Update GitHub Actions dependencies (major)#5602
Conversation
|
Renovate Jira issue ID: SONARJAVA-6353 |
Summary
This PR bumps several major versions of GitHub Actions dependencies:
All action references now use pinned commit hashes alongside version tags for reproducibility. The changes are applied consistently across 6 workflow files and 1 composite action. What reviewers should knowStarting points:
Things to verify:
Non-obvious details:
|
|
![sonar-review-alpha[bot]](https://avatars.githubusercontent.com/in/3025063?s=60&v=4){kind=small}
There was a problem hiding this comment.
Clean update overall — all nine actions/checkout references migrate to the same pinned hash consistently, and there are no missed occurrences of the old action versions anywhere in .github/. The one thing worth confirming before merge is the Slack action upgrade.
| uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2 | ||
| env: | ||
| SLACK_BOT_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SLACK_BOT_TOKEN }} | ||
| with: |
There was a problem hiding this comment.
The jump from v1.26.0 to v3.0.2 crosses a major rewrite (v2) that changed the action's input API. In v2+, the recommended approach moved to an explicit method/payload model. Whether slack-message + SLACK_BOT_TOKEN env var are still accepted in v3 needs to be verified.
GitHub Actions silently ignores unrecognised inputs, so if slack-message was dropped, this step would run, appear successful in the log, and send nothing — invisible until an actual pipeline failure reveals it.
Please test this against a real failure or check the v3 action README to confirm the shorthand inputs are still supported. If they're not, the fix is to switch to the payload input:
uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # v3.0.2
env:
SLACK_BOT_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SLACK_BOT_TOKEN }}
with:
method: chat.postMessage
token: ${{ fromJSON(steps.secrets.outputs.vault).SLACK_BOT_TOKEN }}
payload: |
{
"channel": "squad-jvm-notifs",
"text": "Dogfood build for `${{ steps.dogfood.outputs.sha1 }}`: *failed*, see the logs at https://github.com/SonarSource/sonar-java/actions/workflows/dogfood.yml"
}- Mark as noise
This PR contains the following updates:
v5.0.0→v6.0.2v4→v6v9→v10v4→v7v1.26.0→v3.0.2v3.0.3Release Notes
actions/checkout (actions/checkout)
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.0.1Compare Source
What's Changed
Full Changelog: actions/checkout@v5...v5.0.1
actions/stale (actions/stale)
v10.2.0Compare Source
v10.1.1Compare Source
What's Changed
Bug Fix
only-issue-typesby @Bibo-Joshi in #1298Improvement
Dependency Upgrades
New Contributors
Full Changelog: actions/stale@v10...v10.1.1
v10.1.0Compare Source
What's Changed
only-issue-typesoption to filter issues by type by @Bibo-Joshi in #1255New Contributors
Full Changelog: actions/stale@v10...v10.1.0
v10.0.0Compare Source
What's Changed
Breaking Changes
Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. Release Notes
Enhancement
Dependency Upgrades
Documentation changes
New Contributors
Full Changelog: actions/stale@v9...v10.0.0
v10Compare Source
v9.1.0Compare Source
What's Changed
New Contributors
Full Changelog: actions/stale@v9...v9.1.0
actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
v7.0.0Compare Source
v7 What's new
Direct Uploads
Adds support for uploading single files directly (unzipped). Callers can set the new
archiveparameter tofalseto skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. Thenameparameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.ESM
To support new versions of the
@actions/*packages, we've upgraded the package to ESM.What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v6...v7.0.0
v7Compare Source
v6Compare Source
v6.0.0Compare Source
v5Compare Source
v5.0.0Compare Source
v4.6.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v4...v4.6.2
v4.6.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v4...v4.6.1
v4.6.0Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v4...v4.6.0
v4.5.0Compare Source
What's Changed
Node.jsversion in action by @hamirmahal in #578artifact-digestoutput by @bdehamer in #656New Contributors
Full Changelog: actions/upload-artifact@v4.4.3...v4.5.0
v4.4.3Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v4.4.2...v4.4.3
v4.4.2Compare Source
What's Changed
@actions/artifactto 2.1.11 by @robherley in #627Full Changelog: actions/upload-artifact@v4.4.1...v4.4.2
v4.4.1Compare Source
What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v4.4.0...v4.4.1
v4.4.0Compare Source
Notice: Breaking Changes⚠️
We will no longer include hidden files and folders by default in the
upload-artifactaction of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option,include-hidden-files, to continue to do so.See "Notice of upcoming deprecations and breaking changes in GitHub Actions runners" changelog and this issue for more details.
What's Changed
Full Changelog: actions/upload-artifact@v4.3.6...v4.4.0
v4.3.6Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v4...v4.3.6
v4.3.5Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v4.3.4...v4.3.5
v4.3.4Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v4.3.3...v4.3.4
v4.3.3Compare Source
What's Changed
@actions/artifactdependency to v2.1.6 by @eggyhead in #565Full Changelog: actions/upload-artifact@v4.3.2...v4.3.3
v4.3.2Compare Source
What's Changed
@actions/artifactdependency to v2.1.5 and@actions/coreto v1.0.1 by @eggyhead in #562New Contributors
Full Changelog: actions/upload-artifact@v4.3.1...v4.3.2
v4.3.1Compare Source
v4.3.0Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v4...v4.3.0
v4.2.0Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v4...v4.2.0
v4.1.0Compare Source
What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v4...v4.1.0
slackapi/slack-github-action (slackapi/slack-github-action)
v3.0.2: Slack GitHub Action v3.0.2Compare Source
Patch Changes
79529d7: fix: resolve url.parse deprecation warning for webhook techniquesv3.0.1: Slack GitHub Action v3.0.1Compare Source
What's Changed
Alongside the breaking changes of
@v3.0.0and a new technique to run Slack CLI commands, we tried the wrong name to publish to the GitHub Marketplace 🐙 This action is now noted as The Slack GitHub Action in listings 🎶 ✨🎨 Maintenance
Full Changelog: slackapi/slack-github-action@v3.0.0...v3.0.1
v3Compare Source
v3.0Compare Source
v3.0.0: Slack GitHub Action v3.0.0Compare Source
🎽 Running Slack CLI commands and the active Node runtime, both included in this release 👟 ✨
This major version updates the GitHub Actions required runtime to Node.js 24. Most GitHub-hosted runners already include this, but self-hosted runners may need to be updated ahead of planned deprecations of Node 20 on GitHub Actions runners.
📺 Enhancement: Run Slack CLI commands
This release introduces a new technique for running Slack CLI commands directly in GitHub Actions workflows. Use this to install the latest version (or a specific one) of the CLI and execute commands like
deployfor merges to main,manifest validatewith tests, and other commands.Gather a token using the following CLI command to store with repo secrets, then get started with an example below:
🧪 Validate an app manifest on pull requests
Check that your app manifest is valid before merging changes:
🔗 https://docs.slack.dev/tools/slack-github-action/sending-techniques/running-slack-cli-commands/validate-a-manifest
🚀 Deploy your app on push to main
Automate deployments whenever changes land on your main branch:
🔗 https://docs.slack.dev/tools/slack-github-action/sending-techniques/running-slack-cli-commands/deploy-an-app
Any Slack CLI command can be passed through the
commandoption without the "slack" prefix 🍀The
tokeninput accepts a service token for authentication. You can gather this token by runningslack auth tokenwith the Slack CLI and storing the value as a repository secret.The latest Slack CLI version is used by default, but a specific one can be set with the
versioninput.🏆 Huge thanks to @ewanek1 for explorations and prototypes toward the scripted CLI technique!
For full documentation on the CLI technique, check out the docs and explore the related pages 📚
What's Changed
👾 Enhancements
📚 Documentation
docs.slack.dev/tools*paths in #485 - Thanks @lukegalbraithrussell!🧰 Maintenance
🎁 Dependencies
👋 New Contributors
Full Changelog: slackapi/slack-github-action@v2.1.1...v3.0.0
v2.1.1: Slack Send v2.1.1Compare Source
What's Changed
This release fixes an issue where substituted variables might've broken valid JSON or YAML parsings when using the
payload-file-pathinput option.🐛 Bug fixes
📚 Documentation
🤖 Dependencies
🧰 Maintenance
Full Changelog: slackapi/slack-github-action@v2.1.0...v2.1.1
v2.1.0: Slack Send v2.1.0Compare Source
What's changed
This release improves error messages from odd
payloadparsings. Anapioption is now also available in inputs to change the destination of data with themethodtechnique.Read more on the new site for documentation: https://tools.slack.dev/slack-github-action/
👾 Enhancements
🐛 Bug fixes
📚 Documentation
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.