chore(actions): update github actions to v6#1731

Open

renovate[bot] wants to merge 1 commit into

mainfrom

renovate/major-6-github-actions

renovate Bot commented Jun 29, 2026 •

edited

Loading

Contributor

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v4` → `v6`
docker/metadata-action	action	major	`v5` → `v6`

Dependency PRs must keep npm run test:ci passing. The 97% coverage requirement is enforced as Codecov patch coverage on changed lines (codecov/patch), so dependency-only bumps satisfy it without new tests.

GitHub Actions updates must remain SHA-pinned.

Renovate is the sole dependency and security-update bot for this repo; GitHub Dependabot security updates are disabled to avoid duplicate PRs (e.g. the two hono advisory PRs).

Release Notes

actions/checkout (actions/checkout)

`v6.0.3`

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v6.0.2`

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

`v6.0.1`

Add worktree support for persist-credentials includeIf by @ericsciple in #2327

`v6.0.0`

Persist creds to a separate file by @ericsciple in #2286
Update README to include Node.js 24 support details and requirements by @salmanmkc in #2248

`v6`

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v5.0.1`

Port v6 cleanup to v5 by @ericsciple in #2301

`v5.0.0`

Update actions checkout to use node 24 by @salmanmkc in #2226

`v5`

Port v6 cleanup to v5 by @ericsciple in #2301

`v4.3.1`

Port v6 cleanup to v4 by @ericsciple in #2305

`v4.3.0`

docs: update README.md by @motss in #1971
Add internal repos for checking out multiple repositories by @mouismail in #1977
Documentation update - add recommended permissions to Readme by @benwells in #2043
Adjust positioning of user email note and permissions heading by @joshmgross in #2044
Update README.md by @nebuk89 in #2194
Update CODEOWNERS for actions by @TingluoHuang in #2224
Update package dependencies by @salmanmkc in #2236

`v4.2.2`

url-helper.ts now leverages well-known environment variables by @jww3 in #1941
Expand unit test coverage for isGhes by @jww3 in #1946

`v4.2.1`

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in #1924

`v4.2.0`

Add Ref and Commit outputs by @lucacome in #1180
Dependency updates by @dependabot- #1777, #1872

`v4.1.7`

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in #1739
Bump actions/checkout from 3 to 4 by @dependabot in #1697
Check out other refs/* by commit by @orhantoy in #1774
Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in #1776

`v4.1.6`

Check platform to set archive extension appropriately by @cory-miller in #1732

`v4.1.5`

Update NPM dependencies by @cory-miller in #1703
Bump github/codeql-action from 2 to 3 by @dependabot in #1694
Bump actions/setup-node from 1 to 4 by @dependabot in #1696
Bump actions/upload-artifact from 2 to 4 by @dependabot in #1695
README: Suggest user.email to be 41898282+github-actions[bot]@users.noreply.github.com by @cory-miller in #1707

`v4.1.4`

Disable extensions.worktreeConfig when disabling sparse-checkout by @jww3 in #1692
Add dependabot config by @cory-miller in #1688
Bump the minor-actions-dependencies group with 2 updates by @dependabot in #1693
Bump word-wrap from 1.2.3 to 1.2.5 by @dependabot in #1643

`v4.1.3`

Check git version before attempting to disable sparse-checkout by @jww3 in #1656
Add SSH user parameter by @cory-miller in #1685
Update actions/checkout version in update-main-version.yml by @jww3 in #1650

`v4.1.2`

Fix: Disable sparse checkout whenever sparse-checkout option is not present @dscho in #1598

`v4.1.1`

Correct link to GitHub Docs by @peterbe in #1511
Link to release page from what's new section by @cory-miller in #1514

`v4.1.0`

Add support for partial checkout filters

docker/metadata-action (docker/metadata-action)

`v6.1.0`

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in #613
Bump brace-expansion from 1.1.12 to 5.0.6 in #658 #630
Bump csv-parse from 6.1.0 to 6.2.1 in #617
Bump fast-xml-parser from 5.4.2 to 5.8.0 in #620
Bump flatted from 3.3.3 to 3.4.2 in #623
Bump glob from 10.3.15 to 10.5.0 in #621
Bump handlebars from 4.7.8 to 4.7.9 in #629
Bump lodash from 4.17.23 to 4.18.1 in #639
Bump moment-timezone from 0.6.0 to 0.6.1 in #619
Bump picomatch from 4.0.3 to 4.0.4 in #626
Bump postcss from 8.5.6 to 8.5.10 in #649
Bump tar from 6.2.1 to 7.5.15 in #657
Bump undici from 6.23.0 to 6.25.0 in #614
Bump vite from 7.3.1 to 7.3.2 in #637

Full Changelog: docker/metadata-action@v6.0.0...v6.1.0

`v6.0.0`

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #605
List inputs now preserve # inside values while still supporting full-line # comments by @crazy-max in #607
Switch to ESM and update config/test wiring by @crazy-max in #602
Bump lodash from 4.17.21 to 4.17.23 in #588
Bump @actions/core from 1.11.1 to 3.0.0 in #599
Bump @actions/github from 6.0.1 to 9.0.0 in #597
Bump @docker/actions-toolkit from 0.68.0 to 0.79.0 in #604
Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in #600
Bump semver from 7.7.3 to 7.7.4 in #603

Full Changelog: docker/metadata-action@v5.10.0...v6.0.0

`v6`

`v5.10.0`

Bump @docker/actions-toolkit from 0.66.0 to 0.68.0 in #559 #569
Bump js-yaml from 3.14.1 to 3.14.2 in #564

Full Changelog: docker/metadata-action@v5.9.0...v5.10.0

`v5.9.0`

Add tag-names output to return tag names without image base name by @crazy-max in #553
Bump @babel/runtime-corejs3 from 7.14.7 to 7.28.2 in #539
Bump @docker/actions-toolkit from 0.62.1 to 0.66.0 in #555
Bump brace-expansion from 1.1.11 to 1.1.12 in #540
Bump csv-parse from 5.6.0 to 6.1.0 in #532
Bump semver from 7.7.2 to 7.7.3 in in #554
Bump tmp from 0.2.3 to 0.2.5 in #541

Full Changelog: docker/metadata-action@v5.8.0...v5.9.0

`v5.8.0`

New is_not_default_branch global expression by @crazy-max in #535
Allow to match part of the git tag or value for semver/pep440 types by @crazy-max in #536 #537
Bump @actions/github from 6.0.0 to 6.0.1 in #523
Bump @docker/actions-toolkit from 0.56.0 to 0.62.1 in #526
Bump form-data from 2.5.1 to 2.5.5 in #533
Bump moment-timezone from 0.5.47 to 0.6.0 in #525
Bump semver from 7.7.1 to 7.7.2 in #524

Full Changelog: docker/metadata-action@v5.7.0...v5.8.0

`v5.7.0`

Global expressions support for labels and annotations by @crazy-max in #489
Support disabling outputs as environment variables by @omus in #497
Bump @docker/actions-toolkit from 0.44.0 to 0.56.0 in #507 #509
Bump csv-parse from 5.5.6 to 5.6.0 in #482
Bump moment-timezone from 0.5.46 to 0.5.47 in #501
Bump semver from 7.6.3 to 7.7.1 in #504

Full Changelog: docker/metadata-action@v5.6.1...v5.7.0

`v5.6.1`

Fix GitHub API request fallback for commit date by @crazy-max in #478
Revert to default commit SHA length of 7 by @crazy-max in #480

Full Changelog: docker/metadata-action@v5.6.0...v5.6.1

`v5.6.0`

Add commit_date global expression by @trim21 in #471 #475
Increase short commit sha length to 12 for uniqueness by @crazy-max in #467
Bump @actions/core from 1.10.1 to 1.11.1 #460
Bump @docker/actions-toolkit from 0.16.1 to 0.44.0 #391 #399 #413 #441
Bump braces from 3.0.2 to 3.0.3 #424
Bump cross-spawn from 7.0.3 to 7.0.5 #474
Bump csv-parse from 5.5.5 to 5.5.6 #412
Bump moment-timezone from 0.5.44 to 0.5.46 #383 #470 #459
Bump path-to-regexp from 6.2.2 to 6.3.0 #454
Bump semver from 7.6.0 to 7.6.3 #400 #411 #440
Bump undici from 5.26.3 to 5.28.4 #386 #402

Full Changelog: docker/metadata-action@v5.5.1...v5.6.0

`v5.5.1`

Don't set cwd:// prefix for local bake files by @crazy-max in #382

Full Changelog: docker/metadata-action@v5.5.0...v5.5.1

`v5.5.0`

Set cwd:// prefix for bake files path by @crazy-max in #370
Bump @docker/actions-toolkit from 0.16.0 to 0.16.1 in #371
Bump moment from 2.29.4 to 2.30.1 in #373
Bump moment-timezone from 0.5.43 to 0.5.44 in #374

Full Changelog: docker/metadata-action@v5.4.0...v5.5.0

`v5.4.0`

Bump @docker/actions-toolkit from 0.15.0 to 0.16.0 in #369
Bump csv-parse from 5.5.2 to 5.5.3 in #365

Full Changelog: docker/metadata-action@v5.3.0...v5.4.0

`v5.3.0`

Bump @docker/actions-toolkit from 0.14.0 to 0.15.0 in #363 (fixes #362)

Full Changelog: docker/metadata-action@v5.2.0...v5.3.0

`v5.2.0`

Custom annotations support by @crazy-max in #361

Full Changelog: docker/metadata-action@v5.1.0...v5.2.0

`v5.1.0`

Annotations support by @crazy-max in #352
Split bake definition into two files by @crazy-max in #353
Allow images input to be empty to output bare tags by @crazy-max in #358
Bump @actions/github from 5.1.1 to 6.0.0 in #348
Bump @babel/traverse from 7.17.3 to 7.23.2 in #350
Bump @docker/actions-toolkit from 0.12.0 to 0.14.0 in #349 #357
Bump csv-parse from 5.5.0 to 5.5.2 in #346
Bump semver from 7.5.3 to 7.5.4 in #335

Full Changelog: docker/metadata-action@v5.0.0...v5.1.0

Configuration

📅 Schedule: (in timezone America/Phoenix)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot requested a review from JSONbored as a code owner

June 29, 2026 09:33

renovate Bot assigned JSONbored

codecov Bot commented Jun 29, 2026 •

edited

Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.59%. Comparing base (29da3b1) to head (5829e7a).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1731   +/-   ##
=======================================
  Coverage   95.59%   95.59%           
=======================================
  Files         204      204           
  Lines       22316    22316           
  Branches     8067     8067           
=======================================
  Hits        21332    21332           
  Misses        408      408           
  Partials      576      576

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

renovate Bot force-pushed the renovate/major-6-github-actions branch 2 times, most recently from 438f7a2 to a8f12f7 Compare

June 29, 2026 11:07


          chore(actions): update github actions to v6

5829e7a

renovate Bot force-pushed the renovate/major-6-github-actions branch from a8f12f7 to 5829e7a Compare

June 29, 2026 12:10

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet