Skip to content

chore(deps): update actions/setup-node action to v7 #169

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SamuelIVX merged 1 commit into from
Jul 21, 2026
Merged

chore(deps): update actions/setup-node action to v7 #169

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/linter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
fetch-depth: 0

- name: Setup Node.js
uses: actions/setup-node@v6
uses: actions/setup-node@v7

@coderabbitai coderabbitai Bot Jul 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== workflow excerpt ==\n'
cat -n .github/workflows/linter.yml | sed -n '1,80p'

printf '\n== repo policy search ==\n'
rg -n --hidden -S "actions/setup-node|pin.*SHA|full commit SHA|mutable tag|Dependabot|workflow" .github README* .github 2>/dev/null || true

Repository: SamuelIVX/SamuelIVX.github.io

Length of output: 2577

🌐 Web query:

GitHub Actions actions/setup-node latest major version official releases v7

💡 Result:

As of July 20, 2026, the latest major version of the GitHub Actions setup-node action is v7.0.0, which was officially released on July 14, 2026 [1][2]. Key information regarding this release: - Major Changes: The v7.0.0 release includes a migration to ECMAScript Modules (ESM) to support the latest @actions/* package versions [3][4]. It also includes an upgrade of the underlying action from node20 to node24 [5][4]. - Compatibility Requirements: To ensure compatibility with v7.0.0, your runner must be on version v2.327.1 or later [5][4]. The project continues to maintain the v6.x series concurrently, with v6.5.0 also released on July 14, 2026, primarily to update dependencies like @actions/cache [1][6]. Users are encouraged to review the full release notes on the official GitHub repository for detailed change logs and migration guidance [1][2].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== workflow refs ==\n'
rg -n "uses:\s+[^@]+@" .github/workflows -S

printf '\n== action pinning patterns ==\n'
rg -n "uses:\s+[^@]+@[0-9a-f]{7,40}" .github/workflows -S || true

printf '\n== workflow files ==\n'
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
  [ -e "$f" ] || continue
  echo "--- $f"
  cat -n "$f" | sed -n '1,120p'
done

Repository: SamuelIVX/SamuelIVX.github.io

Length of output: 6932

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== renovate config ==\n'
if [ -f .github/renovate.json ]; then
  cat -n .github/renovate.json | sed -n '1,240p'
fi

printf '\n== renovate-related files ==\n'
rg -n --hidden -S "github-actions|actions/|renovate" .github . 2>/dev/null | sed -n '1,200p' || true

Repository: SamuelIVX/SamuelIVX.github.io

Length of output: 7118

Pin actions/setup-node to a full commit SHA.

@v7 is a mutable tag. Pin it to the release commit and let Renovate handle future updates.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/linter.yml at line 22, Update the actions/setup-node step
to reference the full immutable commit SHA for the intended v7 release instead
of the mutable `@v7` tag, preserving Renovate compatibility for future updates.

Source: Linters/SAST tools

with:
node-version: 24

Expand Down