Skip to content

chore(deps): bump the github-actions group across 1 directory with 10 updates - #94

Merged
kelly-sovacool merged 6 commits into
mainfrom
dependabot/github_actions/github-actions-7522502f15
Oct 8, 2026
Merged

chore(deps): bump the github-actions group across 1 directory with 10 updates#94
kelly-sovacool merged 6 commits into
mainfrom
dependabot/github_actions/github-actions-7522502f15

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the github-actions group with 10 updates in the / directory:

Package From To
actions/checkout 4 7
actions/setup-python 4 7
nf-core/setup-nextflow 1 3
actions/upload-artifact 4 7
nf-core/setup-nf-test 1 2
jlumbroso/free-disk-space 1.3.1 2.0.0
mikepenz/action-junit-report 3 6
CCBR/actions 0.5 0.7
actions/create-github-app-token 2 3
actions/add-to-project 1.0.2 2.0.0

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Commits

Updates actions/setup-python from 4 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

... (truncated)

Commits

Updates nf-core/setup-nextflow from 1 to 3

Release notes

Sourced from nf-core/setup-nextflow's releases.

v3.0.0

Breaking Change

  • Upgraded Node.js version from 20 to 24 (#219)

Added

  • secrets input to set Nextflow secrets (KEY=VALUE format, one per line) (#202)
  • Test to verify /dist is up-to-date
  • Pull request template
  • Contributing documentation

Changed

  • Updated ESLint to v9 with flat config format
  • Migrated codebase to ES Modules (ESM)
  • Simplified action.yml by flattening the composite action structure

v2.0.0

Added

  • renovate dependency automation bot (#41)

Changed

  • Upgraded GitHub Actions node version to v20 (#39)
  • GitHub Octokit API switched to nf-core custom API (#37)

v1.5.2

Added

  • CI workflow steps for better compatibility with https://github.com/nektos/act
  • Visual Studio Code debugging configuration
  • Husky pre-commit hooks for linting and formatting
  • Deprecation messages to warn users of upcoming API switch

v1.5.1

Changed

  • API calls are now lazy loaded to avoid making unnecessary calls (#33)

v1.5.0

Added

  • Throttling support to retry failed API calls (#31)

Changed

  • Octokit API calls refactored and separated from install script (#29)

... (truncated)

Changelog

Sourced from nf-core/setup-nextflow's changelog.

[1.5.1] - 2024-01-30

Changed

  • API calls are now lazy loaded to avoid making unnecessary calls (#33)

[1.5.0] - 2024-01-22

Added

  • Throttling support to retry failed API calls (#31)

Changed

  • Octokit API calls refactored and separated from install script (#29)

[1.4.0] - 2023-08-12

Changed

  • If fs.renameSync fails (e.g. because source and destination files are on different partitions), try fs.copySync and fs.unlinkSync instead (#14).
  • Fail instead of warn, when `nextflow help`` doesn't work (#23).

Fixed

  • Re-enable npm run test in CI (#15).

  • Fix release version check in unit test (#15).

  • Add helper function for checking the latest releases in the unit tests (#15).

[1.3.0] - 2023-05-19

Changed

  • Action now checks tool cache for installed version before querying Octokit (#5/#10)

[1.2.0] - 2022-10-29

Added

  • CAPSULE_LOG is now set to 'none' for less verbose setup logs (#1/#2)

Fixed

  • Release list now paginates the API to find old versions of Nextflow (#3)

[1.1.0] - 2022-06-15

Changed

... (truncated)

Commits

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates nf-core/setup-nf-test from 1 to 2

Release notes

Sourced from nf-core/setup-nf-test's releases.

v2.0.0

Breaking Change

  • Upgrade from node20 to node24

What's Changed

New Contributors

Full Changelog: nf-core/setup-nf-test@v1.3.6...v2.0.0

v1.3.6

What's Changed

Full Changelog: https://github.com/nf-core/setup-nf-test/commits/v1.3.6

v1.3.5

What's Changed

Full Changelog: https://github.com/nf-core/setup-nf-test/commits/v1.3.5

v1.3.4

What's Changed

Full Changelog: https://github.com/nf-core/setup-nf-test/commits/v1.3.4

v1.3.3

What's Changed

Full Changelog: https://github.com/nf-core/setup-nf-test/commits/v1.3.3

v1.3.2

What's Changed

Full Changelog: https://github.com/nf-core/setup-nf-test/commits/v1.3.2

v1.3.1

What's Changed

... (truncated)

Commits

Updates jlumbroso/free-disk-space from 1.3.1 to 2.0.0

Release notes

Sourced from jlumbroso/free-disk-space's releases.

v2.0.0 — three breaking changes, each with its reason

Breaking changes

  1. swap-storage now defaults to false. Closes #12 — reported and diagnosed by @​zaikunzhang, whose proposed documentation fallback became the new FAQ. Removing swap can kill a job under memory pressure with no error pointing back at the cleanup step; a default should not break something that elementary.
  2. tool-cache is renamed preinstalled-runtimes. The old name still works until v3.0.0 and prints a deprecation warning. (Its default is unchanged: false, as it has been since 2022.) The new name says what actually breaks when you enable it: the runtimes that actions/setup-node, setup-python, setup-go, and setup-ruby rely on.
  3. Specific options now override general ones. dotnet: false exempts .NET from every removal path, including large-packages. Fixes #33 — reported by @​ashleney; the overlap was first reported by @​gmij in #6, and @​ax3l explained the overlapping removal paths and a workaround. The policy is explicit, and this release applies it to .NET; future subject options add and test their own exemptions.

Upgrading from v1 to v2

Most workflows need no change.

  • If you set tool-cache:, rename it to preinstalled-runtimes:. The old name still works until v3.0.0 and prints a warning.
  • If you relied on swap being removed by default, add swap-storage: true. It now defaults to false, because removing swap can kill a job under memory pressure with no error pointing back here (#12).
  • If you set dotnet: false and were surprised that .NET was still removed, that is fixed — a specific option now overrides a general one (#33).

Also in this release

A README FAQ ("what are the possible side-effects of these settings?"), CONTRIBUTING.md, and a workflow example for running cleanup conditionally (#22). The reasons behind every design decision live in docs/adr/ — including ADR-0007, the record of this release's default change, written the day it was decided.

v1.3.2 — security fix and the decision records

Fixes the template-injection pattern in input handling (#51, by @​nbuckwalt).

Also adds docs/adr/ — the reasoning behind this action: why it exists, what it inherited from apache/flink and ShubhamTatvamasi, what it deliberately does not do, and what is still open.

No behaviour changes. The swap-storage default change ships in the next release.

Commits
  • ceedf09 docs: credit the contributors who reported the .NET overlap first, and narrow...
  • afeb5ad docs: state the deprecation horizon and add the v1→v2 migration note
  • a614499 docs: remove references to unreleased versions
  • 9881e8b fix: specific options override general ones — dotnet: false now keeps .NET ...
  • 654d8aa feat!: swap-storage defaults to false; tool-cache renamed to preinstalled-run...
  • 3f13fea docs: backfill the deliberative record (ADR-0001..0007)
  • a855e00 Merge pull request #51 from nbuckwalt/fix/cmd-exec-inputs-env-indirection
  • bcffc68 fix: use env var indirection for all boolean inputs to prevent CMD_EXEC
  • See full diff in compare view

Updates mikepenz/action-junit-report from 3 to 6

Release notes

Sourced from mikepenz/action-junit-report's releases.

v6

  • no changes

v5.6.2

🚀 Features

  • Add pr_id parameter to support PR comments from workflow_run contexts

📦 Dependencies

  • Upgrade dev dependencies

Contributors:

v5.6.1

🐛 Fixes

  • User server url from github.context

📦 Dependencies

  • Upgrade Dev Dependencies

Contributors:

v5.6.0

🚀 Features

  • Introduce support for multiple failures in a single test case
  • Add link to check in summary

📦 Dependencies

  • Update dev dependencies
  • Upgrade Dependencies

Contributors:

... (truncated)

Commits
  • a9170d5 chore(deps): update mikepenz/action-gh-release action to v3.1.0 (#1619)
  • efeb9fc Merge pull request #1617 from mikepenz/renovate/node-devdependency-non-major-...
  • b96a237 Merge pull request #1616 from mikepenz/renovate/js-yaml-5.x
  • e80da3b chore: rebuild dist for renovate
  • 1ede41f chore: sync js-yaml version between devDependencies and overrides
  • d0a2dbb chore: sync js-yaml version between devDependencies and overrides
  • e66f752 chore(deps): update node devdependency non-major updates
  • 07503e7 chore(deps): update dependency js-yaml to v5.3.0
  • 6efe830 chore(deps): update mikepenz/release-changelog-builder-action action to v6.2....
  • d9dc257 Merge pull request #1614 from mikepenz/renovate/nanoid-6.x
  • Additional commits viewable in compare view

Updates CCBR/actions from 0.5 to 0.7

Release notes

Sourced from CCBR/actions's releases.

actions 0.7.0

actions 0.6.2

actions 0.6.1

  • Fix changed-files: do not use pip cache with setup-python since the repo is not checked out. (#158, @​kelly-sovacool)
  • Fix forgotten actions that were missed when previously bumping to the latest versions in anticipation of the node.js 20 deprecation. (#159, @​kelly-sovacool)

actions 0.6.0

  • New action: changed-files to detect files that changed matching a pattern. (#152, @​kelly-sovacool)
    • Can compare the most recent commit only or the entire PR changes by setting the comparison-mode option. (#156, @​kelly-sovacool)
  • Bump actions versions to the latest release in anticipation of the node.js 20 deprecation. (#149, @​kelly-sovacool)
  • Improve build-docker example workflows to prevent excessive docker updates. (#153, @​kelly-sovacool)

actions 0.5.3

  • Improve maintain-milestones:

actions 0.5.2

actions 0.5.1

  • fix build-docker to properly use the path to the print versions script and support dockerfiles with entrypoints set. (#126, @​kelly-sovacool)
Changelog

Sourced from CCBR/actions's changelog.

actions development version

actions 0.8.0

New

Fixes

  • Clarify ccbr-actions-version behavior for containerized actions and document the CCBR_ACTIONS_VERSION build argument used by build-docker. (#221, @​kelly-sovacool, @​copilot)
  • Fixes for the draft-release action:
    • Fix draft-release to accept a manually provided version when conventional commits do not determine a version bump. (#213, @​kelly-sovacool, @​copilot)
    • Fix the draft-release example workflow docs (correct typo, Python 3.14, actions/checkout@v7) and rename examples/R-CMD-check.yaml to .yml so it appears in the published examples docs. (#215, @​kelly-sovacool)
    • Match the dev_header in draft-release changelogs case-insensitively so capitalized headers (e.g. ## Development version) are updated correctly. (#220, @​kelly-sovacool, @​copilot)
  • Set up testing infrastructure for github actions and related fixes: (#216, @​kelly-sovacool, @​copilot)
    • Includes host/container integration coverage, dry-run support for release actions, actionlint validation, and contract tests for example workflows.
    • Fix container detection in draft-release, post-release, changed-files, mkdocs-mike, and review-pre-commit-pr: the CCBR_ACTIONS_DOCKER variable baked into the ccbr_actions image is not visible to the env context, so Python/R setup steps (including cache: pip, which fails in container jobs) were still running inside the container. Detection now happens in a shell step whose output gates the setup steps. (#216, @​kelly-sovacool)
    • Fix build-docker: the push_success output now reports false when pushing is disabled. (#216, @​kelly-sovacool, @​copilot)
    • Fix draft-release and post-release: the dry-run input rendered as lowercase true/false in the Python step, raising NameError. (#216, @​kelly-sovacool, @​copilot)
    • New dry-run input for mkdocs-mike to print the mike deploy command instead of deploying the docs website. (#216, @​kelly-sovacool)

actions 0.7.2

  • New commands list-rulesets and copy-ruleset, plus a copy-ruleset action, for copying GitHub rulesets between repositories. (#183, @​kelly-sovacool, @​copilot)
  • Fix build-docker action: fix bash suffix conditional so an empty suffix (and main) leaves the docker tag unchanged. (#199, @​kelly-sovacool)

actions 0.7.1

actions 0.7.0

actions 0.6.2

... (truncated)

Commits
  • e3fa967 chore: 🤖 prepare release v0.7.2
  • b1aeb5b [pre-commit.ci] pre-commit autoupdate (#202)
  • 8ab4457 [pre-commit.ci] pre-commit autoupdate (#200)
  • d0554f4 chore: 🤖 sync copilot instructions - 2026-08-12 (#201)
  • 7a4ba8d chore(deps): bump the github-actions group across 10 directories with 10 upda...
  • dc53149 Merge pull request #193 from CCBR/pre-commit-ci-update-config
  • c08c012 fix(build-docker): handle empty suffix (#199)
  • 2593541 Merge branch 'main' into pre-comm...

    Description has been truncated

@dependabot
chore(deps): bump the github-actions group across 1 directory with 10…
78c797c 
… updates

Bumps the github-actions group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [actions/setup-python](https://github.com/actions/setup-python) | `4` | `7` |
| [nf-core/setup-nextflow](https://github.com/nf-core/setup-nextflow) | `1` | `3` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [nf-core/setup-nf-test](https://github.com/nf-core/setup-nf-test) | `1` | `2` |
| [jlumbroso/free-disk-space](https://github.com/jlumbroso/free-disk-space) | `1.3.1` | `2.0.0` |
| [mikepenz/action-junit-report](https://github.com/mikepenz/action-junit-report) | `3` | `6` |
| [CCBR/actions](https://github.com/ccbr/actions) | `0.5` | `0.7` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2` | `3` |
| [actions/add-to-project](https://github.com/actions/add-to-project) | `1.0.2` | `2.0.0` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v7)

Updates `actions/setup-python` from 4 to 7
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v4...v7)

Updates `nf-core/setup-nextflow` from 1 to 3
- [Release notes](https://github.com/nf-core/setup-nextflow/releases)
- [Changelog](https://github.com/nf-core/setup-nextflow/blob/master/CHANGELOG.md)
- [Commits](nf-core/setup-nextflow@v1...v3)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `nf-core/setup-nf-test` from 1 to 2
- [Release notes](https://github.com/nf-core/setup-nf-test/releases)
- [Commits](nf-core/setup-nf-test@v1...v2)

Updates `jlumbroso/free-disk-space` from 1.3.1 to 2.0.0
- [Release notes](https://github.com/jlumbroso/free-disk-space/releases)
- [Commits](jlumbroso/free-disk-space@54081f1...ceedf09)

Updates `mikepenz/action-junit-report` from 3 to 6
- [Release notes](https://github.com/mikepenz/action-junit-report/releases)
- [Commits](mikepenz/action-junit-report@v3...v6)

Updates `CCBR/actions` from 0.5 to 0.7
- [Release notes](https://github.com/ccbr/actions/releases)
- [Changelog](https://github.com/CCBR/actions/blob/main/CHANGELOG.md)
- [Commits](CCBR/actions@v0.5...v0.7)

Updates `actions/create-github-app-token` from 2 to 3
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@v2...v3)

Updates `actions/add-to-project` from 1.0.2 to 2.0.0
- [Release notes](https://github.com/actions/add-to-project/releases)
- [Commits](actions/add-to-project@v1.0.2...v2.0.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: nf-core/setup-nextflow
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: nf-core/setup-nf-test
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: jlumbroso/free-disk-space
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: mikepenz/action-junit-report
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: CCBR/actions
  dependency-version: '0.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/create-github-app-token
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/add-to-project
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 24, 2026
kelly-sovacool and others added 3 commits October 8, 2026 10:08
@kelly-sovacool
kelly-sovacool merged commit 64df12d into main Oct 8, 2026
7 of 8 checks passed
@kelly-sovacool
kelly-sovacool deleted the dependabot/github_actions/github-actions-7522502f15 branch October 8, 2026 14:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kelly-sovacool kelly-sovacool kelly-sovacool approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kelly-sovacool