chore(deps): bump @actions/cache to 6.2.0 - #771
Merged
HarithaVattikuti merged 4 commits intoJul 16, 2026
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR bumps the vendored @actions/cache client used by actions/setup-go from ^5.1.0 to ^5.2.0 and refreshes the dist/ bundles so the action ships the updated cache behavior at runtime.
Changes:
- Update
@actions/cachedependency to^5.2.0inpackage.json. - Lock
@actions/cacheto5.2.0inpackage-lock.json(incl. updated resolved URL + integrity). - Rebuild
dist/setupanddist/cache-savebundles to include the new cache-mode gating and “read denied” warning behavior from@actions/cache5.2.0.
Show a summary per file
| File | Description |
|---|---|
| package.json | Bumps @actions/cache dependency range to ^5.2.0. |
| package-lock.json | Locks @actions/cache to 5.2.0 and updates resolved/integrity metadata. |
| dist/setup/index.js | Updated bundled cache client code (cache-mode read/write gating; read-denied classification). |
| dist/cache-save/index.js | Updated bundled post-step cache client code to match the new cache behaviors. |
| .licenses/npm/@actions/cache.dep.yml | Updates the tracked third-party dependency version to 5.2.0. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/5 changed files
- Comments generated: 0
- Review effort level: Low
…p-actions-cache-5-2-0 # Conflicts: # .licenses/npm/@actions/cache.dep.yml # dist/cache-save/index.js # dist/setup/index.js # package-lock.json # package.json
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 290d6c74-496d-441c-bdbe-08fc907e0d44
philip-gai
changed the title
priyagupta108
approved these changes
Jul 16, 2026
priya-kinthali
approved these changes
Jul 16, 2026
HarithaVattikuti
approved these changes
Jul 16, 2026
eleboucher
pushed a commit
to eleboucher/runner-k8s-plugin
that referenced
this pull request
Jul 16, 2026
…(#84) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6.5.0` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) #### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) #### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItYWN0aW9uIiwidHlwZS9tYWpvciJdfQ==--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/runner-k8s-plugin/pulls/84
eleboucher
pushed a commit
to eleboucher/apoci
that referenced
this pull request
Jul 16, 2026
…(#141) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6.5.0` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) #### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) #### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItYWN0aW9uIiwidHlwZS9tYWpvciJdfQ==--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/apoci/pulls/141
eleboucher
pushed a commit
to eleboucher/talos-mcp
that referenced
this pull request
Jul 16, 2026
…(#22) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6.5.0` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) #### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) #### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItYWN0aW9uIiwidHlwZS9tYWpvciJdfQ==--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/talos-mcp/pulls/22
fossyy
added a commit
to fossyy/tunnel-please
that referenced
this pull request
Jul 19, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v7.0.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) ##### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> ### [`v7`](actions/setup-go@v6.5.0...v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTcuOSIsInVwZGF0ZWRJblZlciI6IjQzLjI1Ny45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.fossy.my.id/bagas/tunnel-please/pulls/160 Co-authored-by: Renovate-Clanker <renovate-bot@fossy.my.id> Co-committed-by: Renovate-Clanker <renovate-bot@fossy.my.id>
fossyy
added a commit
to fossyy/tunnel-please
that referenced
this pull request
Jul 19, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v7.0.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) ##### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> ### [`v7`](actions/setup-go@v6.5.0...v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTcuOSIsInVwZGF0ZWRJblZlciI6IjQzLjI1Ny45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.fossy.my.id/bagas/tunnel-please/pulls/161 Co-authored-by: Renovate-Clanker <renovate-bot@fossy.my.id> Co-committed-by: Renovate-Clanker <renovate-bot@fossy.my.id>
mergify Bot
added a commit
to ArcadeData/arcadedb
that referenced
this pull request
Jul 19, 2026
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. Release notes *Sourced from [actions/setup-go's releases](https://github.com/actions/setup-go/releases).* > v7.0.0 > ------ > > What's Changed > -------------- > > * Migrate to ESM and upgrade dependencies by [`@priyagupta108`](https://github.com/priyagupta108) in [actions/setup-go#763](https://redirect.github.com/actions/setup-go/pull/763) > * chore(deps): bump `@actions/cache` to 6.2.0 by [`@philip-gai`](https://github.com/philip-gai) in [actions/setup-go#771](https://redirect.github.com/actions/setup-go/pull/771) > > New Contributors > ---------------- > > * [`@philip-gai`](https://github.com/philip-gai) made their first contribution in [actions/setup-go#771](https://redirect.github.com/actions/setup-go/pull/771) > > **Full Changelog**: <actions/setup-go@v6...v7.0.0> Commits * [`b7ad1da`](actions/setup-go@b7ad1da) chore(deps): bump `@actions/cache` to 6.2.0 ([#771](https://redirect.github.com/actions/setup-go/issues/771)) * [`0778a10`](actions/setup-go@0778a10) Migrate to ESM and upgrade dependencies ([#763](https://redirect.github.com/actions/setup-go/issues/763)) * See full diff in [compare view](actions/setup-go@924ae3a...b7ad1da) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
scornet256
added a commit
to scornet256/go-logger
that referenced
this pull request
Jul 20, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v7.0.0...v7.0.0) #### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) #### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> ### [`v7`](actions/setup-go@v6.5.0...v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjMuNiIsInVwZGF0ZWRJblZlciI6IjQzLjI2My42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.simoncor.net/golang/logger/pulls/5
scornet256
added a commit
to scornet256/gogitlabber
that referenced
this pull request
Jul 20, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v7.0.0...v7.0.0) #### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) #### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> ### [`v7`](actions/setup-go@v6.5.0...v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjMuNiIsInVwZGF0ZWRJblZlciI6IjQzLjI2My42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.simoncor.net/golang/gogitlabber/pulls/5
pat-s
pushed a commit
to crowci/terraform-provider-crowci
that referenced
this pull request
Jul 20, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6.5.0` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) #### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) #### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 12:59 AM, only on Monday ( * 0 * * 1 ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4zMS4wIiwidXBkYXRlZEluVmVyIjoiNDMuMzEuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jeSDwn5Om77iPIl19--> Co-authored-by: crowci-bot <admin@crowci.dev> Reviewed-on: https://codefloe.com/crowci/terraform-provider-crowci/pulls/9
GiteaBot
pushed a commit
to go-gitea/terraform-provider-gitea
that referenced
this pull request
Jul 23, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v7.0.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) ##### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> ### [`v7`](actions/setup-go@v6.5.0...v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-go/releases/tag/v6.5.0) [Compare Source](actions/setup-go@v6.4.0...v6.5.0) #### What's Changed ##### Dependency update - Upgrade actions dependencies by [@​priyagupta108](https://github.com/priyagupta108) with [@​Copilot](https://github.com/Copilot) in [#​744](actions/setup-go#744) - Upgrade [@​types/node](https://github.com/types/node) and typescript-eslint dependencies to resolve npm audit findings by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​755](actions/setup-go#755) - Upgrade [@​actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@​jasongin](https://github.com/jasongin) in [#​758](actions/setup-go#758) - Upgrade version to 6.5.0 in package.json and package-lock.json by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​762](actions/setup-go#762) #### New Contributors - [@​priyagupta108](https://github.com/priyagupta108) with [@​Copilot](https://github.com/Copilot) made their first contribution in [#​744](actions/setup-go#744) - [@​jasongin](https://github.com/jasongin) made their first contribution in [#​758](actions/setup-go#758) **Full Changelog**: <actions/setup-go@v6...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-go/releases/tag/v6.4.0) [Compare Source](actions/setup-go@v6.3.0...v6.4.0) ##### What's Changed ##### Enhancement - Add go-download-base-url input for custom Go distributions by [@​gdams](https://github.com/gdams) in [#​721](actions/setup-go#721) ##### Dependency update - Upgrade minimatch from 3.1.2 to 3.1.5 by [@​dependabot](https://github.com/dependabot) in [#​727](actions/setup-go#727) ##### Documentation update - Rearrange README.md, add advanced-usage.md by [@​priyagupta108](https://github.com/priyagupta108) in [#​724](actions/setup-go#724) - Fix Microsoft build of Go link by [@​gdams](https://github.com/gdams) in [#​734](actions/setup-go#734) ##### New Contributors - [@​gdams](https://github.com/gdams) made their first contribution in [#​721](actions/setup-go#721) **Full Changelog**: <actions/setup-go@v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-go/releases/tag/v6.3.0) [Compare Source](actions/setup-go@v6.2.0...v6.3.0) ##### What's Changed - Update default Go module caching to use go.mod by [@​priyagupta108](https://github.com/priyagupta108) in [#​705](actions/setup-go#705) - Fix golang download url to go.dev by [@​178inaba](https://github.com/178inaba) in [#​469](actions/setup-go#469) **Full Changelog**: <actions/setup-go@v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-go/releases/tag/v6.2.0) [Compare Source](actions/setup-go@v6.1.0...v6.2.0) ##### What's Changed ##### Enhancements - Example for restore-only cache in documentation by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​696](actions/setup-go#696) - Update Node.js version in action.yml by [@​ccoVeille](https://github.com/ccoVeille) in [#​691](actions/setup-go#691) - Documentation update of actions/checkout by [@​deining](https://github.com/deining) in [#​683](actions/setup-go#683) ##### Dependency updates - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@​dependabot](https://github.com/dependabot) in [#​682](actions/setup-go#682) - Upgrade [@​actions/cache](https://github.com/actions/cache) to v5 by [@​salmanmkc](https://github.com/salmanmkc) in [#​695](actions/setup-go#695) - Upgrade actions/checkout from 5 to 6 by [@​dependabot](https://github.com/dependabot) in [#​686](actions/setup-go#686) - Upgrade qs from 6.14.0 to 6.14.1 by [@​dependabot](https://github.com/dependabot) in [#​703](actions/setup-go#703) ##### New Contributors - [@​ccoVeille](https://github.com/ccoVeille) made their first contribution in [#​691](actions/setup-go#691) - [@​deining](https://github.com/deining) made their first contribution in [#​683](actions/setup-go#683) **Full Changelog**: <actions/setup-go@v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-go/releases/tag/v6.1.0) [Compare Source](actions/setup-go@v6...v6.1.0) ##### What's Changed ##### Enhancements - Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by [@​nicholasngai](https://github.com/nicholasngai) in [#​665](actions/setup-go#665) - Add support for .tool-versions file and update workflow by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​673](actions/setup-go#673) - Add comprehensive breaking changes documentation for v6 by [@​mahabaleshwars](https://github.com/mahabaleshwars) in [#​674](actions/setup-go#674) ##### Dependency updates - Upgrade eslint-config-prettier from 10.0.1 to 10.1.8 and document breaking changes in v6 by [@​dependabot](https://github.com/dependabot) in [#​617](actions/setup-go#617) - Upgrade actions/publish-action from 0.3.0 to 0.4.0 by [@​dependabot](https://github.com/dependabot) in [#​641](actions/setup-go#641) - Upgrade semver and [@​types/semver](https://github.com/types/semver) by [@​dependabot](https://github.com/dependabot) in [#​652](actions/setup-go#652) ##### New Contributors - [@​nicholasngai](https://github.com/nicholasngai) made their first contribution in [#​665](actions/setup-go#665) - [@​priya-kinthali](https://github.com/priya-kinthali) made their first contribution in [#​673](actions/setup-go#673) - [@​mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#​674](actions/setup-go#674) **Full Changelog**: <actions/setup-go@v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/terraform-provider-gitea/pulls/181 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>
chhe
pushed a commit
to chhe/act_runner
that referenced
this pull request
Jul 23, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v7.0.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) ##### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> ### [`v7`](actions/setup-go@v6.5.0...v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-go/releases/tag/v6.5.0) [Compare Source](actions/setup-go@v6.4.0...v6.5.0) ##### What's Changed ##### Dependency update - Upgrade actions dependencies by [@​priyagupta108](https://github.com/priyagupta108) with [@​Copilot](https://github.com/Copilot) in [#​744](actions/setup-go#744) - Upgrade [@​types/node](https://github.com/types/node) and typescript-eslint dependencies to resolve npm audit findings by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​755](actions/setup-go#755) - Upgrade [@​actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@​jasongin](https://github.com/jasongin) in [#​758](actions/setup-go#758) - Upgrade version to 6.5.0 in package.json and package-lock.json by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​762](actions/setup-go#762) ##### New Contributors - [@​priyagupta108](https://github.com/priyagupta108) with [@​Copilot](https://github.com/Copilot) made their first contribution in [#​744](actions/setup-go#744) - [@​jasongin](https://github.com/jasongin) made their first contribution in [#​758](actions/setup-go#758) **Full Changelog**: <actions/setup-go@v6...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-go/releases/tag/v6.4.0) [Compare Source](actions/setup-go@v6.3.0...v6.4.0) ##### What's Changed ##### Enhancement - Add go-download-base-url input for custom Go distributions by [@​gdams](https://github.com/gdams) in [#​721](actions/setup-go#721) ##### Dependency update - Upgrade minimatch from 3.1.2 to 3.1.5 by [@​dependabot](https://github.com/dependabot) in [#​727](actions/setup-go#727) ##### Documentation update - Rearrange README.md, add advanced-usage.md by [@​priyagupta108](https://github.com/priyagupta108) in [#​724](actions/setup-go#724) - Fix Microsoft build of Go link by [@​gdams](https://github.com/gdams) in [#​734](actions/setup-go#734) ##### New Contributors - [@​gdams](https://github.com/gdams) made their first contribution in [#​721](actions/setup-go#721) **Full Changelog**: <actions/setup-go@v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-go/releases/tag/v6.3.0) [Compare Source](actions/setup-go@v6.2.0...v6.3.0) ##### What's Changed - Update default Go module caching to use go.mod by [@​priyagupta108](https://github.com/priyagupta108) in [#​705](actions/setup-go#705) - Fix golang download url to go.dev by [@​178inaba](https://github.com/178inaba) in [#​469](actions/setup-go#469) **Full Changelog**: <actions/setup-go@v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-go/releases/tag/v6.2.0) [Compare Source](actions/setup-go@v6.1.0...v6.2.0) ##### What's Changed ##### Enhancements - Example for restore-only cache in documentation by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​696](actions/setup-go#696) - Update Node.js version in action.yml by [@​ccoVeille](https://github.com/ccoVeille) in [#​691](actions/setup-go#691) - Documentation update of actions/checkout by [@​deining](https://github.com/deining) in [#​683](actions/setup-go#683) ##### Dependency updates - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@​dependabot](https://github.com/dependabot) in [#​682](actions/setup-go#682) - Upgrade [@​actions/cache](https://github.com/actions/cache) to v5 by [@​salmanmkc](https://github.com/salmanmkc) in [#​695](actions/setup-go#695) - Upgrade actions/checkout from 5 to 6 by [@​dependabot](https://github.com/dependabot) in [#​686](actions/setup-go#686) - Upgrade qs from 6.14.0 to 6.14.1 by [@​dependabot](https://github.com/dependabot) in [#​703](actions/setup-go#703) ##### New Contributors - [@​ccoVeille](https://github.com/ccoVeille) made their first contribution in [#​691](actions/setup-go#691) - [@​deining](https://github.com/deining) made their first contribution in [#​683](actions/setup-go#683) **Full Changelog**: <actions/setup-go@v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-go/releases/tag/v6.1.0) [Compare Source](actions/setup-go@v6...v6.1.0) ##### What's Changed ##### Enhancements - Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by [@​nicholasngai](https://github.com/nicholasngai) in [#​665](actions/setup-go#665) - Add support for .tool-versions file and update workflow by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​673](actions/setup-go#673) - Add comprehensive breaking changes documentation for v6 by [@​mahabaleshwars](https://github.com/mahabaleshwars) in [#​674](actions/setup-go#674) ##### Dependency updates - Upgrade eslint-config-prettier from 10.0.1 to 10.1.8 and document breaking changes in v6 by [@​dependabot](https://github.com/dependabot) in [#​617](actions/setup-go#617) - Upgrade actions/publish-action from 0.3.0 to 0.4.0 by [@​dependabot](https://github.com/dependabot) in [#​641](actions/setup-go#641) - Upgrade semver and [@​types/semver](https://github.com/types/semver) by [@​dependabot](https://github.com/dependabot) in [#​652](actions/setup-go#652) ##### New Contributors - [@​nicholasngai](https://github.com/nicholasngai) made their first contribution in [#​665](actions/setup-go#665) - [@​priya-kinthali](https://github.com/priya-kinthali) made their first contribution in [#​673](actions/setup-go#673) - [@​mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#​674](actions/setup-go#674) **Full Changelog**: <actions/setup-go@v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1102 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>
1 task
20 tasks
8 tasks
nickpell
added a commit
to cloudx-io/openarbiter
that referenced
this pull request
Aug 10, 2026
## Summary Weekly GitHub Actions ratchet review. The routine within-major bump (`mise run //:ratchet:update`) produced **no diff** this cycle — every pinned action is already at the newest release within its constrained major (checkout v7.0.1, mise-action v4.2.4, configure-aws-credentials v6.2.3, amazon-ecr-login v2.1.6, metadata-action v6.2.0, setup-qemu/buildx v4.2.0, build-push v7.3.0, upload-artifact v7.0.1, create-github-app-token v3.2.0). The only actual update available is a **new major for `actions/setup-go` (v6 → v7)**, so this PR performs that scoped upgrade (only `docker.yml` uses setup-go). ## What changes | Action | File | Before | After | Kind | |--------|------|--------|-------|------| | `actions/setup-go` | `.github/workflows/docker.yml` | `924ae3a` (`# ratchet:...@v6`) | `b7ad1da` (`# ratchet:...@v7`) | **major** v6 → v7 | No other refs changed. The `ratchet:upgrade` was scoped to `docker.yml` so the other pins there (already at their newest major) were left untouched. ## Risk assessment (based on changelog) **Overall risk: Low.** `actions/setup-go` v7.0.0 [release notes](https://github.com/actions/setup-go/releases/tag/v7.0.0) — two changes: - **Migrate to ESM and upgrade dependencies** ([#763](actions/setup-go#763)) — internal build/packaging change; no change to the action's inputs, outputs, or behavior. - **Bump `@actions/cache` to 6.2.0** ([#771](actions/setup-go#771)) — dependency update to the Go module caching backend. Key findings: - **Runtime unchanged**: `action.yml` `runs.using` is `node24` on **both** v6 and v7. The usual major-bump breaking risk (a node20 → node24 runtime jump) does **not** apply here. - **No input/output changes**: the `go-version: "1.26.0"` input we use is unaffected; no inputs were removed or renamed. - **Blast radius is limited**: setup-go is only used in the `docker.yml` build job; a regression would surface immediately as a failed Go build in that workflow and would not push anything (push is gated on `main`). - **Reversible**: pinned by SHA with a ratchet constraint comment; trivially revertable. Residual risk: the `@actions/cache` bump could theoretically alter cache hit/restore behavior, but a cache miss only slows a build, it doesn't break correctness. ## Verification checklist - [x] `mise run //:ratchet:update` → no diff (confirms all within-major pins current) - [x] `mise run //:ratchet:upgrade .github/workflows/docker.yml` → single-line change, setup-go only - [x] New SHA `b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` independently resolved from `actions/setup-go` tag `v7.0.0` - [x] Compared `action.yml` `runs.using` on v6 vs v7 → both `node24` (no runtime change) - [x] `mise run //:ratchet:lint` → passes - [x] `mise run //:ratchet:pin` → idempotent (no additional diff → CI "Verify pinning leaves no diff" will pass) - [ ] CI green on this PR (Go / lint / ratchet / docker build) - [ ] Confirm Docker Build job's Go build step succeeds with setup-go v7 <div><a href="https://cursor.com/agents/bc-c2be43b7-14de-4056-90e8-6eeb94710355?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/automations/7fea90df-8209-11f1-a7d1-d6b4613131ce"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/view-automation-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/view-automation-light.png"><img alt="View Automation" width="141" height="28" src="https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Nick Pellegrino <nickpell@users.noreply.github.com>
jvllmr
pushed a commit
to jvllmr/frans
that referenced
this pull request
Aug 10, 2026
…(#255) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6.5.0` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/setup-go (https://github.com/actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) ##### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDQuMyIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Reviewed-on: https://codeberg.org/jvllmr/frans/pulls/255
van-sprundel
pushed a commit
to Odeva-Labs/tax-conformance-kit
that referenced
this pull request
Aug 13, 2026
…(#23) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6.5.0` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/setup-go (https://github.com/actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](actions/setup-go@v7.0.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](actions/setup-go#763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](actions/setup-go#771) ##### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](actions/setup-go#771) **Full Changelog**: <actions/setup-go@v6...v7.0.0> ### [`v7`](actions/setup-go@v6.5.0...v7.0.0) [Compare Source](actions/setup-go@v6.5.0...v7.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDkuMyIsInVwZGF0ZWRJblZlciI6IjQzLjIwOS4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=--> Reviewed-on: https://codeberg.org/odeva/tax-conformance-kit/pulls/23
9 tasks
nickpell
pushed a commit
to cloudx-io/openauction
that referenced
this pull request
Aug 17, 2026
…to the v7 major (#56) ## Summary Weekly refresh of the SHA-pinned GitHub Actions refs under `.github/workflows/`. Two refs moved: - `jdx/mise-action` advanced to the newest release inside its existing `@v4` constraint, via `mise run //:ratchet:update`. - `actions/setup-go` moved to the **v7 major**, which rewrites the `# ratchet:` constraint comment. `ratchet update` deliberately will not do this, so it was done as a separate, intentional step with `mise run //:ratchet:upgrade .github/workflows/docker.yml` after reviewing the upstream release notes. Rationale below. Each change is a separate commit. The diff touches only action SHAs and their `# ratchet:` constraint comments. ## Refs that moved | Action | Files | Constraint | Version from → to | SHA from → to | |---|---|---|---|---| | `jdx/mise-action` | `.github/workflows/go.yml`, `.github/workflows/ratchet.yml` | `@v4` (unchanged) | v4.2.4 → v4.2.5 | `7e36c90d9ab29c415a2384db3006f3ec8a8cc654` → `3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518` | | `actions/setup-go` | `.github/workflows/docker.yml` | `@v6` → `@v7` (rewritten) | v6.5.0 → v7.0.0 | `924ae3a1cded613372ab5595356fb5720e22ba16` → `b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` | The remaining nine pinned actions were already at the newest release within their constraints and are unchanged: `actions/checkout` (v7.0.1), `actions/upload-artifact` (v7.0.1), `actions/create-github-app-token` (v3.2.0), `aws-actions/configure-aws-credentials` (v6.2.3), `aws-actions/amazon-ecr-login` (v2), `docker/metadata-action` (v6.2.0), `docker/setup-qemu-action` (v4.2.0), `docker/setup-buildx-action` (v4.2.0), and `docker/build-push-action` (v7.3.0). After this change no pinned action has a newer major available upstream, so no major is being held back. ## Upstream changelog ### jdx/mise-action v4.2.5 — patch, not breaking [v4.2.5, "Resilient mise downloads with automatic retries"](https://github.com/jdx/mise-action/releases/tag/v4.2.5) (published 2026-08-13). The download helpers previously made a single `curl` or `wget` attempt, so a transient release-asset HTTP or TLS failure aborted setup before mise or any user command could run. Downloads now go through a retry wrapper of up to five attempts with a 2s pause, covering binary, checksum, signature, and version fetches. Checksum and minisign verification still run only after a successful download, never inside the retry loop, so integrity guarantees are unchanged. Comparison: [v4.2.4...v4.2.5](jdx/mise-action@v4.2.4...v4.2.5). ### actions/setup-go v7.0.0 — major, no consumer-facing behavior change [v7.0.0](https://github.com/actions/setup-go/releases/tag/v7.0.0) (published 2026-07-16) contains exactly two commits: "Migrate to ESM and upgrade dependencies" ([#763](actions/setup-go#763)) and "chore(deps): bump @actions/cache to 6.2.0" ([#771](actions/setup-go#771)). Upstream's README adds a "What's new in V7" section stating the release "Migrated action internals to ESM for compatibility with latest `@actions/*` packages. No changes to action inputs, outputs, or behavior." That claim was checked against the [v6.5.0...v7.0.0 comparison](actions/setup-go@v6.5.0...v7.0.0): - `action.yml` is byte-identical between v6.5.0 and v7.0.0 — the same inputs (`go-version`, `go-version-file`, `check-latest`, `token`, `cache`, `cache-dependency-path`, `architecture`, `go-download-base-url`), the same outputs (`go-version`, `cache-hit`), and the same `node24` runtime with unchanged `main` and `post` entry points. The major number reflects the internal module-system migration, not a change to the action's contract. - The `src/` diff is ESM plumbing: import specifiers gain `.js` extensions, the problem-matcher path moves from `__dirname` to `import.meta.url`, `getVersionsDist` is extracted into its own module to replace a `module.exports` indirection that ESM does not support, and two download errors now propagate `cause`. - `@actions/cache` 6.2.0 is a minor bump of the cache client. Per upstream #771 it surfaces a non-fatal warning when the cache service denies a cache read due to token scopes, mirroring the existing cache-write-denied handling. No open upstream issue reports a v7 regression. ## Risk assessment Both changes only alter which commit of an external action a workflow step resolves to. No workflow logic, inputs, permissions, triggers, or repository code change. **`jdx/mise-action` v4.2.4 → v4.2.5 — low risk, covered by PR CI.** A patch release that adds retries around mise downloads. It is used by the `Go` workflow (test and lint jobs) and the `Ratchet` workflow, both of which run on `pull_request`, so the checks on this PR exercise the new pin directly. The change makes setup strictly more tolerant of transient network failures, and download verification is unchanged. **`actions/setup-go` v6.5.0 → v7.0.0 — low risk, but not covered by PR CI.** The evidence above shows the release is an internal refactor with an unchanged interface, and the step in `docker.yml` passes only `go-version: "1.26.5"`, an input v7 keeps. The `@actions/cache` change is additive and explicitly non-fatal, and this step sets no cache inputs. The caveat worth reviewer attention is coverage, not the release itself: `setup-go` is used only in `.github/workflows/docker.yml`, which triggers on `workflow_run` after the `Go` workflow completes and on `workflow_dispatch`. It does not run on pull requests, so a green check here does not prove the v7 pin works. The first real exercise is the `Docker Build` run after this merges to `main`. A failure would surface as a build-time error in that workflow (Go toolchain setup or the enclave `go build`), visible immediately and reversible by restoring the previous SHA and `@v6` constraint. No auction or enclave runtime behavior is involved. ## Verification performed - `mise run //:ratchet:update` — moved `jdx/mise-action` only; re-run after the setup-go upgrade, it produces no further change. - `mise run //:ratchet:lint` — passes; every external ref is SHA-pinned. - `mise run //:ratchet:pin` followed by `git diff --exit-code` — clean, matching the gate in the `Ratchet` workflow. - Every pinned ref was resolved through the GitHub tags API to confirm the pinned SHA equals the commit its `# ratchet:` constraint resolves to, and that both moved SHAs match their release tags. ## Pre-merge checklist - [x] `mise run //:ratchet:update` produces no further changes - [x] `mise run //:ratchet:lint` passes - [x] `mise run //:ratchet:pin` is idempotent — leaves no diff - [x] Diff contains only action SHA pins and `# ratchet:` constraint comments, with no unrelated workflow edits - [x] Both moved SHAs confirmed against their upstream release tags - [x] Upstream release notes reviewed for both moved refs, including the v7 major - [x] PR CI green, including `Ratchet Lint` ## Post-merge verification - [ ] Workflows on `main` resolve to the new pins: `jdx/mise-action@3c2e0cf` and `actions/setup-go@b7ad1da` - [ ] The next `Docker Build` run on `main` succeeds with `setup-go` v7 — the only path that exercises that pin, since `docker.yml` does not run on pull requests <div><a href="https://cursor.com/agents/bc-af74e51e-a962-4d00-aae9-bac178b51f29?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/automations/65e8572f-8209-11f1-a7d1-d6b4613131ce"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/view-automation-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/view-automation-light.png"><img alt="View Automation" width="141" height="28" src="https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/view-automation-dark.png"><source](https://cursor.com/assets/images/view-automation-dark.png"><source){kind=link}
![https://cursor.com/assets/images/view-automation-light.png"><img](https://cursor.com/assets/images/view-automation-light.png"><img){kind=link}
![https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div](https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div){kind=link}
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Bumps
@actions/cachefrom^6.1.0to^6.2.0and rebuilds the vendoreddist/bundles.@actions/cachedependency to^6.2.0inpackage.jsonand lock it to6.2.0inpackage-lock.json.dist/setupanddist/cache-savebundles via ncc so they embed the 6.2.0 client code..licenses/npm/@actions/cache.dep.ymlrecord to 6.2.0 (LICENSE text is byte-identical to 6.1.0).@actions/cache6.2.0 ships new client behavior transparently to this action: it surfaces a non-fatal warning when the cache service denies a cache read due to token scopes, matching the existing cache-write-denied handling.Related issue:
N/A
Check list: