chore(deps): update actions/setup-node action to v7#169
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe linter workflow updates its Node.js setup step from ChangesLinter workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8).github/workflows/linter.ymlTraceback (most recent call last): Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/linter.yml:
- Line 22: Update the actions/setup-node step to reference the full immutable
commit SHA for the intended v7 release instead of the mutable `@v7` tag,
preserving Renovate compatibility for future updates.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 300a1fb8-3aa1-4c52-9408-2cb4ee2262ef
📒 Files selected for processing (1)
.github/workflows/linter.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: Analyze (actions)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Lint Code Base
🧰 Additional context used
🪛 zizmor (1.26.1)
.github/workflows/linter.yml
[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v6 | ||
| uses: actions/setup-node@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== workflow excerpt ==\n'
cat -n .github/workflows/linter.yml | sed -n '1,80p'
printf '\n== repo policy search ==\n'
rg -n --hidden -S "actions/setup-node|pin.*SHA|full commit SHA|mutable tag|Dependabot|workflow" .github README* .github 2>/dev/null || trueRepository: SamuelIVX/SamuelIVX.github.io
Length of output: 2577
🌐 Web query:
GitHub Actions actions/setup-node latest major version official releases v7
💡 Result:
As of July 20, 2026, the latest major version of the GitHub Actions setup-node action is v7.0.0, which was officially released on July 14, 2026 [1][2]. Key information regarding this release: - Major Changes: The v7.0.0 release includes a migration to ECMAScript Modules (ESM) to support the latest @actions/* package versions [3][4]. It also includes an upgrade of the underlying action from node20 to node24 [5][4]. - Compatibility Requirements: To ensure compatibility with v7.0.0, your runner must be on version v2.327.1 or later [5][4]. The project continues to maintain the v6.x series concurrently, with v6.5.0 also released on July 14, 2026, primarily to update dependencies like @actions/cache [1][6]. Users are encouraged to review the full release notes on the official GitHub repository for detailed change logs and migration guidance [1][2].
Citations:
- 1: https://github.com/actions/setup-node/releases
- 2: https://github.com/actions/setup-node/releases/tag/v7.0.0
- 3: actions/setup-node@v6...v7
- 4: https://git.gorbe.io/actions/setup-node
- 5: https://github.com/actions/setup-node
- 6: https://github.com/actions/setup-node/releases/tag/v6.5.0
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== workflow refs ==\n'
rg -n "uses:\s+[^@]+@" .github/workflows -S
printf '\n== action pinning patterns ==\n'
rg -n "uses:\s+[^@]+@[0-9a-f]{7,40}" .github/workflows -S || true
printf '\n== workflow files ==\n'
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -e "$f" ] || continue
echo "--- $f"
cat -n "$f" | sed -n '1,120p'
doneRepository: SamuelIVX/SamuelIVX.github.io
Length of output: 6932
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== renovate config ==\n'
if [ -f .github/renovate.json ]; then
cat -n .github/renovate.json | sed -n '1,240p'
fi
printf '\n== renovate-related files ==\n'
rg -n --hidden -S "github-actions|actions/|renovate" .github . 2>/dev/null | sed -n '1,200p' || trueRepository: SamuelIVX/SamuelIVX.github.io
Length of output: 7118
Pin actions/setup-node to a full commit SHA.
@v7 is a mutable tag. Pin it to the release commit and let Renovate handle future updates.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/linter.yml at line 22, Update the actions/setup-node step
to reference the full immutable commit SHA for the intended v7 release instead
of the mutable `@v7` tag, preserving Renovate compatibility for future updates.
Source: Linters/SAST tools
1 participant
This PR contains the following updates:
v6→v7Release Notes
actions/setup-node (actions/setup-node)
v7.0.0Compare Source
What's Changed
Enhancements:
Bug fixes:
mirrorTokeningetManifestif it's provided by @deiga in #1548Documentation updates:
Dependency update:
New Contributors
Full Changelog: actions/setup-node@v6...v7.0.0
v7Compare Source
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.