Update github actions (major) by renovate[bot] · Pull Request #3089 · open-telemetry/opentelemetry-java-contrib

renovate · 2026-09-01T00:52:32Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v6.0.2` → `v7.0.1`
actions/setup-java	action	major	`v5.7.0` → `v6.0.0`
actions/setup-node	action	major	`v6.4.0` → `v7.0.0`
actions/upload-artifact	action	major	`v5.0.0` → `v7.0.1`
node	uses-with	major	`22` → `24`

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.1.0`

Compare Source

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

actions/setup-java (actions/setup-java)

`v6.0.0`

Compare Source

actions/setup-node (actions/setup-node)

`v7.0.0`

Compare Source

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in #1577
Migrate to ESM and upgrade dependencies by @gowridurgad in #1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in #1558
Only use mirrorToken in getManifest if it's provided by @deiga in #1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in #1536
docs: Update restore-only cache documentation by @priya-kinthali in #1550
docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in #1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in #1569

New Contributors

@chiranjib-swain made their first contribution in #1536
@deiga made their first contribution in #1548
@jasongin made their first contribution in #1569

Full Changelog: actions/setup-node@v6...v7.0.0

`v6.5.0`

Compare Source

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

actions/upload-artifact (actions/upload-artifact)

`v7.0.1`

Compare Source

What's Changed

Update the readme with direct upload details by @danwkennedy in #795
Readme: bump all the example versions to v7 by @danwkennedy in #796
Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in #797

Full Changelog: actions/upload-artifact@v7...v7.0.1

`v7.0.0`

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in #754
Upgrade the module to ESM and bump dependencies by @danwkennedy in #762
Support direct file uploads by @danwkennedy in #764

New Contributors

@Link- made their first contribution in #754

Full Changelog: actions/upload-artifact@v6...v7.0.0

`v6.0.0`

Compare Source

v6 - What's new

[!IMPORTANT]
actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in #719
fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in #744
prepare release v6.0.0 for Node.js 24 support by @salmanmkc in #745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

actions/node-versions (node)

`v24.20.0`: 24.20.0

Compare Source

Node.js 24.20.0

`v24.19.0`: 24.19.0

Compare Source

Node.js 24.19.0

`v24.18.1`: 24.18.1

Compare Source

Node.js 24.18.1

`v24.18.0`: 24.18.0

Compare Source

Node.js 24.18.0

`v24.17.0`: 24.17.0

Compare Source

Node.js 24.17.0

`v24.16.0`: 24.16.0

Compare Source

Node.js 24.16.0

`v24.15.0`: 24.15.0

Compare Source

Node.js 24.15.0

`v24.14.1`: 24.14.1

Compare Source

Node.js 24.14.1

`v24.14.0`: 24.14.0

Compare Source

Node.js 24.14.0

`v24.13.1`: 24.13.1

Compare Source

Node.js 24.13.1

`v24.13.0`: 24.13.0

Compare Source

Node.js 24.13.0

`v24.12.0`: 24.12.0

Compare Source

Node.js 24.12.0

`v24.11.1`: 24.11.1

Compare Source

Node.js 24.11.1

`v24.11.0`: 24.11.0

Compare Source

Node.js 24.11.0

`v24.10.0`: 24.10.0

Compare Source

Node.js 24.10.0

`v24.9.0`: 24.9.0

Compare Source

Node.js 24.9.0

`v24.8.0`: 24.8.0

Compare Source

Node.js 24.8.0

`v24.7.0`: 24.7.0

Compare Source

Node.js 24.7.0

`v24.6.0`: 24.6.0

Compare Source

Node.js 24.6.0

`v24.5.0`: 24.5.0

Compare Source

Node.js 24.5.0

`v24.4.1`: 24.4.1

Compare Source

Node.js 24.4.1

`v24.4.0`: 24.4.0

Compare Source

Node.js 24.4.0

`v24.3.0`: 24.3.0

Compare Source

Node.js 24.3.0

`v24.2.0`: 24.2.0

Compare Source

Node.js 24.2.0

`v24.1.0`: 24.1.0

Compare Source

Node.js 24.1.0

`v24.0.2`: 24.0.2

Compare Source

Node.js 24.0.2

`v24.0.1`: 24.0.1

Compare Source

Node.js 24.0.1

`v24.0.0`: 24.0.0

Compare Source

Node.js 24.0.0

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 07:59 AM, only on Tuesday (* 0-7 * * 2)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copilot

Pull request overview

Updates pinned GitHub Actions versions across CI workflows to the latest major releases, aligning the repo’s automation with newer action runtimes (notably Node.js 24) while keeping actions pinned by commit SHA.

Changes:

Bump actions/setup-java from v5.7.0 to v6.0.0 across multiple Gradle-based workflows.
Update draft-release-notes workflow to actions/checkout v7.0.1, actions/setup-node v7.0.0 (Node 24), and actions/upload-artifact v7.0.1.
Keep workflows using SHA-pinned action references (supply-chain best practice) while updating the pinned SHAs.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/sonatype-guide-dependency-audit-daily.yml	Updates `actions/setup-java` pin to v6.0.0 for the daily dependency audit job.
.github/workflows/release.yml	Updates `actions/setup-java` pin to v6.0.0 in release-related jobs that run Gradle.
.github/workflows/draft-release-notes.yml	Updates checkout/setup-node/upload-artifact pins and bumps Node from 22 → 24 for the release-notes drafting workflow.
.github/workflows/dependency-submission.yml	Updates `actions/setup-java` pin to v6.0.0 for dependency graph submission.
.github/workflows/copilot-setup-steps.yml	Updates `actions/setup-java` pin to v6.0.0 for Copilot setup workflow steps.
.github/workflows/codeql.yml	Updates `actions/setup-java` pin to v6.0.0 for Java CodeQL analysis steps.
.github/workflows/build-daily.yml	Updates `actions/setup-java` pin to v6.0.0 in the snapshot publishing workflow path.
.github/workflows/build-common.yml	Updates `actions/setup-java` pin to v6.0.0 across reusable build/test jobs.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Update github actions

eb3eb94

Copilot AI lite review requested due to automatic review settings September 1, 2026 00:52

renovate Bot added the dependencies Pull requests that update a dependency file label Sep 1, 2026

renovate Bot requested a review from a team as a code owner September 1, 2026 00:52

renovate Bot added the dependencies Pull requests that update a dependency file label Sep 1, 2026

Copilot started reviewing on behalf of open-telemetry September 1, 2026 00:54 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

laurit approved these changes Sep 1, 2026

View reviewed changes

laurit added this pull request to the merge queue Sep 1, 2026

Merged via the queue into main with commit be2dcf4 Sep 1, 2026
30 checks passed

laurit deleted the renovate/major-github-actions branch September 1, 2026 07:25

Navigation Menu

Uh oh!

Update github actions (major) - #3089

Update github actions (major)#3089
laurit merged 1 commit into
mainfrom
renovate/major-github-actions

renovate Bot commented Sep 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

renovate Bot commented Sep 1, 2026

Release Notes

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

What's Changed

What's Changed

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v6 - What's new

Node.js 24

What's Changed

v24.20.0: 24.20.0

v24.19.0: 24.19.0

v24.18.1: 24.18.1

v24.18.0: 24.18.0

v24.17.0: 24.17.0

v24.16.0: 24.16.0

v24.15.0: 24.15.0

v24.14.1: 24.14.1

v24.14.0: 24.14.0

v24.13.1: 24.13.1

v24.13.0: 24.13.0

v24.12.0: 24.12.0

v24.11.1: 24.11.1

v24.11.0: 24.11.0

v24.10.0: 24.10.0

v24.9.0: 24.9.0

v24.8.0: 24.8.0

v24.7.0: 24.7.0

v24.6.0: 24.6.0

v24.5.0: 24.5.0

v24.4.1: 24.4.1

v24.4.0: 24.4.0

v24.3.0: 24.3.0

v24.2.0: 24.2.0

v24.1.0: 24.1.0

v24.0.2: 24.0.2

v24.0.1: 24.0.1

v24.0.0: 24.0.0

Configuration

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`v24.20.0`: 24.20.0

`v24.19.0`: 24.19.0

`v24.18.1`: 24.18.1

`v24.18.0`: 24.18.0

`v24.17.0`: 24.17.0

`v24.16.0`: 24.16.0

`v24.15.0`: 24.15.0

`v24.14.1`: 24.14.1

`v24.14.0`: 24.14.0

`v24.13.1`: 24.13.1

`v24.13.0`: 24.13.0

`v24.12.0`: 24.12.0

`v24.11.1`: 24.11.1

`v24.11.0`: 24.11.0

`v24.10.0`: 24.10.0

`v24.9.0`: 24.9.0

`v24.8.0`: 24.8.0

`v24.7.0`: 24.7.0

`v24.6.0`: 24.6.0

`v24.5.0`: 24.5.0

`v24.4.1`: 24.4.1

`v24.4.0`: 24.4.0

`v24.3.0`: 24.3.0

`v24.2.0`: 24.2.0

`v24.1.0`: 24.1.0

`v24.0.2`: 24.0.2

`v24.0.1`: 24.0.1

`v24.0.0`: 24.0.0