chore(deps): update github actions (major)

Metadata

Project: craft-actions
Number: #68
Type: pull request
State: merged
Author: renovate[bot]
Labels: dependencies
Created: 2026-07-04 03:14 AM UTC
Updated: 2026-07-06 01:10 PM UTC
Closed: 2026-07-06 01:09 PM UTC

Current evaluation

Renovate's major GitHub Actions bump merged into main: actions/cache v5→v6, actions/checkout v6.0.3/v5.0.1→v7.0.0, pnpm/action-setup v4.3.0→v6.0.9, with all CI checks green.

Resolution: closed resolved

Reason: The PR was approved and merged, landing the dependency updates across 6 workflow files (+13/-13). All listed CI checks (CLA, test-action-code, setup/pack matrices) passed with no failures or pending jobs.

Evaluated by: mr-cal-bot

No scores available.

Issue body

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://redirect.github.com/actions/cache) | action | major | `v5` → `v6` | | [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v6.0.3` → `v7.0.0` | | [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v5.0.1` → `v7.0.0` | | [pnpm/action-setup](https://redirect.github.com/pnpm/action-setup) | action | major | `v4.3.0` → `v6.0.9` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://redirect.github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.1.0) ##### What's Changed - Bump [@actions/cache](https://redirect.github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://redirect.github.com/jasongin) in [#1768](https://redirect.github.com/actions/cache/pull/1768) **Full Changelog**: <https://github.com/actions/cache/compare/v6...v6.1.0> ### [`v6.0.0`](https://redirect.github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://redirect.github.com/Samirat) in [#1760](https://redirect.github.com/actions/cache/pull/1760) **Full Changelog**: <https://github.com/actions/cache/compare/v5...v6.0.0> ### [`v6`](https://redirect.github.com/actions/cache/compare/v5.0.5...v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.1.0...v6.0.0) </details> <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2454](https://redirect.github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2458](https://redirect.github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2460](https://redirect.github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2461](https://redirect.github.com/actions/checkout/pull/2461) - Bump [@actions/core](https://redirect.github.com/actions/core) and [@actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2459](https://redirect.github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2463](https://redirect.github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2462](https://redirect.github.com/actions/checkout/pull/2462) ### [`v7`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.3...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2454](https://redirect.github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2458](https://redirect.github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2460](https://redirect.github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2461](https://redirect.github.com/actions/checkout/pull/2461) - Bump [@actions/core](https://redirect.github.com/actions/core) and [@actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2459](https://redirect.github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2463](https://redirect.github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2462](https://redirect.github.com/actions/checkout/pull/2462) </details> <details> <summary>pnpm/action-setup (pnpm/action-setup)</summary> ### [`v6.0.9`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.9) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.8...v6.0.9) #### What's Changed - fix: update pnpm to v11.7.0 by [@zkochan](https://redirect.github.com/zkochan) in [#267](https://redirect.github.com/pnpm/action-setup/pull/267) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6...v6.0.9> ### [`v6.0.8`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.8) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8) #### What's Changed - docs(README): fix `cache_dependency_path` type by [@haines](https://redirect.github.com/haines) in [#257](https://redirect.github.com/pnpm/action-setup/pull/257) - fix: drop patchPnpmEnv so standalone+self-update works on Windows by [@zkochan](https://redirect.github.com/zkochan) in [#258](https://redirect.github.com/pnpm/action-setup/pull/258) - fix: update pnpm to 11.1.1 by [@mungodewar](https://redirect.github.com/mungodewar) in [#248](https://redirect.github.com/pnpm/action-setup/pull/248) #### New Contributors - [@mungodewar](https://redirect.github.com/mungodewar) made their first contribution in [#248](https://redirect.github.com/pnpm/action-setup/pull/248) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8> ### [`v6.0.7`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.7) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7) #### What's Changed - fix: honor devEngines.packageManager.onFail=error ([#252](https://redirect.github.com/pnpm/action-setup/issues/252)) by [@zkochan](https://redirect.github.com/zkochan) in [#254](https://redirect.github.com/pnpm/action-setup/pull/254) - fix: restore inputs from state in post by [@haines](https://redirect.github.com/haines) in [#255](https://redirect.github.com/pnpm/action-setup/pull/255) - fix: self-update bootstrap to packageManager-pinned version ([#233](https://redirect.github.com/pnpm/action-setup/issues/233)) by [@zkochan](https://redirect.github.com/zkochan) in [#256](https://redirect.github.com/pnpm/action-setup/pull/256) #### New Contributors - [@haines](https://redirect.github.com/haines) made their first contribution in [#255](https://redirect.github.com/pnpm/action-setup/pull/255) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7> ### [`v6.0.6`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.6) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6) #### What's Changed - fix: bin\_dest output points to self-updated pnpm, not bootstrap by [@zkochan](https://redirect.github.com/zkochan) in [#249](https://redirect.github.com/pnpm/action-setup/pull/249) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6> ### [`v6.0.5`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.5) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.4...v6.0.5) #### What's Changed - fix: append (not prepend) action node dir to PATH for npm bootstrap by [@zkochan](https://redirect.github.com/zkochan) in [#241](https://redirect.github.com/pnpm/action-setup/pull/241) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.4...v6.0.5> ### [`v6.0.4`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.4) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.3...v6.0.4) #### What's Changed - fix: use npm co-located with the action node binary by [@benquarmby](https://redirect.github.com/benquarmby) in [#239](https://redirect.github.com/pnpm/action-setup/pull/239) #### New Contributors - [@benquarmby](https://redirect.github.com/benquarmby) made their first contribution in [#239](https://redirect.github.com/pnpm/action-setup/pull/239) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.3...v6.0.4> ### [`v6.0.3`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.3) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.2...v6.0.3) Updated pnpm to v11.0.0-rc.5 **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.2...v6.0.3> ### [`v6.0.2`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.2) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.1...v6.0.2) #### What's Changed - fix: pnpm self-update binary shadowed by bootstrap on PATH by [@oniani1](https://redirect.github.com/oniani1) in [#230](https://redirect.github.com/pnpm/action-setup/pull/230) #### New Contributors - [@oniani1](https://redirect.github.com/oniani1) made their first contribution in [#230](https://redirect.github.com/pnpm/action-setup/pull/230) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.1...v6.0.2> ### [`v6.0.1`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.1) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6...v6.0.1) Update pnpm to v11.0.0-rc.2. `pnpm-lock.yaml` will not be saved with two documents unless the `packageManager` is set via `devEngines.packageManager`. Related issue: [#228](https://redirect.github.com/pnpm/action-setup/issues/228) ### [`v6.0.0`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.0) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6...v6) Added support for pnpm [v11](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.0.0-rc.0). ### [`v6`](https://redirect.github.com/pnpm/action-setup/compare/v5.0.0...v6) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v5.0.0...v6) ### [`v5.0.0`](https://redirect.github.com/pnpm/action-setup/releases/tag/v5.0.0) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v5.0.0...v5.0.0) Updated the action to use Node.js 24. ### [`v5`](https://redirect.github.com/pnpm/action-setup/compare/v4.4.0...v5.0.0) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v4.4.0...v5.0.0) ### [`v4.4.0`](https://redirect.github.com/pnpm/action-setup/releases/tag/v4.4.0) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v4.3.0...v4.4.0) Updated the action to use Node.js 24. </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - "every weekend" - Automerge - "after 1 am and before 7 am" 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-actions).

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-03 01:59 PM UTC	stealth/space-bunny-alpha	—	closed resolved	Renovate's major GitHub Actions bump merged into main: actions/cache v5→v6, actions/checkout v6.0.3/v5.0.1→v7.0.0, pnpm/action-setup v4.3.0→v6.0.9, with all CI checks green.
2026-09-25 09:31 AM UTC	stealth/space-bunny-alpha	—	closed resolved	Merged canonical/craft-actions#1242, upgrading actions/cache to v6, actions/checkout to v7, and pnpm/action-setup to v6.0.9; all reported CI checks passed.
2026-07-23 02:02 PM UTC	qwen/qwen3.6-35b-a3b	—	—	Merged automated GitHub Actions dependency updates. Renovate upgraded actions/cache to v6, actions/checkout to v7, and pnpm/action-setup to v6. Approved by one reviewer, passed all CI checks, and merged with a +13/-13 line change across six files.
2026-07-04 04:12 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 0 Complexity: 15 Confidence: 90	needs review	Updates GitHub Actions dependencies to major versions: actions/cache v5→v6, actions/checkout v5/v6→v7, pnpm/action-setup v4→v6. Currently open and awaiting maintainer review.

Update history

No update history recorded yet.

Related issues

Issue	Project	State	Summary	Similarity
#26 chore(deps): update github actions (major)	craft-actions	merged	Renovate PR merged into main (commit 5da5881): actions/checkout v4→v5, Node.js 20→22 and Ubuntu runners 22.04→24.04 across 2 workflow files (+7/-7), approved and all CI checks passing.	89%
#77 chore(deps): update actions/checkout action to v7	craft-actions	merged	Renovate's actions/checkout v6.0.3 → v7.0.0 major bump was approved and merged into main as commit c9a166a (+1/-1 in .github/workflows/test.yaml); all CI green. Later refined by #83 to v7.0.1 (45232fc).	86%
#162 chore(deps): update github actions (major)	craft-application	merged	Renovate PR #162 bumped actions/setup-python v4→v5 and actions/upload-artifact v3→v4 in CI workflows; approved by 2 reviewers and merged as commit 701a86e9 on main.	86%
#228 chore(deps): update github actions (major)	craft-cli	merged	Merged Renovate PR #228 (commit b452117), upgrading codecov-action v3→v4 and release-drafter v5.25.0→v6.0.0.	85%
#549 chore(deps): update github actions (major)	craft-parts	merged	Merged #549 updated CI to actions/checkout v4 and Ubuntu 22.04 runners via commit a85c25b0.	84%
#1452 chore(deps): update github actions (major)	charmcraft	merged	Renovate PR #1452 merged as commit 40044dc7, bumping actions/setup-python v4->v5 and github/codeql-action v2->v3 in .github/workflows (6 insertions, 6 deletions).	84%
#213 chore(deps): update github actions (major)	craft-cli	merged	Merged PR #213 as commit 0509d20, upgrading actions/setup-python v4→v5 and actions/upload-artifact v3→v4.	83%
#130 chore(deps): update github actions	craft-actions	merged	Updated GitHub Actions dependencies: actions/setup-node to v7.1.0 and actions/upload-artifact to v7.0.2. Merged as a routine dependency update.	83%
#149 chore(deps): update github actions to v4 (major)	craft-store	merged	Renovate PR merged (commit 1534c9f), bumping actions/download-artifact and actions/upload-artifact from v3 to v4 across CI workflows.	83%
#184 chore(deps): update github actions (major)	craft-store	merged	Merged in commit 4d11ec4, upgrading codecov-action v3→v4, release-drafter v5.25.0→v6.0.0, and action-gh-release v1→v2.	82%