build(github-actions): 📦 major github-actions (major) (#99)

renovate[bot] · web-flow · commit e31fa69d09b6 · 2025-10-04T13:41:11.000-05:00
> [!NOTE] > Mend has cancelled [the proposed renaming](https://redirect.github.com/renovatebot/renovate/discussions/37842) of the Renovate GitHub app being renamed to `mend[bot]`. > > This notice will be removed on 2025-10-07. <hr> This PR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v4` -> `v5` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/actions/checkout/badge)](https://securityscorecards.dev/viewer/?uri=github.com/actions/checkout) | | [actions/stale](https://redirect.github.com/actions/stale) | action | major | `v9` -> `v10` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/actions/stale/badge)](https://securityscorecards.dev/viewer/?uri=github.com/actions/stale) | | [amannn/action-semantic-pull-request](https://redirect.github.com/amannn/action-semantic-pull-request) | action | major | `v5` -> `v6` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/amannn/action-semantic-pull-request/badge)](https://securityscorecards.dev/viewer/?uri=github.com/amannn/action-semantic-pull-request) | | [aquaproj/aqua-installer](https://redirect.github.com/aquaproj/aqua-installer) | action | major | `v3.1.0` -> `v4.0.3` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/aquaproj/aqua-installer/badge)](https://securityscorecards.dev/viewer/?uri=github.com/aquaproj/aqua-installer) | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v5`](https://redirect.github.com/actions/checkout/compare/v4...v5) [Compare Source](https://redirect.github.com/actions/checkout/compare/v4...v5) </details> <details> <summary>actions/stale (actions/stale)</summary> ### [`v10`](https://redirect.github.com/actions/stale/compare/v9...v10) [Compare Source](https://redirect.github.com/actions/stale/compare/v9...v10) </details> <details> <summary>amannn/action-semantic-pull-request (amannn/action-semantic-pull-request)</summary> ### [`v6`](https://redirect.github.com/amannn/action-semantic-pull-request/compare/v5...v6) [Compare Source](https://redirect.github.com/amannn/action-semantic-pull-request/compare/v5...v6) </details> <details> <summary>aquaproj/aqua-installer (aquaproj/aqua-installer)</summary> ### [`v4.0.3`](https://redirect.github.com/aquaproj/aqua-installer/releases/tag/v4.0.3) [Compare Source](https://redirect.github.com/aquaproj/aqua-installer/compare/v4.0.2...v4.0.3) 🛡️ Starting from this release, [Immutable Release](https://github.blog/changelog/2025-08-26-releases-now-support-immutability-in-public-preview/) is enabled! ##### SHA256 Checksum ``` d76bb5c3a23025e9d344aeba04c0a4d4ed6c9fb05e85530c8c3be2ef8e8f3a6a aqua-installer ``` [#&#8203;867](https://redirect.github.com/aquaproj/aqua-installer/issues/867) Update the bootstrap aqua version to v2.53.10 ### [`v4.0.2`](https://redirect.github.com/aquaproj/aqua-installer/releases/tag/v4.0.2) [Compare Source](https://redirect.github.com/aquaproj/aqua-installer/compare/v4.0.1...v4.0.2) ##### SHA256 Checksum ``` 98b883756cdd0a6807a8c7623404bfc3bc169275ad9064dc23a6e24ad398f43d aqua-installer ``` ##### Improvement [#&#8203;839](https://redirect.github.com/aquaproj/aqua-installer/issues/839) Use curl's --retry option: `curl --retry 5` ### [`v4.0.1`](https://redirect.github.com/aquaproj/aqua-installer/releases/tag/v4.0.1) [Compare Source](https://redirect.github.com/aquaproj/aqua-installer/compare/v4.0.0...v4.0.1) ##### SHA256 Checksum ``` 42d5b4496020dc97856f5694cfb592ba80949d4918661fd062a5b0bb05d570ce aqua-installer ``` ##### Improvement [#&#8203;835](https://redirect.github.com/aquaproj/aqua-installer/issues/835) Update the bootstrap version of aqua to v2.53.3 As of aqua v2.53.0, aqua supported retrying download of assets. This update enables aqua-installer to retry download of aqua. ### [`v4.0.0`](https://redirect.github.com/aquaproj/aqua-installer/releases/tag/v4.0.0) [Compare Source](https://redirect.github.com/aquaproj/aqua-installer/compare/v3.1.2...v4.0.0) ##### SHA256 Checksum ``` f7fa69dacb234ce9648f3008cef9120a1e59d96c37971e747668c0fada7bec68 aqua-installer ``` ##### ⚠️ Breaking Changes [#&#8203;822](https://redirect.github.com/aquaproj/aqua-installer/issues/822) If you pass a GitHub Access token via environment variable `env`, it would be overridden by the input `github_token`. ```yaml uses: aquaproj/aqua-installer@v2.0.0 env: GITHUB_TOKEN: ${{secrets.PAT}} # This is overridden by ${{github.token}} ``` ##### How to migrate Pass a GitHub access token by the input `github_token`. ```yaml uses: aquaproj/aqua-installer@v2.0.0 with: github_token: ${{secrets.PAT}} ``` ##### Why is this breaking change required? Recently, GitHub updated rate limits for unauthenticated requests. <https://github.blog/changelog/2025-05-08-updated-rate-limits-for-unauthenticated-requests/> As a result, aqua-installer often hits the API rate limit if a GitHub access token isn't passed via environment variable. e.g. <https://github.com/szksh-lab/.github/actions/runs/15082243052/job/42400373723> ``` time="2025-05-17T05:48:24Z" level=error msg="install the registry" aqua_version=2.51.2 env=linux/amd64 error="get a file by Get GitHub Content API: status code 429" program=aqua registry_name=standard time="2025-05-17T05:48:24Z" level=fatal msg="aqua failed" aqua_version=2.51.2 env=linux/amd64 error="it failed to install some registries" program=aqua ``` It failed to download the standard registry by GitHub content API. To resolve the issue, we pass a GitHub actions token by default. And we add the input `github_token` to allow you to change the access token. ##### Features [#&#8203;822](https://redirect.github.com/aquaproj/aqua-installer/issues/822) The input `github_token` is added. You can pass a GitHub access token by input. By default, GitHub Actions token `${{github.token}}` is passed. ##### Others [#&#8203;823](https://redirect.github.com/aquaproj/aqua-installer/issues/823) chore: update the bootstrap version to v2.51.2 ### [`v3.1.2`](https://redirect.github.com/aquaproj/aqua-installer/releases/tag/v3.1.2) [Compare Source](https://redirect.github.com/aquaproj/aqua-installer/compare/v3.1.1...v3.1.2) ##### SHA256 Checksum ``` 9a5afb16da7191fbbc0c0240a67e79eecb0f765697ace74c70421377c99f0423 aqua-installer ``` ##### Fixes [#&#8203;801](https://redirect.github.com/aquaproj/aqua-installer/issues/801) Update the bootstrap version of aqua to v2.48.1 [aquaproj/aqua#3744](https://redirect.github.com/aquaproj/aqua/issues/3744) > \[!CAUTION] > To install aqua v2.48.2-0 or later, please aqua-installer v3.1.2 or later ### [`v3.1.1`](https://redirect.github.com/aquaproj/aqua-installer/releases/tag/v3.1.1) [Compare Source](https://redirect.github.com/aquaproj/aqua-installer/compare/v3.1.0...v3.1.1) ##### SHA256 Checksum ``` e9d4c99577c6b2ce0b62edf61f089e9b9891af1708e88c6592907d2de66e3714 aqua-installer ``` ##### 🐛 Bug Fixes [#&#8203;750](https://redirect.github.com/aquaproj/aqua-installer/issues/750) Fix a bug that aqua-installer doesn't work using Darwin's built-in sha256sum [@&#8203;Takashi-kun](https://redirect.github.com/Takashi-kun) aqua-installer worked well using GNU sha256sum, but it didn't work using Darwin's built-in sha256sum. ```console $ ./aqua-installer [INFO] Installing aqua v2.37.2 for bootstrapping... [INFO] Downloading https://github.com/aquaproj/aqua/releases/download/v2.37.2/aqua_darwin_arm64.tar.gz ... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 6716k 100 6716k 0 0 1227k 0 0:00:05 0:00:05 --:--:-- 1706k [INFO] Verifying checksum of aqua v2.37.2 ... usage: sha256sum [-bctwz] [files ...] $ echo $? 1 ``` </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 10pm,before 3am" in timezone America/Chicago, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DelineaXPM/github-workflows).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
diff --git a/.github/workflows/auto-update-contributors.yml b/.github/workflows/auto-update-contributors.yml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Check for existing open contributors pull request
         id: check_pr
diff --git a/.github/workflows/cache-trunk.yml b/.github/workflows/cache-trunk.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Trunk Check
         uses: trunk-io/trunk-action@75699af9e26881e564e9d832ef7dc3af25ec031b # v1
         with:
diff --git a/.github/workflows/changie-trigger-release.yml b/.github/workflows/changie-trigger-release.yml
@@ -27,7 +27,7 @@ jobs:
     name: dependency-release
     steps:
       - name: checkout-repo
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0 # Ensures a full checkout
       - name: configure-default-git-committer
@@ -45,7 +45,7 @@ jobs:
               echo "Branch exists. Skipping workflow."
               echo "BRANCH_ALREADY_EXISTS=true" >> "$GITHUB_OUTPUT"
           fi
-      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
+      - uses: aquaproj/aqua-installer@ea518c135a02fc11ff8024364510c181a5c6b342 # v4.0.3
         if: steps.check_branch.outputs.BRANCH_ALREADY_EXISTS == 'false'
         with:
           aqua_version: v2.42.2
diff --git a/.github/workflows/conventional-pr.yml b/.github/workflows/conventional-pr.yml
@@ -19,7 +19,7 @@ jobs:
     permissions:
       pull-requests: read
     steps:
-      - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/lint-post-annotations.yml b/.github/workflows/lint-post-annotations.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Trunk Check
         uses: trunk-io/trunk-action@75699af9e26881e564e9d832ef7dc3af25ec031b # v1.2.4
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -23,15 +23,15 @@ jobs:
       contents: read # For repo checkout
     steps:
       - name: checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: set-aqua-policy-if-file-exists
         run: |
           if [[ -f aqua-policy.yaml ]]; then
             echo "AQUA_POLICY_CONFIG=${GITHUB_WORKSPACE}/aqua-policy.yaml:${AQUA_POLICY_CONFIG}" >> $GITHUB_ENV
           else
             echo "👉 No aqua-policy.yaml file found, skipping setting AQUA_POLICY_CONFIG"
           fi
-      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
+      - uses: aquaproj/aqua-installer@ea518c135a02fc11ff8024364510c181a5c6b342 # v4.0.3
         continue-on-error: true
         with:
           aqua_version: v2.42.2
@@ -56,7 +56,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       GITHUB_REF_BRANCH: ${{ github.ref }}
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
           ref: ${{ env.GITHUB_REF_BRANCH }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       # https://github.com/magnetikonline/action-golang-cache
       - name: Setup Golang with cache
@@ -30,7 +30,7 @@ jobs:
           else
             echo "👉 No aqua-policy.yaml file found, skipping setting AQUA_POLICY_CONFIG"
           fi
-      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
+      - uses: aquaproj/aqua-installer@ea518c135a02fc11ff8024364510c181a5c6b342 # v4.0.3
         with:
           aqua_version: v2.42.2
           # working_directory:
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
@@ -21,15 +21,15 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: set-aqua-policy-if-file-exists
         run: |
           if [ -f aqua-policy.yaml ]; then
             echo "AQUA_POLICY_CONFIG=${GITHUB_WORKSPACE}/aqua-policy.yaml:${AQUA_POLICY_CONFIG}" >> $GITHUB_ENV
           else
             echo "👉 No aqua-policy.yaml file found, skipping setting AQUA_POLICY_CONFIG"
           fi
-      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
+      - uses: aquaproj/aqua-installer@ea518c135a02fc11ff8024364510c181a5c6b342 # v4.0.3
         with:
           aqua_version: v2.42.2
           enable_aqua_install: true
@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Config Options: https://github.com/actions/stale#list-of-input-options
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10
         with:
           days-before-stale: 14
           days-before-close: 5
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: set-aqua-policy-if-file-exists
         run: |
           if [[ -f aqua-policy.yaml ]]; then
@@ -43,7 +43,7 @@ jobs:
           else
             echo "👉 No aqua-policy.yaml or .aqua/aqua-policy.yaml file found, skipping setting AQUA_POLICY_CONFIG"
           fi
-      - uses: aquaproj/aqua-installer@f13c5d2f0357708d85477aabe50fd3f725528745 # v3.1.0
+      - uses: aquaproj/aqua-installer@ea518c135a02fc11ff8024364510c181a5c6b342 # v4.0.3
         with:
           aqua_version: v2.42.2
           enable_aqua_install: true
