chore(deps): update github-actions (maint-28) (major) #9957

renovate-bot · 2025-06-17T09:06:01Z

This PR contains the following updates:

Package	Type	Update	Change
Vampire/setup-wsl	action	major	`v5.0.1` -> `v6.0.0`
actions/attest-sbom	action	major	`v2` -> `v3`
actions/checkout	action	major	`v4.2.2` -> `v5.0.0`
actions/checkout	action	major	`v4` -> `v5`
actions/download-artifact	action	major	`v4.3.0` -> `v6.0.0`
actions/download-artifact	action	major	`v4` -> `v6`
actions/github-script	action	major	`v7.0.1` -> `v8.0.0`
actions/upload-artifact	action	major	`v4.6.2` -> `v5.0.0`
actions/upload-artifact	action	major	`v4` -> `v5`
github/codeql-action	action	major	`v3.29.7` -> `v4.31.2`
windows	github-runner	major	`2022` -> `2025`

Release Notes

Vampire/setup-wsl (Vampire/setup-wsl)

`v6.0.0`

Compare Source

Highlights

Update of Debian distribution if configured is now retried up to 4 times, as the package servers became less stable.

Breaking Changes

The action now always uses WSLv2 as the default WSL
version. Before it used WSLv1 if only that was available
whcih mainly was for the decommissioned windows-2019 runner images.

Details

Make Gradle Wrapper scripts executable [af172e2]
Remove tests on windows-2019 which was decommissioned [cbf3871]
Increase version to 6.0.0 [c0fd238]
Always use WSLv2 as default WSL version [e840292]
Install zstd before restoring cache on windows-11-arm to get same cache version [b87f2eb]
Run WSL update only on windows-2022, not windows-11-arm [c498099]
Retry up to 4 times to update Debian packages (#75) [442f98c]

actions/attest-sbom (actions/attest-sbom)

`v3`

Compare Source

actions/checkout (actions/checkout)

`v5.0.0`

Compare Source

What's Changed

Update actions checkout to use node 24 by @salmanmkc in #2226
Prepare v5.0.0 release by @salmanmkc in #2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

`v4.3.0`

Compare Source

What's Changed

docs: update README.md by @motss in #1971
Add internal repos for checking out multiple repositories by @mouismail in #1977
Documentation update - add recommended permissions to Readme by @benwells in #2043
Adjust positioning of user email note and permissions heading by @joshmgross in #2044
Update README.md by @nebuk89 in #2194
Update CODEOWNERS for actions by @TingluoHuang in #2224
Update package dependencies by @salmanmkc in #2236
Prepare release v4.3.0 by @salmanmkc in #2237

New Contributors

@motss made their first contribution in #1971
@mouismail made their first contribution in #1977
@benwells made their first contribution in #2043
@nebuk89 made their first contribution in #2194
@salmanmkc made their first contribution in #2236

Full Changelog: actions/checkout@v4...v4.3.0

actions/download-artifact (actions/download-artifact)

`v6.0.0`

Compare Source

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

Update README for download-artifact v5 changes by @yacaovsnc in #417
Update README with artifact extraction details by @yacaovsnc in #424
Readme: spell out the first use of GHES by @danwkennedy in #431
Bump @actions/artifact to v4.0.0
Prepare v6.0.0 by @danwkennedy in #438

New Contributors

@danwkennedy made their first contribution in #431

Full Changelog: actions/download-artifact@v5...v6.0.0

`v5.0.0`

Compare Source

What's Changed

Update README.md by @nebuk89 in #407
BREAKING fix: inconsistent path behavior for single artifact downloads by ID by @GrantBirki in #416

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

By name: name: my-artifact → extracted to path/ (direct)
By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

By name: name: my-artifact → extracted to path/ (unchanged)
By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:

You download artifacts by name
You download multiple artifacts by ID
You already use merge-multiple: true as a workaround

⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist

### Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

- uses: actions/download-artifact@v5
  with:
    artifact-ids: 12345
    path: dist/my-artifact  # Explicitly specify the nested path

New Contributors

@nebuk89 made their first contribution in #407

Full Changelog: actions/download-artifact@v4...v5.0.0

actions/github-script (actions/github-script)

`v8.0.0`

Compare Source

`v7.1.0`

Compare Source

What's Changed

Upgrade husky to v9 by @benelan in #482
Add workflow file for publishing releases to immutable action package by @Jcambass in #485
Upgrade IA Publish by @Jcambass in #486
Fix workflow status badges by @joshmgross in #497
Update usage of actions/upload-artifact by @joshmgross in #512
Clear up package name confusion by @joshmgross in #514
Update dependencies with npm audit fix by @joshmgross in #515
Specify that the used script is JavaScript by @timotk in #478
chore: Add Dependabot for NPM and Actions by @nschonni in #472
Define permissions in workflows and update actions by @joshmgross in #531
chore: Add Dependabot for .github/actions/install-dependencies by @nschonni in #532
chore: Remove .vscode settings by @nschonni in #533
ci: Use github/setup-licensed by @nschonni in #473
make octokit instance available as octokit on top of github, to make it easier to seamlessly copy examples from GitHub rest api or octokit documentations by @iamstarkov in #508
Remove octokit README updates for v7 by @joshmgross in #557
docs: add "exec" usage examples by @neilime in #546
Bump ruby/setup-ruby from 1.213.0 to 1.222.0 by @dependabot[bot] in #563
Bump ruby/setup-ruby from 1.222.0 to 1.229.0 by @dependabot[bot] in #575
Clearly document passing inputs to the script by @joshmgross in #603
Update README.md by @nebuk89 in #610

New Contributors

@benelan made their first contribution in #482
@Jcambass made their first contribution in #485
@timotk made their first contribution in #478
@iamstarkov made their first contribution in #508
@neilime made their first contribution in #546
@nebuk89 made their first contribution in #610

Full Changelog: actions/github-script@v7...v7.1.0

actions/upload-artifact (actions/upload-artifact)

`v5.0.0`

Compare Source

github/codeql-action (github/codeql-action)

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.9 - 17 Oct 2025

Update default CodeQL bundle version to 2.23.3. #3205
Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

See the full CHANGELOG.md for more information.

`v4.30.8`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v4.30.7`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.7 - 06 Oct 2025

[v4+ only] The CodeQL Action now runs on Node.js v24. #3169

See the full CHANGELOG.md for more information.

`v3.31.2`

Compare Source

`v3.31.1`

Compare Source

`v3.31.0`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.0 - 24 Oct 2025

Bump minimum CodeQL bundle version to 2.17.6. #3223
When SARIF files are uploaded by the analyze or upload-sarif actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the upload-sarif action. For analyze, this may affect Advanced Setup for CodeQL users who specify a value other than always for the upload input. #3222

See the full CHANGELOG.md for more information.

`v3.30.9`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.9 - 17 Oct 2025

Update default CodeQL bundle version to 2.23.3. #3205
Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

See the full CHANGELOG.md for more information.

`v3.30.8`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.30.7`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.7 - 06 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.30.6`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025

Update default CodeQL bundle version to 2.23.2. #3168

See the full CHANGELOG.md for more information.

`v3.30.5`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.5 - 26 Sep 2025

We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

See the full CHANGELOG.md for more information.

`v3.30.4`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.4 - 25 Sep 2025

We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100
We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107
You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130
Update default CodeQL bundle version to 2.23.1. #3118

See the full CHANGELOG.md for more information.

`v3.30.3`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.3 - 10 Sep 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.30.2`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.2 - 09 Sep 2025

Fixed a bug which could cause language autodetection to fail. #3084
Experimental: The quality-queries input that was added in 3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new analysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. #3064

See the full CHANGELOG.md for more information.

`v3.30.1`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.1 - 05 Sep 2025

Update default CodeQL bundle version to 2.23.0. #3077

See the full CHANGELOG.md for more information.

`v3.30.0`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.0 - 01 Sep 2025

Reduce the size of the CodeQL Action, speeding up workflows by approximately 4 seconds. #3054

See the full CHANGELOG.md for more information.

`v3.29.11`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.11 - 21 Aug 2025

Update default CodeQL bundle version to 2.22.4. #3044

See the full CHANGELOG.md for more information.

`v3.29.10`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.10 - 18 Aug 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.29.9`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.9 - 12 Aug 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.29.8`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.8 - 08 Aug 2025

Fix an issue where the Action would autodetect unsupported languages such as HTML. #3015

See the full CHANGELOG.md for more information.

Configuration

📅 Schedule: Branch creation - "after 2am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

CLAassistant · 2025-06-17T09:06:09Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

github-actions · 2025-06-17T12:51:12Z

CT Test Results

1 files 11 suites 2m 57s ⏱️
95 tests 91 ✅ 4 💤 0 ❌
111 runs 107 ✅ 4 💤 0 ❌

Results for commit eb5afdf.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

paulo-ferraz-oliveira · 2025-06-24T23:38:30Z

@kikofernandez, will this mean that you'll start publishing for Windows 2025, too? I can't remember what the issue was but we weren't able to support that version next to https://github.com/erlef/setup-beam.

kikofernandez · 2025-10-23T14:00:31Z

@kikofernandez, will this mean that you'll start publishing for Windows 2025, too? I can't remember what the issue was but we weren't able to support that version next to https://github.com/erlef/setup-beam.

Sorry for the huge delay. If possible, yes, simply because we want to use an up-to-date GH Action.

forking-renovate bot added the team:VM Assigned to OTP team VM label Jun 17, 2025

forking-renovate bot assigned garazdawi and kikofernandez Jun 17, 2025

garazdawi removed their assignment Jun 17, 2025

kikofernandez previously approved these changes Jun 18, 2025

View reviewed changes

renovate-bot changed the title ~~chore(deps): update dependency windows to v2025 (maint-28)~~ chore(deps): update github-actions (maint-28) (major) Jul 3, 2025

renovate-bot dismissed kikofernandez’s stale review via 9ead5ad July 3, 2025 08:41

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch 2 times, most recently from 9ead5ad to ca0a027 Compare July 3, 2025 15:23

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from ca0a027 to 073fd2a Compare July 28, 2025 14:04

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch 4 times, most recently from dbd1556 to f40a998 Compare August 11, 2025 11:37

kikofernandez mentioned this pull request Aug 11, 2025

adds nsis to windows-2025 #10092

Open

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from f40a998 to 850cca7 Compare August 11, 2025 13:28

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch 2 times, most recently from 5b68c73 to c14de24 Compare September 4, 2025 17:27

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from c14de24 to cfaf8d0 Compare September 17, 2025 07:37

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch 2 times, most recently from dff636e to 8b3efb3 Compare October 10, 2025 18:16

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from 8b3efb3 to 0138442 Compare October 17, 2025 21:57

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch 2 times, most recently from 4ffca5a to 91fae4d Compare October 30, 2025 13:38

chore(deps): update github-actions

eb5afdf

renovate-bot force-pushed the renovate/maint-28-major-github-actions branch from 91fae4d to eb5afdf Compare October 30, 2025 16:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update github-actions (maint-28) (major) #9957

chore(deps): update github-actions (maint-28) (major) #9957

Uh oh!

renovate-bot commented Jun 17, 2025 •

edited

Loading

Uh oh!

CLAassistant commented Jun 17, 2025

Uh oh!

github-actions bot commented Jun 17, 2025 •

edited

Loading

Uh oh!

paulo-ferraz-oliveira commented Jun 24, 2025

Uh oh!

kikofernandez commented Oct 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

chore(deps): update github-actions (maint-28) (major) #9957

Are you sure you want to change the base?

chore(deps): update github-actions (maint-28) (major) #9957

Uh oh!

Conversation

renovate-bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Highlights

Breaking Changes

Details

What's Changed

⚠️ Minimum Compatible Runner Version

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

v5.0.0

🚨 Breaking Change

What Changed

Migration Guide

✅ No Action Needed If:

⚠️ Action Required If:

New Contributors

What's Changed

New Contributors

CodeQL Action Changelog

4.30.9 - 17 Oct 2025

CodeQL Action Changelog

4.30.8 - 10 Oct 2025

CodeQL Action Changelog

4.30.7 - 06 Oct 2025

CodeQL Action Changelog

3.31.0 - 24 Oct 2025

CodeQL Action Changelog

3.30.9 - 17 Oct 2025

CodeQL Action Changelog

3.30.8 - 10 Oct 2025

CodeQL Action Changelog

3.30.7 - 06 Oct 2025

CodeQL Action Changelog

3.30.6 - 02 Oct 2025

CodeQL Action Changelog

3.30.5 - 26 Sep 2025

CodeQL Action Changelog

3.30.4 - 25 Sep 2025

CodeQL Action Changelog

3.30.3 - 10 Sep 2025

CodeQL Action Changelog

3.30.2 - 09 Sep 2025

CodeQL Action Changelog

3.30.1 - 05 Sep 2025

CodeQL Action Changelog

3.30.0 - 01 Sep 2025

CodeQL Action Changelog

3.29.11 - 21 Aug 2025

CodeQL Action Changelog

3.29.10 - 18 Aug 2025

CodeQL Action Changelog

3.29.9 - 12 Aug 2025

CodeQL Action Changelog

3.29.8 - 08 Aug 2025

Configuration

Uh oh!

CLAassistant commented Jun 17, 2025

Uh oh!

github-actions bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CT Test Results

Artifacts

Uh oh!

paulo-ferraz-oliveira commented Jun 24, 2025

Uh oh!

kikofernandez commented Oct 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

renovate-bot commented Jun 17, 2025 •

edited

Loading

github-actions bot commented Jun 17, 2025 •

edited

Loading