chore(deps): bump the actions-core group across 1 directory with 3 updates

[dependabot]

Bumps the actions-core group with 3 updates in the / directory: actions/checkout, actions/setup-node and actions/setup-go.

Updates actions/checkout from 6.0.3 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates actions/setup-node from 6 to 7

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Updates actions/setup-go from 6 to 7

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-go#763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-go#771

New Contributors

• @​philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in actions/setup-go#744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in actions/setup-go#755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-go#758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in actions/setup-go#762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in actions/setup-go#744
• @​jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

• Add go-download-base-url input for custom Go distributions by @​gdams in actions/setup-go#721

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-go#727

Documentation update

• Rearrange README.md, add advanced-usage.md by @​priyagupta108 in actions/setup-go#724
• Fix Microsoft build of Go link by @​gdams in actions/setup-go#734

New Contributors

• @​gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

• Update default Go module caching to use go.mod by @​priyagupta108 in actions/setup-go#705
• Fix golang download url to go.dev by @​178inaba in actions/setup-go#469

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

• b7ad1da chore(deps): bump @​actions/cache to 6.2.0 (#771)
• 0778a10 Migrate to ESM and upgrade dependencies (#763)
• See full diff in compare view

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	29 file(s)	✅ success
Action Lint	29 file(s)	❌ failure
Pinned Actions	29 file(s)	❌ failure
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	29 file(s)	✅ success
Shell Check	29 file(s)	✅ success
README Check	29 file(s)	✅ success
Composite Schema	no changes	⏭️ skipped
Deployment Matrix	no changes	⏭️ skipped

❌ Failures (2)

Action Lint

.github

• .github (line 585) — �[31m❌ [actionlint] The command ran successfully and some problem was found (found 4 errors, linted 29 files), exit code: 1�[0m

.github/workflows/go-ci.yml

• .github/workflows/go-ci.yml (line 171) — shellcheck reported issue in this script: SC2162:info:13:39: read without -r will mangle backslashes
• .github/workflows/go-ci.yml (line 171) — shellcheck reported issue in this script: SC2086:info:23:43: Double quote to prevent globbing and word splitting
• .github/workflows/go-ci.yml (line 171) — shellcheck reported issue in this script: SC2086:info:15:15: Double quote to prevent globbing and word splitting
• .github/workflows/go-ci.yml (line 171) — shellcheck reported issue in this script: SC2086:info:14:13: Double quote to prevent globbing and word splitting

Pinned Actions

.github/workflows/go-ci.yml

• .github/workflows/go-ci.yml (line 162) — External action not pinned by SHA: uses: actions/checkout@v7.0.1 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 149) — External action not pinned by SHA: uses: golangci/golangci-lint-action@v9 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 143) — External action not pinned by SHA: uses: actions/setup-go@v7 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 140) — External action not pinned by SHA: uses: actions/checkout@v7.0.1 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 129) — External action not pinned by SHA: uses: fgrosse/go-coverage-report@v1.3.0 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 124) — External action not pinned by SHA: uses: actions/download-artifact@v8 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 121) — External action not pinned by SHA: uses: actions/checkout@v7.0.1 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 104) — External action not pinned by SHA: uses: actions/upload-artifact@v7 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 85) — External action not pinned by SHA: uses: actions/setup-go@v7 (use full commit SHA with a # vX.Y.Z comment)
• .github/workflows/go-ci.yml (line 82) — External action not pinned by SHA: uses: actions/checkout@v7.0.1 (use full commit SHA with a # vX.Y.Z comment)

⚠️ Warnings (3)

Pinned Actions

.github

• .github (line 170) — Found 2 internal action(s) not pinned to a version. Consider pinning to vX.Y.Z.

.github/workflows/release-notification.yml

• .github/workflows/release-notification.yml (line 183) — Internal composite must use floating major tag (e.g. @v1) or develop/main for testing: uses: LerianStudio/github-actions-shared-workflows/src/notify/slack-release@v1.18.0
• .github/workflows/release-notification.yml (line 171) — Internal composite must use floating major tag (e.g. @v1) or develop/main for testing: uses: LerianStudio/github-actions-shared-workflows/src/notify/discord-release@v1.18.0

---

_{🔍 View full scan logs}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

Found 4 issue(s): 4 Medium

Severity	Rule	File	Message
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:164	Potential unsafe checkout of untrusted pull request on non-privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:182	Potential unsafe checkout of untrusted pull request on non-privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/build.yml:296	Potential unsafe checkout of untrusted pull request on non-privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/version-propagation.yml:62	Potential unsafe checkout of untrusted pull request on non-privileged workflow.

---

_{🔍 View full scan logs | 🛡️ Security tab}