build(deps): bump the github-actions group with 6 updates by dependabot[bot] · Pull Request #156 · Staffbase/gitops-github-action

dependabot · 2026-08-01T06:03:21Z

Bumps the github-actions group with 6 updates:

Package	From	To
docker/setup-buildx-action	`4.1.0`	`4.2.0`
docker/login-action	`4.2.0`	`4.5.1`
docker/build-push-action	`7.2.0`	`7.3.0`
actions/checkout	`7.0.0`	`7.0.1`
jdx/mise-action	`4.2.0`	`4.2.3`
Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml	`14.1.0`	`15.1.1`

Updates docker/setup-buildx-action from 4.1.0 to 4.2.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.2.0

Preserve names in esbuild bundle by @crazy-max in docker/setup-buildx-action#572

Bump @actions/core from 3.0.0 to 3.0.1 in docker/setup-buildx-action#551

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/setup-buildx-action#557 docker/setup-buildx-action#580

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/setup-buildx-action#573

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-buildx-action#576

Bump js-yaml from 4.1.1 to 5.2.0 in docker/setup-buildx-action#562

Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-buildx-action#577

Bump tmp from 0.2.5 to 0.2.7 in docker/setup-buildx-action#556

Bump undici from 6.25.0 to 6.27.0 in docker/setup-buildx-action#570

Bump vite from 7.3.2 to 7.3.6 in docker/setup-buildx-action#569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

Commits

bb05f3f Merge pull request #580 from docker/dependabot/npm_and_yarn/docker/actions-to...
321c814 [dependabot skip] chore: update generated content
b9a36ef build(deps): bump @docker/actions-toolkit from 0.91.0 to 0.92.0
ebeab24 Merge pull request #570 from docker/dependabot/npm_and_yarn/undici-6.27.0
5c7b8ae [dependabot skip] chore: update generated content
037e618 build(deps): bump undici from 6.25.0 to 6.27.0
66080e5 Merge pull request #577 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
409aef0 Merge pull request #562 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
49c6e42 build(deps): bump sigstore from 4.1.0 to 4.1.1
2211273 [dependabot skip] chore: update generated content
Additional commits viewable in compare view

Updates docker/login-action from 4.2.0 to 4.5.1

Release notes

Sourced from docker/login-action's releases.

v4.5.1

Support dhi.io as Docker Hub OIDC registry by @crazy-max in docker/login-action#1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Docker Hub OIDC login support by @crazy-max in docker/login-action#1048

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1091.0 in docker/login-action#1037

Bump @docker/actions-toolkit from 0.92.0 to 0.94.0 in docker/login-action#1044 docker/login-action#1050

Bump brace-expansion from 1.1.13 to 1.1.16 in docker/login-action#1046

Bump js-yaml from 5.2.0 to 5.2.1 in docker/login-action#1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

Skip empty registry-auth secret mask by @crazy-max in docker/login-action#1035

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1077.0 docker/login-action#1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Preserve names in esbuild bundle by @crazy-max in docker/login-action#1022

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 docker/login-action#999 docker/login-action#1030

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/login-action#1004 docker/login-action#1027

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/login-action#1023

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/login-action#1029

Bump http-proxy-agent and https-proxy-agent to 9.1.0 in docker/login-action#1017

Bump js-yaml from 4.1.1 to 5.2.0 in docker/login-action#1028

Bump sigstore from 4.1.0 to 4.1.1 in docker/login-action#1031

Bump tmp from 0.2.5 to 0.2.7 in docker/login-action#1002

Bump undici from 6.24.1 to 6.27.0 in docker/login-action#1020

Bump vite from 7.3.3 to 7.3.6 in docker/login-action#1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

Commits

abd2ef4 Merge pull request #1055 from crazy-max/test-registry-auth-oidc
d49d3a9 Merge pull request #1054 from crazy-max/oidc-missing-dhi
b58b17c test: cover Docker Hub OIDC with registry-auth
be646c2 chore: update generated content
d77c059 support dhi.io as Docker Hub OIDC registry
06fb636 Merge pull request #1037 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
a8bc953 [dependabot skip] chore: update generated content
f54b901 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
77f18f6 Merge pull request #1049 from docker/dependabot/github_actions/codeql-actions...
ec0bf28 Merge pull request #1050 from docker/dependabot/npm_and_yarn/docker/actions-t...
Additional commits viewable in compare view

Updates docker/build-push-action from 7.2.0 to 7.3.0

Release notes

Sourced from docker/build-push-action's releases.

v7.3.0

Preserve names in esbuild bundle by @crazy-max in docker/build-push-action#1567

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/build-push-action#1545 docker/build-push-action#1572

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/build-push-action#1568

Bump js-yaml from 4.1.1 to 4.3.0 in docker/build-push-action#1566

Bump tmp from 0.2.5 to 0.2.7 in docker/build-push-action#1547

Bump undici from 6.24.1 to 6.27.0 in docker/build-push-action#1564

Bump vite from 7.3.2 to 7.3.6 in docker/build-push-action#1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

Commits

53b7df9 Merge pull request #1572 from docker/dependabot/npm_and_yarn/docker/actions-t...
154298c [dependabot skip] chore: update generated content
cb1238b chore(deps): Bump @docker/actions-toolkit from 0.91.0 to 0.92.0
24f845d Merge pull request #1566 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
9c69730 [dependabot skip] chore: update generated content
bc3a3a5 Merge pull request #1574 from docker/dependabot/github_actions/aws-actions/co...
a82c504 chore(deps): Bump js-yaml from 4.1.1 to 4.3.0
0285a75 Merge pull request #1573 from docker/dependabot/github_actions/actions/cache-...
c6ad2a3 Merge pull request #1575 from docker/dependabot/github_actions/actions/checko...
d37484f Merge pull request #1564 from docker/dependabot/npm_and_yarn/undici-6.27.0
Additional commits viewable in compare view

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

Skip running unsafe pr check if input is default by @aiqiaoy in actions/checkout#2518

Trim only ascii whitespace for branch by @aiqiaoy in actions/checkout#2521

Escape values passed to --unset by @aiqiaoy in actions/checkout#2530

Various dependency updates

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Various dependency updates

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

3d3c42e prep v7.0.1 release (#2531)
2880268 escape values passed to --unset (#2530)
12cd223 trim only ascii whitespace for branch (#2521)
62661c4 skip running unsafe pr check if input is default (#2518)
e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
631c942 eslint 9 (#2474)
4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
ba09753 Bump actions/checkout from 6 to 7 (#2488)
b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
Additional commits viewable in compare view

Updates jdx/mise-action from 4.2.0 to 4.2.3

Release notes

Sourced from jdx/mise-action's releases.

v4.2.3: Restore mise PATH propagation

A patch release that restores mise's PATH propagation to subsequent workflow steps — without reintroducing the full-PATH snapshot behavior that v4.2.1 fixed.

Fixed

Export mise PATH entries to subsequent steps (#575) by @jdx

v4.2.1 stopped exporting the complete PATH returned by mise env --json into GITHUB_ENV, which correctly prevented snapshotting the runner's environment into subsequent steps. However, that also dropped mise-produced PATH entries — tool shims, [env] _.path directories, and similar — that workflows relied on after the setup step. See #565.

The action now computes only the prefix that mise prepended to the existing PATH and forwards those directories individually through GITHUB_PATH. This preserves mise's configured ordering, composes cleanly with PATH changes from other actions, and never persists the runner's full PATH through GITHUB_ENV. The dotenv fallback path (used with older mise versions) also strips PATH= lines and re-derives additions from mise env --json.

A new export_path input (default true) lets workflows keep regular env exports while opting out of PATH changes:
- uses: jdx/mise-action@v4
  with:
    export_path: false # keep env vars, skip mise PATH additions
Full Changelog: jdx/mise-action@v4.2.2...v4.2.3

v4.2.2: Zstd tar fallback for older runners

A small patch release that fixes archive selection on runners with an older tar and corrects a stale default in the README.

Fixed

Verify tar supports Zstd before picking .tar.zst (#569 by @JackMyers001

The action previously chose the .tar.zst mise archive whenever zstd --version succeeded, then extracted it with tar --zstd. On RHEL 8-compatible runners that ship zstd 1.4.4 alongside GNU tar 1.30, the --zstd option isn't recognized and installation failed.

Detection now runs both checks:
zstd --version
tar --zstd --version
If either fails, the action falls back to the .tar.gz archive. No configuration change is required — existing workflows on affected runners just start working again. Fixes #568.

Documentation

Update the cache_key_prefix example in the README to reflect the current default of mise-v1 (previously documented as mise-v0) (#570 by @muzimuzhi).

New Contributors

@JackMyers001 made their first contribution in #569

@muzimuzhi made their first contribution in #570

Full Changelog: jdx/mise-action@v4.2.1...v4.2.2

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

4.2.3 - 2026-07-24

🐛 Bug Fixes

export mise path entries to subsequent steps (#575) by @jdx in #575

4.2.2 - 2026-07-24

🐛 Bug Fixes

(release-plz) exit when git-cliff produces no version bump (#566) by @jdx in #566

ensure tar supports Zstd (#569) by @JackMyers001 in #569

📚 Documentation

update default value of cache_key_prefix (#570) by @muzimuzhi in #570

New Contributors

@muzimuzhi made their first contribution in #570

@JackMyers001 made their first contribution in #569

4.2.1 - 2026-07-16

🐛 Bug Fixes

verify mise downloads with signed checksums (#548) by @jdx in #548

exclude PATH from environment export (#556) by @jdx in #556

🔍 Other Changes

Enable Entire for Codex (#529) by @jdx in #529

⚙️ Miscellaneous Tasks

(ci) automate weekly releases (#557) by @jdx in #557

(release) skip ai reviews for release prs (#549) by @jdx in #549

4.2.0 - 2026-06-17

🚀 Features

support bootstrap mode (#522) by @jdx in #522

... (truncated)

Commits

9e7f763 chore: release v4.2.3 (#578)
0f85637 fix: export mise path entries to subsequent steps (#575)
a24c375 chore(deps): migrate to aube lockfile (#576)
f10502f chore: release v4.2.2 (#567)
5df6b79 chore(deps): update zizmorcore/zizmor-action action to v0.6.0 (#574)
be707ec chore(deps): update jdx/mise-action action to v4.2.1 (#572)
d0f7879 chore(deps): update github/codeql-action action to v4.37.1 (#571)
fc371b7 docs: update default value of cache_key_prefix (#570)
5c77551 fix: ensure tar supports Zstd (#569)
a63ca4f fix(release-plz): exit when git-cliff produces no version bump (#566)
Additional commits viewable in compare view

Updates Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml from 14.1.0 to 15.1.1

Release notes

Sourced from Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml's releases.

Version 15.1.1 🌈

Changes

Update GitOps action to version 8.0.1 @monotek (#474)

📝 Documentation

📝 Update Readme Versions @staffbase-actions[bot] (#473)

Version 15.1.0 🌈

Changes

🚀 Features

fix(techdocs): publish only changed components on push @flaxel (#464)

📝 Documentation

📝 Update Readme Versions @staffbase-actions[bot] (#472)

Version 15.0.0 🌈

Changes

Update GitOps action to version 8.0.0 @monotek (#471)

This will enable the docker-tag-timestamp setting by default, creating image tags like: my-service:main-20260625131302-9999270a.

Set it to "false" if you want to make your image tags look like this again: my-service:main-9999270a

📝 Documentation

📝 Update Readme Versions @staffbase-actions[bot] (#466)

🚨 Dependencies

chore(deps): bump Staffbase/autodev-action from 2.8.1 to 2.9.0 @dependabot[bot] (#468)

chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 @dependabot[bot] (#470)

chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.4.0 @dependabot[bot] (#469)

chore(deps): bump Staffbase/gitops-github-action from 7.6.1 to 7.7.0 @dependabot[bot] (#467)

Commits

a380884 Merge pull request #474 from Staffbase/monotek-patch-1
5051dca Merge pull request #473 from Staffbase/update-readme
ff2d856 Update GitOps action to version 8.0.1
1f62c2d 📝 update readme versions
f5e49d0 Merge pull request #464 from Staffbase/claude/youthful-curie-e9k9aq
7104aea fix(techdocs): add trailing newline to monorepo template
b03ac1b ⏪ Revert logic change
13afb33 Merge pull request #472 from Staffbase/update-readme
c21d00e 📝 update readme versions
5968460 Merge pull request #468 from Staffbase/dependabot/github_actions/Staffbase/au...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.2.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.5.1` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.2.0` | `7.3.0` | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [jdx/mise-action](https://github.com/jdx/mise-action) | `4.2.0` | `4.2.3` | | [Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml](https://github.com/staffbase/gha-workflows) | `14.1.0` | `15.1.1` | Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@d7f5e7f...bb05f3f) Updates `docker/login-action` from 4.2.0 to 4.5.1 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...abd2ef4) Updates `docker/build-push-action` from 7.2.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@f9f3042...53b7df9) Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `jdx/mise-action` from 4.2.0 to 4.2.3 - [Release notes](https://github.com/jdx/mise-action/releases) - [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md) - [Commits](jdx/mise-action@e6a8b39...9e7f763) Updates `Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml` from 14.1.0 to 15.1.1 - [Release notes](https://github.com/staffbase/gha-workflows/releases) - [Commits](Staffbase/gha-workflows@7433384...a380884) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: jdx/mise-action dependency-version: 4.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml dependency-version: 15.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update an action file github_actions Pull requests that update GitHub Actions code major Pull requests with breakable changes labels Aug 1, 2026

dependabot Bot requested review from a team as code owners August 1, 2026 06:03

dependabot Bot requested review from kaitimmer and monotek August 1, 2026 06:03

dependabot Bot added the dependencies Pull requests that update an action file label Aug 1, 2026

dependabot Bot requested review from axdotl and flaxel August 1, 2026 06:03

dependabot Bot added github_actions Pull requests that update GitHub Actions code major Pull requests with breakable changes labels Aug 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the github-actions group with 6 updates - #156

build(deps): bump the github-actions group with 6 updates#156
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-04ebd7b092

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

v4.2.0

v4.5.1

v4.5.0

v4.4.0

v4.3.0

v7.3.0

v7.0.1

What's Changed

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.3: Restore mise PATH propagation

Fixed

Export mise PATH entries to subsequent steps (#575) by @​jdx

v4.2.2: Zstd tar fallback for older runners

Fixed

Verify tar supports Zstd before picking .tar.zst (#569 by @​JackMyers001

Documentation

New Contributors

Changelog

4.2.3 - 2026-07-24

🐛 Bug Fixes

4.2.2 - 2026-07-24

🐛 Bug Fixes

📚 Documentation

New Contributors

4.2.1 - 2026-07-16

🐛 Bug Fixes

🔍 Other Changes

⚙️ Miscellaneous Tasks

4.2.0 - 2026-06-17

🚀 Features

Version 15.1.1 🌈

Changes

📝 Documentation

Version 15.1.0 🌈

Changes

🚀 Features

📝 Documentation

Version 15.0.0 🌈

Changes

📝 Documentation

🚨 Dependencies

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Export mise PATH entries to subsequent steps (#575) by `@jdx`

Verify `tar` supports Zstd before picking `.tar.zst` (#569 by `@JackMyers001`