chore(deps): bump actions/setup-java from 4 to 5 - #11
Conversation
dependabot
Bot
added
dependencies
|
@dependabot rebase |
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 4 to 5. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v4...v5) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
3221223 to
76a98f5
Compare
|
Local review (the bot cannot run on dependabot events — no secrets): 1-line actions major bump; every usage in this repo pins explicit, stable inputs (checkout: defaults only; setup-node: node-version 20 + npm cache; setup-java: temurin/17; upload/download-artifact: plain name+path single-artifact pair, landing in the same batch so the pair stays consistent). Publish workflows are tag-triggered, so CI here does not exercise them — residual risk accepted, recoverable by re-tag. No Critical/Medium. |
…p-java to v5 (#43) * chore(deps): bump actions/checkout to v7, upload-artifact to v7, setup-java to v5 Replicates dependabot #8/#9/#11, which the branch ruleset blocks from merging (bot-authored PRs never receive the Copilot review the copilot_code_review rule waits for). Same review rationale as noted on those PRs: every usage pins explicit stable inputs; the upload/download-artifact pair stays consistent (download@v8 landed via #7); publish workflows are tag-triggered so the residual risk surfaces only at the next release and is recoverable by re-tag. * Review Medium: match the artifact pair at v8, fail release on empty dist upload-artifact goes v8 (not v7) so the tag-only upload/download pair shares a major, and the GitHub release step now fails when dist/*.zip matches nothing instead of silently publishing a release without the plugin. * upload-artifact back to v7 — v8 does not exist for the upload action The upload/download majors are simply offset (upload latest is v7, download latest is v8, both on the shared v4+ artifact backend), which is exactly the pairing dependabot proposed. fail_on_unmatched_files stays: an empty dist/ must fail the release.
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps actions/setup-java from 4 to 5.
Release notes
Sourced from actions/setup-java's releases.
... (truncated)
Commits
b6effb0Deprecate legacy Adopt distributions in v5 (#1186)e498d2aBackport #1151: Fix missing wrapper cache distributions (#1153)6a3384dFix npm audit failures on releases/v5 (#1154)03ad4deBackport #1097/#1098: cache Maven and Gradle wrapper distributions separately...d229d2eBackport #1111: Preserve Maven toolchains across repeated setup-java runs (#1...bbf0f69dist: Cover Tencent Kona JDK 25 (#1110)513edc4feat: expose cache-primary-key output (#597) [v5 backport] (#1089)62df799Add Maven compiler problem matcher for javac diagnostics (#1087)176156achore: bump version to 5.6.0 for v5 release linebf7b8debuild: rebuild dist for backported changes (#1079, #1083, #1084)