ci(deps): update github-actions - #4
Open
renovate-bot-lohn[bot] wants to merge 1 commit into
Open
Conversation
renovate-bot-lohn
Bot
force-pushed
the
renovate/github-actions
branch
4 times, most recently
from
July 23, 2026 15:29
1b1a5ab to
b8928ba
Compare
renovate-bot-lohn
Bot
force-pushed
the
renovate/github-actions
branch
4 times, most recently
from
August 1, 2026 21:06
adb9451 to
43c18af
Compare
renovate-bot-lohn
Bot
force-pushed
the
renovate/github-actions
branch
from
August 4, 2026 12:11
43c18af to
850ab92
Compare
renovate-bot-lohn
Bot
force-pushed
the
renovate/github-actions
branch
from
August 7, 2026 21:05
850ab92 to
b3e4573
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.1.0→v4.2.2v7.0.0→v7.0.1v4.2.0→v4.2.4v4.2.5v3.0.4→v3.0.5v1.14.0→v1.14.2Release Notes
actions/attest (actions/attest)
v4.2.2Compare Source
What's Changed
Full Changelog: actions/attest@v4.2.1...v4.2.2
v4.2.1Compare Source
What's Changed
Full Changelog: actions/attest@v4.2.0...v4.2.1
v4.2.0Compare Source
What's Changed
Full Changelog: actions/attest@v4.1.1...v4.2.0
v4.1.1Compare Source
What's Changed
Full Changelog: actions/attest@v4.1.0...v4.1.1
actions/checkout (actions/checkout)
v7.0.1Compare Source
jdx/mise-action (jdx/mise-action)
v4.2.4: : Reliable locking detection under forced colorCompare Source
A small patch release that fixes locking-support detection when workflows force colored output.
Fixed
Detect
mise install --lockedreliably under forced color (#580 by @scop)When colored output was forced globally (for example via
CLICOLOR_FORCE=1), ANSI escape codes inmise install --helpprevented the action from matching--lockedin the help text, so locking support was reported as unavailable even on versions of mise that supported it.The help probe now runs with
NO_COLOR=1in its environment, which overridesCLICOLOR_FORCEand guarantees plain-text output for the feature detection — regardless of the surrounding workflow's color settings.Full Changelog: jdx/mise-action@v4.2.3...v4.2.4
v4.2.3: : Restore mise PATH propagationCompare Source
A patch release that restores mise's PATH propagation to subsequent workflow steps — without reintroducing the full-PATH snapshot behavior that v4.2.1 fixed.
Fixed
Export mise PATH entries to subsequent steps (#575) by @jdx
v4.2.1 stopped exporting the complete
PATHreturned bymise env --jsonintoGITHUB_ENV, which correctly prevented snapshotting the runner's environment into subsequent steps. However, that also dropped mise-produced PATH entries — tool shims,[env] _.pathdirectories, and similar — that workflows relied on after the setup step. See #565.The action now computes only the prefix that mise prepended to the existing
PATHand forwards those directories individually throughGITHUB_PATH. This preserves mise's configured ordering, composes cleanly with PATH changes from other actions, and never persists the runner's fullPATHthroughGITHUB_ENV. The dotenv fallback path (used with older mise versions) also stripsPATH=lines and re-derives additions frommise env --json.A new
export_pathinput (defaulttrue) lets workflows keep regularenvexports while opting out of PATH changes:Full Changelog: jdx/mise-action@v4.2.2...v4.2.3
v4.2.2: : Zstd tar fallback for older runnersCompare Source
A small patch release that fixes archive selection on runners with an older
tarand corrects a stale default in the README.Fixed
Verify
tarsupports Zstd before picking.tar.zst(#569 by @JackMyers001The action previously chose the
.tar.zstmise archive wheneverzstd --versionsucceeded, then extracted it withtar --zstd. On RHEL 8-compatible runners that shipzstd1.4.4 alongside GNUtar1.30, the--zstdoption isn't recognized and installation failed.Detection now runs both checks:
If either fails, the action falls back to the
.tar.gzarchive. No configuration change is required — existing workflows on affected runners just start working again. Fixes #568.Documentation
cache_key_prefixexample in the README to reflect the current default ofmise-v1(previously documented asmise-v0) (#570 by @muzimuzhi).New Contributors
Full Changelog: jdx/mise-action@v4.2.1...v4.2.2
v4.2.1: : Signed checksums and PATH export fixCompare Source
A small patch release with two user-facing fixes: mise downloads are now verified against minisign-signed release checksums by default, and the
envinput no longer leaks the runner'sPATHinto subsequent steps.Fixed
Verify mise downloads with signed checksums (#548) by @jdx
The action now embeds mise's minisign public key and verifies
SHASUMS256.txt.minisigbefore trusting any release checksums, then checks the downloaded mise binary's SHA256 against the verified list. This applies to both GitHub release archives (verified before extraction) and the defaultmise.jdx.devCDN path (verified against the signed checksum for the matching release asset). If a CDN download fails verification, the action warns and falls back to the signed GitHub release asset instead of installing an unverified binary.sha256input still works as an explicit override.2024.12.24(which predate minisign checksums) get a warning and skip signed verification rather than failing.download | tarfast path is replaced with a download-then-verify-then-extract flow.Thanks to @potiuk for the detailed threat-model writeup in #547.
Exclude
PATHfrom environment export (#556) by @jdxThe
envinput has always documented that "PATH modifications are not part of this", but since the switch tomise env --jsonin #252 (needed for redaction support), the action was exporting every string value returned by mise — including the computedPATH— intoGITHUB_ENV. That effectively snapshotted the runner's entirePATHinto subsequent steps and let[env] _.pathentries inmise.tomlleak past the action's own PATH management.exportMiseEnvnow skipsPATH(case-insensitive) when exporting JSON env vars, restoring the documented behavior. Normal mise env vars are still exported, and PATH continues to be managed by the action's own setup (e.g.add_shims_to_path). Fixes #555.Full Changelog: jdx/mise-action@v4.2.0...v4.2.1
marocchino/sticky-pull-request-comment (marocchino/sticky-pull-request-comment)
v3.0.5Compare Source
What's Changed
{{{content}}}placeholder by @marocchino with @Copilot in #1665Full Changelog: marocchino/sticky-pull-request-comment@v3.0.4...v3.0.5
pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)
v1.14.2Compare Source
This one probably won't touch you visibly so just bookmark @webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube or encourage him to come back with more to share next year!
🛠️ Urgh… Another release!? Again? Explain yourself!
Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.
🧐 Tell me why..
The rest of the updates bump things related to
pypi-attestationsandsigstore, which has the most interesting backstory here. @facutuesca💰 sent a patch in #417 but a bunch more helped out.TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23.
On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.
I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.
Over the course of investigation, @facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.
Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.
🫶 New Contributors
🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2
🧔♂️ Release Manager: @webknjaz 🇺🇦
🙏 Special Thanks to @davidbrochart💰 and @Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @miketheman💰 confirmed the Warehouse-side details. Also, @jku💰 and @woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.
💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.
v1.14.1Compare Source
This release was cut at EuroPython 2026 Sprints
🛠️ Internal Dependencies
@adisivaprasad💰 helped get rid of the GitHub Actions runner warning about the old Node 20 runtime being used by updating
actions/setup-pythonfrom v5.6.0 to v6.2.0 in #408.💪 New Contributors
🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.0...v1.14.1
🧔♂️ Release Manager: @webknjaz 🇺🇦
🙏 Special Thanks to @jylenhof💰 for reminding me to work on this release!
💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.
Configuration
📅 Schedule: (in timezone Asia/Tokyo)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.