Skip to content

Bump the github-actions group across 1 directory with 5 updates - #21048

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-47c163feb5
Closed

Bump the github-actions group across 1 directory with 5 updates#21048
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-47c163feb5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 5 updates in the / directory:

Package From To
github/gh-aw-actions/setup 0.89.17 0.91.7
github/gh-aw-actions/setup-cli 0.89.17 0.91.7
actions/upload-artifact 7.0.1 7.0.2
actions/download-artifact 8.0.1 8.0.2
actions/setup-node 7.0.0 7.1.0

Updates github/gh-aw-actions/setup from 0.89.17 to 0.91.7

Release notes

Sourced from github/gh-aw-actions/setup's releases.

v0.91.7

Sync of actions from gh-aw at v0.91.7.

v0.91.6

Sync of actions from gh-aw at v0.91.6.

v0.91.5

Sync of actions from gh-aw at v0.91.5.

v0.91.4

Sync of actions from gh-aw at v0.91.4.

v0.91.2

Sync of actions from gh-aw at v0.91.2.

v0.91.1

Sync of actions from gh-aw at v0.91.1.

v0.91.0

Sync of actions from gh-aw at v0.91.0.

v0.90.4

Sync of actions from gh-aw at v0.90.4.

v0.90.3

Sync of actions from gh-aw at v0.90.3.

v0.90.1

Sync of actions from gh-aw at v0.90.1.

v0.90.0

Sync of actions from gh-aw at v0.90.0.

v0.89.22

Sync of actions from gh-aw at v0.89.22.

v0.89.21

Sync of actions from gh-aw at v0.89.21.

v0.89.20

Sync of actions from gh-aw at v0.89.20.

Commits

Updates github/gh-aw-actions/setup-cli from 0.89.17 to 0.91.7

Release notes

Sourced from github/gh-aw-actions/setup-cli's releases.

v0.91.7

Sync of actions from gh-aw at v0.91.7.

v0.91.6

Sync of actions from gh-aw at v0.91.6.

v0.91.5

Sync of actions from gh-aw at v0.91.5.

v0.91.4

Sync of actions from gh-aw at v0.91.4.

v0.91.2

Sync of actions from gh-aw at v0.91.2.

v0.91.1

Sync of actions from gh-aw at v0.91.1.

v0.91.0

Sync of actions from gh-aw at v0.91.0.

v0.90.4

Sync of actions from gh-aw at v0.90.4.

v0.90.3

Sync of actions from gh-aw at v0.90.3.

v0.90.1

Sync of actions from gh-aw at v0.90.1.

v0.90.0

Sync of actions from gh-aw at v0.90.0.

v0.89.22

Sync of actions from gh-aw at v0.89.22.

v0.89.21

Sync of actions from gh-aw at v0.89.21.

v0.89.20

Sync of actions from gh-aw at v0.89.20.

Commits

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits
  • 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
  • e455989 Prepare download-artifact v8.0.2
  • a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
  • 29bb7ce Update @​actions/artifact to 6.3.1
  • 484a0b5 Update the readme (#473)
  • See full diff in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the github-actions group across 1 directory with 5 updates
b71765c 
Bumps the github-actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) | `0.89.17` | `0.91.7` |
| [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) | `0.89.17` | `0.91.7` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |



Updates `github/gh-aw-actions/setup` from 0.89.17 to 0.91.7
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@f3b81cd...7a07356)

Updates `github/gh-aw-actions/setup-cli` from 0.89.17 to 0.91.7
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@f3b81cd...7a07356)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

---
updated-dependencies:
- dependency-name: github/gh-aw-actions/setup
  dependency-version: 0.91.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/gh-aw-actions/setup-cli
  dependency-version: 0.91.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 16, 2026
@github-actions

github-actions Bot commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 21048

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 21048"

@github-actions github-actions Bot added the area-codeflow for labeling automated codeflow. intentionally a different color! label Oct 16, 2026
@github-actions

github-actions Bot commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Tests selector

Selects the full PR test matrix + all PR-gated jobs (ALL) — a rule matching '.github/workflows/run-tests.yml' selects ALL

Selection computed for commit b71765c.

@github-actions

github-actions Bot commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions

github-actions Bot commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

@github-actions github-actions Bot mentioned this pull request Oct 16, 2026
Open
@radical

Ankit Jain (radical) commented Oct 16, 2026

Copy link
Copy Markdown
Member

CI confidence report

🔴 BLOCKED

Assessment remains incomplete.

  • Assessment incomplete: INCOMPLETE — The generated-workflow gate failed, and the updated gh-aw activation bundle still needs a targeted source-to-consumer compatibility and trust review before the assessment can be completed. Unassessed behavior is not cleared.

Failing PR/CI

Coverage not demonstrated

🔴 Validate Agentic Workflows gate — Eight generated lock files and one side-repository workflow are stale; generated lint and contract tests were skipped.

  • Generated workflow file consistency — Observed: Compilation succeeded with gh-aw v0.89.17, but the generated-files-up-to-date check failed for eight lock files plus .github/workflows/agentics-maintenance-microsoft-aspire.dev.yml: analyze-ci-failure, daily-repo-status, extension-changelog, milestone-changelog, pr-docs-check, release-notes-generate, release-update-support-mdx, and repo-pulse. | Missing evidence: The required generated-file consistency check failed on the final head; downstream generated lint and workflow-contract tests did not run. | Expected: All eight agentic .lock.yml files and the generated side-repository maintenance workflow match the pinned compiler output at the PR head. | Evidence: job status: receipt

  • Generated workflow lint and contract tests — Observed: Both downstream steps were skipped after the consistency check reported eight stale lock files and one stale side-repository maintenance workflow. | Missing evidence: There is no qualifying lint or contract-test result for the nine generated workflow files at the PR head. | Expected: Generated workflow lint and agentic workflow contract tests execute against the final generated definitions. | Evidence: job status: receipt

  • Required validation: Regenerate the eight lock files and side-repository maintenance workflow, then rerun Validate Agentic Workflows.

  • Done when: All nine generated files match compiler output; the final-head gate passes and executes generated lint and workflow-contract tests.

🔴 gh-aw setup action compatibility review — A material upstream action source delta remains unreviewed; unchanged inputs and compiler success do not establish compatibility of the bundled runtime code.

  • Expected: The exact gh-aw-actions/setup v0.91.7 implementation remains compatible with all nine Aspire generated-workflow consumers.
  • Observed: The action pin and manifest were checked, but the implementation delta between v0.89.17 and v0.91.7 was not traced through all affected consumers. The new action bundles changed runtime scripts.
  • Missing evidence: A material upstream action source delta remains unreviewed; unchanged inputs and compiler success do not establish compatibility of the bundled runtime code.
  • Required validation: Complete a source-to-consumer compatibility review of the exact gh-aw-actions/setup v0.91.7 diff.
  • Done when: The changed modules are mapped to their consumers, their input/output and execution contracts are documented, and any required final-tree validation is identified.
  • Assessment needed: Trace changed setup bundle modules to the nine generated workflow consumers and establish the affected compatibility contracts before classifying runtime execution.
  • Evidence: upstream source diff: receipt

🔴 Updated gh-aw activation trust review — The external gh-aw setup action changed many activation scripts, including agent execution and safe-output modules; the workflow scanner does not assess that action-source delta.

  • Expected: A targeted trust-boundary review covers the updated code staged into Aspire agentic workflows.
  • Observed: Zizmor passed for workflow definitions, but the changed upstream setup bundle was not independently reviewed for token use, mutation targets, output handling, or execution changes.
  • Missing evidence: The external gh-aw setup action changed many activation scripts, including agent execution and safe-output modules; the workflow scanner does not assess that action-source delta.
  • Required validation: Complete a targeted source review of changed trust-sensitive modules in gh-aw-actions/setup v0.91.7.
  • Done when: Changed token, mutation, prompt, output, and execution paths are traced to consumers and any findings are resolved or explicitly qualified.
  • Assessment needed: Review the exact action diff and trace any changed trust-sensitive modules to the nine workflow consumers; keep scope to those paths.
  • Evidence: upstream source diff: receipt

🔴 Updated agentic workflow runtime assessment — The updated action copies changed activation scripts into agentic workflow environments; affected runtime paths and whether a representative safe run is required remain unassessed.

  • Expected: The updated gh-aw activation code has a source-backed behavior assessment and an evidence-based decision on representative execution.
  • Observed: Nine generated workflows use the updated setup action (50 setup invocations); final-head validation compiled generated workflows but did not execute them, and its downstream contract tests were skipped.
  • Missing evidence: The updated action copies changed activation scripts into agentic workflow environments; affected runtime paths and whether a representative safe run is required remain unassessed.
  • Required validation: Trace the changed activation scripts to the nine affected agentic workflows and decide whether a representative final-tree run is required.
  • Done when: Every behaviorally changed path is mapped to consumers and the run-versus-contract-only disposition is supported by evidence.
  • Assessment needed: Complete the changed-module-to-workflow trace first; then either establish authorized supported representative execution or document why the contract-first exception is sufficient.
  • Evidence: upstream source diff: receipt

Audited commit: b71765cc
Independent review: completed
This is a partial CI-confidence review, not a complete code review.

Coverage catalog

The items below show the affected workflows, tests, artifacts and other validation evidence.

Workflows and pipelines

🔴 1. GitHub execution and coverage — A workflow or test-lane gap remains.
  • Evidence / missing boundary: The setup action is a shared activation-code bundle; assess its source delta before deciding whether representative final-definition execution is required. | Outerloop generation and acquisition checks passed, while package/image/archive jobs were skipped; action pin-only changes do not create a separate scenario-coverage requirement. This does not claim those skipped jobs ran. | Quarantine runsheet/acquisition checks passed; other skipped jobs are outside the unchanged quarantine scenario-selection contract. | The deployment test workflow has no changed deployment contract; the artifact action upgrades are separately assessed by their stable metadata and release notes.
🔴 1a. Affected workflow final-definition execution — Validation not demonstrated
  • Applicability: yes — Nine generated agentic workflows update the gh-aw setup action; their runtime behavior has not yet been traced or executed.
  • Evidence / missing boundary: The setup action is a shared activation-code bundle; assess its source delta before deciding whether representative final-definition execution is required.
  • Required validation: see finding for Updated agentic workflow runtime assessment.
⚪ 1b. Outerloop scenario coverage — Not applicable
  • Applicability: no — No outerloop selector, scenario, or test-lane contract changed.
  • Evidence / missing boundary: Outerloop generation and acquisition checks passed, while package/image/archive jobs were skipped; action pin-only changes do not create a separate scenario-coverage requirement. This does not claim those skipped jobs ran.
⚪ 1c. Quarantine scenario coverage — Not applicable
  • Applicability: no — No quarantine selector, scenario, or test-lane contract changed.
  • Evidence / missing boundary: Quarantine runsheet/acquisition checks passed; other skipped jobs are outside the unchanged quarantine scenario-selection contract.
⚪ 1d. Deployment E2E coverage — Not applicable
  • Applicability: no — Deployment workflow changes are action pins only; deployment inputs and behavior were not changed.
  • Evidence / missing boundary: The deployment test workflow has no changed deployment contract; the artifact action upgrades are separately assessed by their stable metadata and release notes.
⚪ 2. Internal Azure pipeline/stage execution — Not applicable
  • Applicability: no — No Azure Pipelines definition, task, or invoked pipeline script changed.
  • Evidence / missing boundary: All 33 changed files are GitHub workflow YAML files and update GitHub Action references only; there is no demonstrated Azure pipeline consumer change.
⚪ 3. CI selection/result gates — Not applicable
  • Applicability: no — No trigger, permission, selector, routing, or final-result gate changed.
  • Evidence / missing boundary: The patch changes action references and version comments only; no selection/result-gate behavior changed.

Functional and platform coverage

⚪ 4. Ordinary functional/regression/platform coverage — Not applicable
  • Applicability: no — No product source or test code changed.
  • Evidence / missing boundary: All changes are GitHub Action pins; the unrelated Aspire.Hosting test failures are excluded from this CI-infrastructure assessment.

Produced outputs and artifacts

🟢 5. Artifact/release-consumer integrity — Verified
  • Applicability: yes — Artifact upload/download actions are used in touched workflow consumers.
  • Evidence / missing boundary: Release notes describe retry handling only and action metadata/caller contracts are unchanged; this verifies interface compatibility, not content-level end-to-end artifact correctness.
🟢 Artifact upload/download contracts

  • Expected: The artifact action upgrades preserve the configured input/output contract for existing upload/download consumers.
  • Observed: v7.0.2 and v8.0.2 release notes describe HTTP 429 retry handling; action metadata and caller inputs/outputs are unchanged.
  • Evidence: upstream release notes: receipt; upstream release notes: receipt

Static checks and dependency safety

🔴 6. Lint/static analysis/generated consistency — Validation not demonstrated
  • Applicability: yes — The generated-workflow validation gate failed before generated lint and contract tests ran.
  • Evidence / missing boundary: Handwritten workflow lint passed; generated consistency failed for eight .lock.yml files plus one side-repository maintenance workflow, so generated lint and contract tests were skipped.
  • Required validation: see finding for Generated workflow file consistency.
  • Required validation: see finding for Generated workflow lint and contract tests.
🟢 Handwritten workflow lint

  • Expected: Handwritten GitHub workflow definitions pass the repository lint gate on the final head.
  • Observed: Lint handwritten workflows completed successfully on the PR head.
  • Evidence: job status: receipt
🔴 7. Dependency/action/task/tool version safety — Validation not demonstrated
  • Applicability: yes — Action tag provenance and the setup-node caller contract are verified; compatibility of the changed gh-aw setup activation bundle remains open.
  • Evidence / missing boundary: All five updated action tags and SHA comments were checked; setup-node source changes were traced to explicit Node 20.x/22/24 calls. The gh-aw setup bundle still needs source-to-consumer assessment.
🟢 Action tag and immutable SHA provenance

  • Expected: Every updated third-party action pin resolves to the exact SHA named by its version comment; explicit caller versions remain effective.
  • Observed: All five updated action tags resolved to their pinned SHAs. setup-cli v0.91.7 makes its version input optional, while Aspire callers still pass v0.89.17 and final-head validation installed that version.
  • Evidence: upstream action source: receipt; upstream action source: receipt; upstream release notes: receipt; upstream action release: receipt; upstream action release: receipt; upstream action release: receipt
- **Required validation:** see [finding](#finding-3390cff25a476aa0) for gh-aw setup action compatibility review.
🟢 setup-node v7.1.0 caller contract

  • Expected: The new setup-node version keeps Aspire callers on their explicit Node versions and its added validation/retry behavior is compatible with those calls.
  • Observed: The v7.1.0 source adds validation of the installed Node version and retries invalid/transient manifest fetches. All changed Aspire callers specify Node 20.x, 22/22.x, or 24; none switches to a version-file input or mise.toml. This is source-backed compatibility evidence, not a runtime probe.
  • Evidence: upstream source diff: receipt; PR workflow diff: receipt

Security and agent behavior

🔴 8. Security/trust-boundary review — Validation not demonstrated
  • Applicability: yes — Zizmor completed successfully, but the updated external gh-aw activation code has not received the separate targeted source trust review.
  • Evidence / missing boundary: The successful workflow scan covers workflow definitions; the changed action repository contains modified execution and safe-output modules that require source-to-consumer review.
🟢 Zizmor workflow scan

  • Expected: Zizmor executes on the final workflow definitions with the pinned tool version.
  • Observed: The final-head Zizmor job completed successfully with version 2.1.0 and exit code 0; this records scanner completion, not a separate source trust review.
  • Evidence: job status: receipt
- **Required validation:** see [finding](#finding-016c9b05c2a48389) for Updated gh-aw activation trust review.
🔴 9. Representative agent behavior — Validation not demonstrated
  • Applicability: yes — The updated action stages modified activation scripts into nine generated workflows; behavior and representative-run requirements remain unassessed.
  • Evidence / missing boundary: The compiler validation is not an agentic runtime execution, and its generated workflow contract tests were skipped.
  • Required validation: see finding for Updated agentic workflow runtime assessment.

@IEvangelist David Pine (IEvangelist) mentioned this pull request Oct 19, 2026
Open
5 of 14 tasks
@dependabot @github

dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 21, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-47c163feb5 branch October 21, 2026 06:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area-codeflow for labeling automated codeflow. intentionally a different color! dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@radical