Skip to content

deps: bump the github-actions group with 3 updates #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FrilLab merged 1 commit into from
Jun 1, 2026
Merged

deps: bump the github-actions group with 3 updates #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6

- name: Set up Rust
uses: actions-rust-lang/setup-rust-toolchain@v1
Expand All @@ -52,10 +52,10 @@ jobs:
working-directory: apps/frilvault

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6

- name: Set up Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: 22
cache: npm
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6

- uses: actions/setup-node@v4
- uses: actions/setup-node@v6
with:
node-version: 22
Comment on lines +18 to 20
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

actions/setup-node v6 cache behavior npm

💡 Result:

In actions/setup-node v6, caching for npm is now enabled automatically by default [1][2]. Key aspects of this behavior include: Automatic Activation: The action automatically detects your package manager. If your package.json contains either a top-level packageManager field or a devEngines.packageManager field set to npm, caching will be enabled without requiring the cache input [1][2]. Control via Input: This automatic behavior is controlled by the package-manager-cache input, which defaults to true [2][3]. You can explicitly disable this automatic caching by setting package-manager-cache: false [1][4]. Mechanism: Under the hood, the action uses actions/cache to cache the global npm cache directory (rather than node_modules) [4][5]. It relies on your lockfile (e.g., package-lock.json) to generate a unique hash for the cache key [4][6]. For optimal results in CI, it is recommended to use npm ci rather than npm install, as npm ci is designed to work directly with the lockfile and will benefit from the restored global cache [6][7]. Security: For workflows involving elevated privileges or access to sensitive information, it is recommended to set package-manager-cache: false if caching is not explicitly required for your operation [1][8]. Note on Lockfiles: The caching feature requires a lockfile to generate a cache key. If you do not use a lockfile, you should explicitly disable caching to avoid errors or unexpected behavior [4].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== release.yml (relevant section) ==="
nl -ba .github/workflows/release.yml | sed -n '1,120p'

echo "=== ci.yml (find setup-node@v6 cache config) ==="
if [ -f .github/workflows/ci.yml ]; then
  nl -ba .github/workflows/ci.yml | sed -n '1,160p'
  echo "=== grep for setup-node@v6 in ci.yml ==="
  rg -n "uses:\s*actions/setup-node@v6" .github/workflows/ci.yml || true
fi

echo "=== package.json packageManager fields ==="
if [ -f package.json ]; then
  cat package.json
else
  echo "package.json not found"
fi

echo "=== lockfiles present (top-level) ==="
ls -la | rg -n "package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json|package\.json" || true

Repository: FrilLab/frilvault

Length of output: 161

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== release.yml (lines 1-120) ==="
awk '{print NR "\t" $0}' .github/workflows/release.yml | sed -n '1,160p'

echo "=== ci.yml (lines 1-220 if present) ==="
if [ -f .github/workflows/ci.yml ]; then
  awk '{print NR "\t" $0}' .github/workflows/ci.yml | sed -n '1,240p'
  echo "=== grep for setup-node@v6 in ci.yml ==="
  rg -n "uses:\s*actions/setup-node@v6" .github/workflows/ci.yml || true
else
  echo "ci.yml not found"
fi

echo "=== check package.json packageManager fields ==="
if [ -f package.json ]; then
  cat package.json
else
  echo "package.json not found"
fi

echo "=== lockfiles present (top-level) ==="
ls -la | rg -n "package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json|bun.lockb|package\.json" || true

Repository: FrilLab/frilvault

Length of output: 2349

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== package-lock.json locations ==="
fd -a "package-lock.json" . || true

echo "=== pnpm/yarn lock locations (just in case) ==="
fd -a "pnpm-lock.yaml" . || true
fd -a "yarn.lock" . || true

echo "=== package.json locations (top few) ==="
fd -a "package.json" . | head -n 50

echo "=== show apps/frilvault/package.json (if exists) ==="
if [ -f apps/frilvault/package.json ]; then
  cat apps/frilvault/package.json
else
  echo "apps/frilvault/package.json not found"
fi

echo "=== show apps/frilvault/package-lock.json (top fields only) ==="
if [ -f apps/frilvault/package-lock.json ]; then
  head -n 40 apps/frilvault/package-lock.json
else
  echo "apps/frilvault/package-lock.json not found"
fi

Repository: FrilLab/frilvault

Length of output: 3052

🌐 Web query:

actions/setup-node@v6 package-manager-cache automatic caching detection conditions packageManager field devEngines.packageManager lockfile

💡 Result:

In actions/setup-node@v6, automatic caching is natively supported and enabled by default for npm projects [1][2]. Detection Conditions: The action automatically detects and enables caching for npm when no explicit cache input is provided, provided that one of the following conditions is met in the package.json file: - The top-level packageManager field is set to npm [1][3]. - The devEngines.packageManager field is set to npm [1][2]. If your package.json does not include a packageManager field set to npm, automatic caching will be disabled unless you explicitly enable it using the cache input [1][4]. For other package managers like Yarn or pnpm, caching is disabled by default and must always be configured manually via the cache input [1][2]. Control and Security: - The automatic caching behavior is controlled by the package-manager-cache input, which defaults to true [1][2]. - To disable automatic caching (e.g., for security reasons in workflows with elevated privileges or sensitive information, or when operating without a lockfile), set package-manager-cache: false [1][5]. - The cache mechanism relies on the presence of a lockfile (e.g., package-lock.json) to generate a unique cache key [5][2]. It is strongly recommended to commit the lockfile to version control [4][2]. Note that for workflows that require specific cache paths or multiple dependency files (such as in monorepos), you should use the cache-dependency-path input to ensure the correct files are hashed for the cache key [2][6].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== top-level package.json/package-lock.json ==="
ls -la | rg -n "package\.json|package-lock\.json" || true

echo "=== check for any package-lock.json at repo root level only ==="
find . -maxdepth 2 -type f -name "package-lock.json" -print

echo "=== check for any package.json at repo root level only ==="
find . -maxdepth 2 -type f -name "package.json" -print

Repository: FrilLab/frilvault

Length of output: 233

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== All package-lock.json files ==="
find . -type f -name "package-lock.json" -print

echo "=== All package.json files (top-level to depth 3) ==="
find . -maxdepth 3 -type f -name "package.json" -print

Repository: FrilLab/frilvault

Length of output: 216

Fix npm caching configuration in the release workflow (setup-node@v6)
setup-node@v6 only auto-enables npm caching when the workflow’s package.json declares packageManager/devEngines.packageManager as npm; in release.yml the step runs from repo root (no root package.json/package-lock.json), while the only lockfile is apps/frilvault/package-lock.json. Update the setup-node@v6 step to match CI by adding cache: npm and cache-dependency-path: apps/frilvault/package-lock.json (and ensure npm ci runs in apps/frilvault).

🧰 Tools
🪛 zizmor (1.25.2)

[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 18-18: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 18 - 20, Update the setup-node@v6
step in the release workflow to explicitly enable npm caching and point to the
correct lockfile: add with keys "cache: npm" and "cache-dependency-path:
apps/frilvault/package-lock.json" to the setup-node@v6 configuration, and ensure
the subsequent install step runs "npm ci" from the apps/frilvault directory
(e.g. by setting the working-directory or running npm ci --prefix
apps/frilvault) so caching is applied correctly.


Expand All @@ -25,6 +25,6 @@ jobs:

- run: vsce package

- uses: softprops/action-gh-release@v2
- uses: softprops/action-gh-release@v3
with:
files: '*.vsix'