Skip to content

ci: bump the actions group across 1 directory with 18 updates - #44

Merged
abd-ulbasit merged 1 commit into
mainfrom
dependabot/github_actions/actions-20d2bb4d17
Jul 27, 2026
Merged

ci: bump the actions group across 1 directory with 18 updates#44
abd-ulbasit merged 1 commit into
mainfrom
dependabot/github_actions/actions-20d2bb4d17

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 18 updates in the / directory:

Package From To
actions/checkout 4 7
actions/setup-go 5 7
golangci/golangci-lint-action d583c34f0599d37dbac4a198b9c83201be380893 ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
actions/upload-artifact 4 7
codecov/codecov-action 4 7
github/codeql-action 3 4
dawidd6/action-download-artifact 6 21
docker/setup-qemu-action 3 4
docker/setup-buildx-action 3 4
docker/login-action 3 4
docker/metadata-action 5 6
docker/build-push-action 6 7
actions/dependency-review-action 4 5
actions/configure-pages 5 6
actions/upload-pages-artifact 4 5
actions/deploy-pages 4 5
release-drafter/release-drafter 6 7
goreleaser/goreleaser-action 6 7

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-go from 5 to 7

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

New Contributors

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

Updates golangci/golangci-lint-action from d583c34f0599d37dbac4a198b9c83201be380893 to ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a

Commits

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 4 to 7

Release notes

Sourced from codecov/codecov-action's releases.

v7.0.0

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v6.0.2

This is a copy of the v7.0.0 release to make updates easier

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v5.5.5

This release only contains the keybase.io change as described here.

Full Changelog: codecov/codecov-action@v5.5.4...v5.5.5

v5.5.4

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

Updates github/codeql-action from 3 to 4

Release notes

Sourced from github/codeql-action's releases.

v3.37.3

No user facing changes.

v3.37.2

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v3.37.1

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

v3.37.0

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v3.36.3

No user facing changes.

v3.36.2

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

v3.36.1

No user facing changes.

v3.36.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

v3.35.5

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

v3.35.4

  • Update default CodeQL bundle version to 2.25.4. #3881

v3.35.3

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
  • Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
  • Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
  • Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
  • Update default CodeQL bundle version to 2.25.3. #3865

v3.35.2

  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

4.36.2 - 04 Jun 2026

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

  • Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
  • Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
  • Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
  • Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
  • Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
  • Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
  • Update default CodeQL bundle version to 2.25.2. #3823

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

... (truncated)

Commits
  • da21ad6 Remove NewRemoteFileAddresses FF and default to its behaviour
  • cf46341 Merge pull request #4007 from github/mbg/use-registry-proxy-for-repo-auth
  • 7db34ae Refactor looking up proxy env vars into getRegistryProxyConfig.
  • 8125f87 Remove unused getApiFetch
  • 7c4a258 Merge pull request #4021 from github/mergeback/v4.37.1-to-main-7188fc36
  • 0297913 Rebuild
  • 1226301 Update changelog and version after v4.37.1
  • 7188fc3 Merge pull request #4020 from github/update-v4.37.1-9e7c07009
  • c8b5f69 Update changelog for v4.37.1
  • 9e7c070 Merge pull request #4014 from github/mbg/explicit-remote-prefix
  • Additional commits viewable in compare view

Updates dawidd6/action-download-artifact from 6 to 21

Release notes

Sourced from dawidd6/action-download-artifact's releases.

v21

What's Changed

New Contributors

Full Changelog: dawidd6/action-download-artifact@v20...v21

v20

What's Changed

  • build(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by @​dependabot[bot] in dawidd6/action-download-artifact#387
  • node_modules: update by Description has been truncated

    Note
    Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added ci CI/CD related dependencies Pull requests that update a dependency file labels May 11, 2026
@dependabot
dependabot Bot requested a review from abd-ulbasit as a code owner May 11, 2026 23:53
@abd-ulbasit

abd-ulbasit commented Jul 26, 2026

Copy link
Copy Markdown
Owner

@dependabot recreate

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-20d2bb4d17 branch from 46f04fd to 374a649 Compare July 26, 2026 18:19
@abd-ulbasit

abd-ulbasit commented Jul 27, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-20d2bb4d17 branch from 374a649 to 78bb1e5 Compare July 27, 2026 10:46
@abd-ulbasit

abd-ulbasit commented Jul 27, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-20d2bb4d17 branch from 78bb1e5 to eb3546d Compare July 27, 2026 11:48
@abd-ulbasit

abd-ulbasit commented Jul 27, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

1 similar comment
@abd-ulbasit

abd-ulbasit commented Jul 27, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-20d2bb4d17 branch 2 times, most recently from 8dc3246 to 2328290 Compare July 27, 2026 12:08
abd-ulbasit added a commit that referenced this pull request Jul 27, 2026
@abd-ulbasit @claude
build: raise the Go toolchain floor and the builder image together
42e393e 
go.mod pinned `go 1.24.0` while deploy/docker/Dockerfile built on
golang:1.24-alpine. Those two have to move as a pair, and because they
sat in separate files no single dependabot PR could move both — so every
open PR was wedged:

  - #21/#33/#55/#56 raise go.mod to 1.25.0, and the Docker job then dies
    on the 1.24 builder:
      go: go.mod requires go >= 1.25.0 (running go 1.24.13; GOTOOLCHAIN=local)
  - #44 bumps actions/setup-go v5 -> v7, which exports GOTOOLCHAIN=local.
    With go.mod still at 1.24.0 the Security and Benchmark jobs die
    installing their tools:
      golang.org/x/vuln@v1.6.0 requires go >= 1.25.0 (running go 1.24.0)
      golang.org/x/perf@... requires go >= 1.25.0 (running go 1.24.0)

The two PRs that would have raised the base image (#2, #22) were closed,
and dependabot will not re-propose a bump it has already opened. So the
deadlock could only be broken by hand, from main, in one commit.

Raise both here, plus the benchmark Job manifest that runs go from the
same image.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-20d2bb4d17 branch from 2328290 to 8f15a05 Compare July 27, 2026 16:16
@abd-ulbasit

abd-ulbasit commented Jul 27, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-20d2bb4d17 branch from 8f15a05 to 50486b2 Compare July 27, 2026 16:27
@abd-ulbasit

abd-ulbasit commented Jul 27, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-20d2bb4d17 branch from 50486b2 to 3967457 Compare July 27, 2026 16:40
abd-ulbasit added a commit that referenced this pull request Jul 27, 2026
@abd-ulbasit @claude
build: raise the toolchain floor to 1.25.8 for the tools CI installs
625c6d7 
Same deadlock as 42e393e, one patch level deeper, surfaced by #44.

actions/setup-go v7 exports GOTOOLCHAIN=local, so every `go install
...@latest` in CI has to be satisfiable by exactly the version go.mod
declares — there is no toolchain download to paper over a gap. go.mod
said 1.25.0, which is enough for govulncheck and benchstat but not for
gosec:

    gosec@latest: github.com/securego/gosec/v2@v2.28.0 requires
    go >= 1.25.8 (running go 1.25.0; GOTOOLCHAIN=local)

So #44 could not go green on its own either. 1.25.8 is the minimum that
satisfies all three tools, not the newest release — the go directive is a
floor, and there is no reason to lock out 1.25.0-1.25.7 users beyond what
the tooling actually needs.

deploy/docker/Dockerfile needs no change: golang:1.25-alpine tracks the
newest 1.25.x, currently 1.25.12.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@abd-ulbasit

abd-ulbasit commented Jul 27, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot @abd-ulbasit
ci: bump the actions group across 1 directory with 18 updates
98aa10c 
Bumps the actions group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5` | `7` |
| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `d583c34f0599d37dbac4a198b9c83201be380893` | `ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `4` | `7` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |
| [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) | `6` | `21` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3` | `4` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` |
| [docker/login-action](https://github.com/docker/login-action) | `3` | `4` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5` | `6` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4` | `5` |
| [actions/configure-pages](https://github.com/actions/configure-pages) | `5` | `6` |
| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `4` | `5` |
| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4` | `5` |
| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `6` | `7` |
| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `6` | `7` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `actions/setup-go` from 5 to 7
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v7)

Updates `golangci/golangci-lint-action` from d583c34f0599d37dbac4a198b9c83201be380893 to ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@d583c34...ba0d7d2)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `codecov/codecov-action` from 4 to 7
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v4...v7)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

Updates `dawidd6/action-download-artifact` from 6 to 21
- [Release notes](https://github.com/dawidd6/action-download-artifact/releases)
- [Commits](dawidd6/action-download-artifact@v6...v21)

Updates `docker/setup-qemu-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@v3...v4)

Updates `docker/setup-buildx-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@v3...v4)

Updates `docker/login-action` from 3 to 4
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v3...v4)

Updates `docker/metadata-action` from 5 to 6
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@v5...v6)

Updates `docker/build-push-action` from 6 to 7
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v6...v7)

Updates `actions/dependency-review-action` from 4 to 5
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@v4...v5)

Updates `actions/configure-pages` from 5 to 6
- [Release notes](https://github.com/actions/configure-pages/releases)
- [Commits](actions/configure-pages@v5...v6)

Updates `actions/upload-pages-artifact` from 4 to 5
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](actions/upload-pages-artifact@v4...v5)

Updates `actions/deploy-pages` from 4 to 5
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](actions/deploy-pages@v4...v5)

Updates `release-drafter/release-drafter` from 6 to 7
- [Release notes](https://github.com/release-drafter/release-drafter/releases)
- [Commits](release-drafter/release-drafter@v6...v7)

Updates `goreleaser/goreleaser-action` from 6 to 7
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/configure-pages
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/dependency-review-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/deploy-pages
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-pages-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: codecov/codecov-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: dawidd6/action-download-artifact
  dependency-version: '21'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/build-push-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/login-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/metadata-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/setup-buildx-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/setup-qemu-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: golangci/golangci-lint-action
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: goreleaser/goreleaser-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: release-drafter/release-drafter
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@abd-ulbasit
abd-ulbasit force-pushed the dependabot/github_actions/actions-20d2bb4d17 branch from 3967457 to 98aa10c Compare July 27, 2026 16:57
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@abd-ulbasit
abd-ulbasit merged commit 069ddcb into main Jul 27, 2026
14 checks passed
@abd-ulbasit
abd-ulbasit deleted the dependabot/github_actions/actions-20d2bb4d17 branch July 27, 2026 17:09
abd-ulbasit added a commit that referenced this pull request Jul 27, 2026
@abd-ulbasit @claude
ci: give release-drafter the write permission it always needed
1ecc8ee 
Merging #44 took release-drafter v6 -> v7 and the job went red on main:

    Resource not accessible by integration
    https://docs.github.com/rest/releases/releases#create-a-release

The bump did not break it, it stopped hiding it. release-drafter creates
and updates a draft GitHub Release on every push to main, which needs
`contents: write`, and this workflow only ever granted `contents: read`.
v6 did not fail the job when that call was rejected, so it looked fine —
but `gh api repos/.../releases` shows no draft release has ever existed
here. The feature has been dead since the workflow was added.

Grant `contents: write` on the job rather than the workflow, so the
declaration sits next to the step that needs it. Fork and Dependabot
pull_request runs are handed a read-only token by GitHub regardless of
what is declared here, so this does not widen what an untrusted PR can
do.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@abd-ulbasit abd-ulbasit Awaiting requested review from abd-ulbasit abd-ulbasit is a code owner

Assignees

No one assigned

Labels

ci CI/CD related dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@abd-ulbasit