: github/gh-aw-actions/setup@5e508589e03a7757a7e05b26e834292f5445bfb6 # v0.88.8

.github/workflows/doc-freshness.lock.yml:98

  • This is a generated DO NOT EDIT workflow, but its embedded manifest and .github/aw/actions-lock.json still pin github/gh-aw-actions/setup to v0.81.6. Recompiling will therefore restore the old SHA and discard this upgrade; update the authoritative lock/compiler version and regenerate the workflow.
        uses: github/gh-aw-actions/setup@5e508589e03a7757a7e05b26e834292f5445bfb6 # v0.88.8

.github/workflows/agentics-maintenance.yml:181

  • This file is generated by gh-aw v0.81.6, and its setup steps still explicitly install CLI v0.81.6 (for example, line 183). Directly replacing action SHAs here is not reproducible: the next gh aw compile will regenerate the old pins. Upgrade the gh-aw compiler/authoritative action lock and regenerate this maintenance workflow instead.
        uses: github/gh-aw-actions/setup-cli@5e508589e03a7757a7e05b26e834292f5445bfb6 # v0.88.8

.github/workflows/issue-go-yes.lock.yml:1548

  • This generated lock file is now inconsistent with its authoritative inputs: .github/workflows/issue-go-yes.md:173 still requests actions/checkout@v6, while this line runs v7.0.1 and still labels it as v6.0.3. The documented gh aw compile step will overwrite this upgrade; update the source/action lock and regenerate the workflow instead.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.3 (source v6)
  • Files reviewed: 17/17 changed files
  • Comments generated: 0 new
  • Review effort level: Balanced

@dependabot @github

dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 22, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-72f33c95e9 branch September 22, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant