deps: bump the github-actions group with 3 updates#2
Conversation
Bumps the github-actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [actions/setup-node](https://github.com/actions/setup-node) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Updates `actions/checkout` from 4 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) Updates `actions/setup-node` from 4 to 6 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v6) Updates `softprops/action-gh-release` from 2 to 3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@v2...v3) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
📝 WalkthroughWalkthroughThis pull request updates GitHub Actions across the project's CI and release workflows. The CI workflow bumps ChangesGitHub Actions Version Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 18-20: Update the setup-node@v6 step in the release workflow to
explicitly enable npm caching and point to the correct lockfile: add with keys
"cache: npm" and "cache-dependency-path: apps/frilvault/package-lock.json" to
the setup-node@v6 configuration, and ensure the subsequent install step runs
"npm ci" from the apps/frilvault directory (e.g. by setting the
working-directory or running npm ci --prefix apps/frilvault) so caching is
applied correctly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2c83c323-f517-44b6-a19b-55ba21b6a161
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/release.yml
| - uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: 22 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
actions/setup-node v6 cache behavior npm
💡 Result:
In actions/setup-node v6, caching for npm is now enabled automatically by default [1][2]. Key aspects of this behavior include: Automatic Activation: The action automatically detects your package manager. If your package.json contains either a top-level packageManager field or a devEngines.packageManager field set to npm, caching will be enabled without requiring the cache input [1][2]. Control via Input: This automatic behavior is controlled by the package-manager-cache input, which defaults to true [2][3]. You can explicitly disable this automatic caching by setting package-manager-cache: false [1][4]. Mechanism: Under the hood, the action uses actions/cache to cache the global npm cache directory (rather than node_modules) [4][5]. It relies on your lockfile (e.g., package-lock.json) to generate a unique hash for the cache key [4][6]. For optimal results in CI, it is recommended to use npm ci rather than npm install, as npm ci is designed to work directly with the lockfile and will benefit from the restored global cache [6][7]. Security: For workflows involving elevated privileges or access to sensitive information, it is recommended to set package-manager-cache: false if caching is not explicitly required for your operation [1][8]. Note on Lockfiles: The caching feature requires a lockfile to generate a cache key. If you do not use a lockfile, you should explicitly disable caching to avoid errors or unexpected behavior [4].
Citations:
- 1: https://github.com/actions/setup-node/blob/v6/README.md
- 2: https://github.com/actions/setup-node/tree/refs/heads/main
- 3: https://github.com/actions/setup-node
- 4: https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md
- 5: https://git.cxtech.cc/actions/setup-node/src/commit/7d8f743c059f1e87e3a0014017e4955e76a2dc46/README.md
- 6: https://dev.to/akaranjkar08/github-actions-cicd-build-a-complete-nodejs-pipeline-2026-150
- 7: https://dev.to/sohanaakbar7/docker-caching-strategies-that-actually-work-with-npm-ci-4ja4
- 8: https://github.com/marketplace/actions/setup-node-js-environment
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== release.yml (relevant section) ==="
nl -ba .github/workflows/release.yml | sed -n '1,120p'
echo "=== ci.yml (find setup-node@v6 cache config) ==="
if [ -f .github/workflows/ci.yml ]; then
nl -ba .github/workflows/ci.yml | sed -n '1,160p'
echo "=== grep for setup-node@v6 in ci.yml ==="
rg -n "uses:\s*actions/setup-node@v6" .github/workflows/ci.yml || true
fi
echo "=== package.json packageManager fields ==="
if [ -f package.json ]; then
cat package.json
else
echo "package.json not found"
fi
echo "=== lockfiles present (top-level) ==="
ls -la | rg -n "package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json|package\.json" || trueRepository: FrilLab/frilvault
Length of output: 161
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== release.yml (lines 1-120) ==="
awk '{print NR "\t" $0}' .github/workflows/release.yml | sed -n '1,160p'
echo "=== ci.yml (lines 1-220 if present) ==="
if [ -f .github/workflows/ci.yml ]; then
awk '{print NR "\t" $0}' .github/workflows/ci.yml | sed -n '1,240p'
echo "=== grep for setup-node@v6 in ci.yml ==="
rg -n "uses:\s*actions/setup-node@v6" .github/workflows/ci.yml || true
else
echo "ci.yml not found"
fi
echo "=== check package.json packageManager fields ==="
if [ -f package.json ]; then
cat package.json
else
echo "package.json not found"
fi
echo "=== lockfiles present (top-level) ==="
ls -la | rg -n "package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json|bun.lockb|package\.json" || trueRepository: FrilLab/frilvault
Length of output: 2349
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== package-lock.json locations ==="
fd -a "package-lock.json" . || true
echo "=== pnpm/yarn lock locations (just in case) ==="
fd -a "pnpm-lock.yaml" . || true
fd -a "yarn.lock" . || true
echo "=== package.json locations (top few) ==="
fd -a "package.json" . | head -n 50
echo "=== show apps/frilvault/package.json (if exists) ==="
if [ -f apps/frilvault/package.json ]; then
cat apps/frilvault/package.json
else
echo "apps/frilvault/package.json not found"
fi
echo "=== show apps/frilvault/package-lock.json (top fields only) ==="
if [ -f apps/frilvault/package-lock.json ]; then
head -n 40 apps/frilvault/package-lock.json
else
echo "apps/frilvault/package-lock.json not found"
fiRepository: FrilLab/frilvault
Length of output: 3052
🌐 Web query:
actions/setup-node@v6 package-manager-cache automatic caching detection conditions packageManager field devEngines.packageManager lockfile
💡 Result:
In actions/setup-node@v6, automatic caching is natively supported and enabled by default for npm projects [1][2]. Detection Conditions: The action automatically detects and enables caching for npm when no explicit cache input is provided, provided that one of the following conditions is met in the package.json file: - The top-level packageManager field is set to npm [1][3]. - The devEngines.packageManager field is set to npm [1][2]. If your package.json does not include a packageManager field set to npm, automatic caching will be disabled unless you explicitly enable it using the cache input [1][4]. For other package managers like Yarn or pnpm, caching is disabled by default and must always be configured manually via the cache input [1][2]. Control and Security: - The automatic caching behavior is controlled by the package-manager-cache input, which defaults to true [1][2]. - To disable automatic caching (e.g., for security reasons in workflows with elevated privileges or sensitive information, or when operating without a lockfile), set package-manager-cache: false [1][5]. - The cache mechanism relies on the presence of a lockfile (e.g., package-lock.json) to generate a unique cache key [5][2]. It is strongly recommended to commit the lockfile to version control [4][2]. Note that for workflows that require specific cache paths or multiple dependency files (such as in monorepos), you should use the cache-dependency-path input to ensure the correct files are hashed for the cache key [2][6].
Citations:
- 1: https://github.com/actions/setup-node/blob/v6/README.md
- 2: https://github.com/actions/setup-node?tab=readme-ov-file
- 3: https://github.com/actions/setup-node
- 4: https://git.d.aiengines.ir/actions/setup-node/src/commit/53b83947a5a98c8d113130e565377fae1a50d02f/README.md
- 5: https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md
- 6: https://github.com/actions/setup-node/blob/fbeca22fb217b9a8ce9891899ff32e5edae593f7/README.md
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== top-level package.json/package-lock.json ==="
ls -la | rg -n "package\.json|package-lock\.json" || true
echo "=== check for any package-lock.json at repo root level only ==="
find . -maxdepth 2 -type f -name "package-lock.json" -print
echo "=== check for any package.json at repo root level only ==="
find . -maxdepth 2 -type f -name "package.json" -printRepository: FrilLab/frilvault
Length of output: 233
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== All package-lock.json files ==="
find . -type f -name "package-lock.json" -print
echo "=== All package.json files (top-level to depth 3) ==="
find . -maxdepth 3 -type f -name "package.json" -printRepository: FrilLab/frilvault
Length of output: 216
Fix npm caching configuration in the release workflow (setup-node@v6)
setup-node@v6 only auto-enables npm caching when the workflow’s package.json declares packageManager/devEngines.packageManager as npm; in release.yml the step runs from repo root (no root package.json/package-lock.json), while the only lockfile is apps/frilvault/package-lock.json. Update the setup-node@v6 step to match CI by adding cache: npm and cache-dependency-path: apps/frilvault/package-lock.json (and ensure npm ci runs in apps/frilvault).
🧰 Tools
🪛 zizmor (1.25.2)
[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 18-18: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 18 - 20, Update the setup-node@v6
step in the release workflow to explicitly enable npm caching and point to the
correct lockfile: add with keys "cache: npm" and "cache-dependency-path:
apps/frilvault/package-lock.json" to the setup-node@v6 configuration, and ensure
the subsequent install step runs "npm ci" from the apps/frilvault directory
(e.g. by setting the working-directory or running npm ci --prefix
apps/frilvault) so caching is applied correctly.
dependabot
Bot
deleted the
dependabot/github_actions/github-actions-0f2d96765f
branch
1 participant
Bumps the github-actions group with 3 updates: actions/checkout, actions/setup-node and softprops/action-gh-release.
Updates
actions/checkoutfrom 4 to 6Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)Updates
actions/setup-nodefrom 4 to 6Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
48b55a0Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)ab72c7eUpgrade@actionsdependencies (#1525)53b8394Bump minimatch from 3.1.2 to 3.1.5 (#1498)54045abScope test lockfiles by package manager and update cache tests (#1495)c882bffReplace uuid with crypto.randomUUID() (#1378)774c1d6feat(node-version-file): support parsingdevEnginesfield (#1283)efcb663fix: remove hardcoded bearer (#1467)d02c89dFix npm audit issues (#1491)6044e13Docs: bump actions/checkout from v5 to v6 (#1468)8e49463Fix README typo (#1226)Updates
softprops/action-gh-releasefrom 2 to 3Release notes
Sourced from softprops/action-gh-release's releases.
... (truncated)
Changelog
Sourced from softprops/action-gh-release's changelog.
Commits
b430933release: cut v3.0.0 for Node 24 upgrade (#670)c2e35e0chore(deps): bump the npm group across 1 directory with 7 updates (#783)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit