🚨 Update github actions to v7 (main) by renovate[bot] · Pull Request #233 · conforma/user-guide

renovate · 2026-02-27T02:47:02Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v6.0.2` → `v7.0.1`
actions/upload-artifact	action	major	`v6.0.0` → `v7.0.1`

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.1.0`

Compare Source

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

actions/upload-artifact (actions/upload-artifact)

`v7.0.1`

Compare Source

What's Changed

Update the readme with direct upload details by @danwkennedy in #795
Readme: bump all the example versions to v7 by @danwkennedy in #796
Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in #797

Full Changelog: actions/upload-artifact@v7...v7.0.1

`v7.0.0`

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in #754
Upgrade the module to ESM and bump dependencies by @danwkennedy in #762
Support direct file uploads by @danwkennedy in #764

New Contributors

@Link- made their first contribution in #754

Full Changelog: actions/upload-artifact@v6...v7.0.0

`v7`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fullsend-ai-review · 2026-07-12T10:15:20Z

🤖 Finished Review · ✅ Success · Started 10:15 AM UTC · Completed 10:20 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-07-12T10:20:03Z

Review — Approve ✅

Summary

This Renovate bot PR updates two GitHub Actions in .github/workflows/scorecards.yml from v6 to v7 (major version bumps):

Action	Old Version	New Version
`actions/checkout`	`v6.0.2` (`de0fac2...`)	`v7.0.1` (`3d3c42e...`)
`actions/upload-artifact`	`v6.0.0` (`b7c566a...`)	`v7.0.1` (`043fb46...`)

Verification

✅ SHA integrity: Both commit SHAs verified against their respective GitHub tags via the GitHub API — they match the claimed versions exactly.
✅ Official actions: Both are first-party GitHub Actions from the actions organization.
✅ Pin format: Actions remain pinned to full commit SHAs with version comments, following supply-chain security best practices.

Breaking Change Analysis

actions/checkout v7: Key change is blocking fork PR checkout for pull_request_target and workflow_run events. This workflow only triggers on branch_protection_rule, schedule, and push — not affected.
actions/upload-artifact v7: Adds optional archive parameter for direct file uploads (defaults to true, backward compatible) and ESM upgrade. The workflow's existing usage of name, path, and retention-days inputs is fully compatible.

Dimensions Reviewed

Dimension	Result
Correctness	✅ Version pins are accurate; workflow inputs are compatible with v7
Security	✅ Full SHA pinning maintained; official actions; checkout v7 adds security hardening
Intent & coherence	✅ Standard automated dependency update, appropriately scoped
Style/conventions	✅ Follows existing `@<sha> # v<version>` format
Documentation	✅ No documentation impact for CI config changes
Cross-repo contracts	✅ No external API or interface changes

No findings above the reporting threshold.

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/scorecards.yml

Previous run

Review — approve

PR: #233 — 🚨 Update github actions to v7 (main)
Author: renovate[bot]
Scope: 1 file changed (.github/workflows/scorecards.yml), 2 additions, 2 deletions

Summary

This PR updates two SHA-pinned GitHub Actions in the OpenSSF Scorecard workflow from v6 to v7:

Action	Old	New
`actions/checkout`	`v6.0.2` (`de0fac2e...`)	`v7.0.0` (`9c091bb2...`)
`actions/upload-artifact`	`v6.0.0` (`b7c566a7...`)	`v7.0.1` (`043fb46d...`)

Dimension results

Dimension	Result
Correctness	✅ No issues — SHA pins verified against GitHub API; both resolve to claimed tags. No breaking changes affect this workflow's triggers (`push`/`schedule`/`branch_protection_rule`) or inputs (`persist-credentials: false`, `name`/`path`/`retention-days`).
Security	✅ No issues — Permissions block unchanged (`read-all` top-level, scoped job permissions). No injection surfaces (no expression interpolation of user-controlled inputs). `persist-credentials: false` retained. `actions/checkout` v7's fork-blocking change is not relevant (workflow does not use `pull_request_target` or `workflow_run`).
Intent & coherence	✅ Mechanical dependency bump by Renovate bot — authorization implicit.
Style & conventions	✅ New lines follow the existing `owner/action@full-sha # version-comment` pinning pattern.
Docs currency	✅ CI workflow change — no documentation impact.
Cross-repo contracts	⏭ Skipped — no exported interfaces modified.

Verdict

Approve. Clean, mechanical dependency version bump. Both SHA pins are verified authentic, no breaking changes affect this workflow, and permissions are unchanged.

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/scorecards.yml

fullsend-ai-review · 2026-07-20T18:54:36Z

🤖 Finished Review · ✅ Success · Started 6:54 PM UTC · Completed 6:57 PM UTC
Commit: 87c4a29 · View workflow run →

renovate Bot added main major renovate labels Feb 27, 2026

github-actions Bot added the size: XS label Feb 27, 2026

renovate Bot force-pushed the renovate/main-major-github-actions branch from f856c89 to 8a140ee Compare April 10, 2026 18:06

renovate Bot changed the title ~~🚨 Update actions/upload-artifact action to v7 (main)~~ 🚨 Update github actions to v7 (main) Jun 2, 2026

renovate Bot force-pushed the renovate/main-major-github-actions branch from 8a140ee to 22bd5ef Compare June 18, 2026 21:43

renovate Bot force-pushed the renovate/main-major-github-actions branch from 22bd5ef to 4590e0b Compare July 12, 2026 10:14

fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Jul 12, 2026

🚨 Update github actions to v7

a3fb02a

renovate Bot force-pushed the renovate/main-major-github-actions branch from 4590e0b to a3fb02a Compare July 20, 2026 18:53

fullsend-ai-review Bot added requires-manual-review Review requires human judgment and removed requires-manual-review Review requires human judgment labels Jul 20, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🚨 Update github actions to v7 (main)#233

🚨 Update github actions to v7 (main)#233
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-major-github-actions

renovate Bot commented Feb 27, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Jul 12, 2026 •

edited

Loading

Review — approve

Summary

Dimension results

Verdict

Uh oh!

fullsend-ai-review Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

Configuration

Uh oh!

fullsend-ai-review Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review — Approve ✅

Summary

Verification

Breaking Change Analysis

Dimensions Reviewed

Review — approve

Summary

Dimension results

Verdict

Uh oh!

fullsend-ai-review Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Feb 27, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 12, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 12, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 20, 2026 •

edited

Loading