build(deps): update github actions (main) (major)

Issue body

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://redirect.github.com/actions/cache) | action | major | `v5` → `v6` | | [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v6` → `v7` | | [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | major | `v7` → `v8` | | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | major | `v6` → `v7` | | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | action | major | `v6` → `v7` | | [softprops/action-gh-release](https://redirect.github.com/softprops/action-gh-release) | action | major | `v2` → `v3` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://redirect.github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.1.0) ##### What's Changed - Bump [@actions/cache](https://redirect.github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@jasongin](https://redirect.github.com/jasongin) in [#1768](https://redirect.github.com/actions/cache/pull/1768) **Full Changelog**: <https://github.com/actions/cache/compare/v6...v6.1.0> ### [`v6.0.0`](https://redirect.github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@Samirat](https://redirect.github.com/Samirat) in [#1760](https://redirect.github.com/actions/cache/pull/1760) **Full Changelog**: <https://github.com/actions/cache/compare/v5...v6.0.0> ### [`v6`](https://redirect.github.com/actions/cache/compare/v5.0.5...v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.1.0...v6.0.0) </details> <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7.0.0...v7.0.1) - Bump github/codeql-action from 3 to 4 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2475](https://redirect.github.com/actions/checkout/pull/2475) - Bump actions/setup-node from 4 to 6 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2477](https://redirect.github.com/actions/checkout/pull/2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2478](https://redirect.github.com/actions/checkout/pull/2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2479](https://redirect.github.com/actions/checkout/pull/2479) - Bump actions/checkout from 6 to 7 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2488](https://redirect.github.com/actions/checkout/pull/2488) - Bump actions/upload-artifact from 4 to 7 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2476](https://redirect.github.com/actions/checkout/pull/2476) - eslint 9 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2474](https://redirect.github.com/actions/checkout/pull/2474) - Bump the minor-actions-dependencies group with 2 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2499](https://redirect.github.com/actions/checkout/pull/2499) - skip running unsafe pr check if input is default by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2518](https://redirect.github.com/actions/checkout/pull/2518) - trim only ascii whitespace for branch by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2521](https://redirect.github.com/actions/checkout/pull/2521) - escape values passed to --unset by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2530](https://redirect.github.com/actions/checkout/pull/2530) ### [`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2454](https://redirect.github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2458](https://redirect.github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2460](https://redirect.github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2461](https://redirect.github.com/actions/checkout/pull/2461) - Bump [@actions/core](https://redirect.github.com/actions/core) and [@actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2459](https://redirect.github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2463](https://redirect.github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2462](https://redirect.github.com/actions/checkout/pull/2462) ### [`v7`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.1.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2454](https://redirect.github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2458](https://redirect.github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2460](https://redirect.github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2461](https://redirect.github.com/actions/checkout/pull/2461) - Bump [@actions/core](https://redirect.github.com/actions/core) and [@actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2459](https://redirect.github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@aiqiaoy](https://redirect.github.com/aiqiaoy) in [#2463](https://redirect.github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#2462](https://redirect.github.com/actions/checkout/pull/2462) </details> <details> <summary>actions/download-artifact (actions/download-artifact)</summary> ### [`v8.0.1`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.1) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8...v8.0.1) #### What's Changed - Support for CJK characters in the artifact name by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#471](https://redirect.github.com/actions/download-artifact/pull/471) - Add a regression test for artifact name + content-type mismatches by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#472](https://redirect.github.com/actions/download-artifact/pull/472) **Full Changelog**: <https://github.com/actions/download-artifact/compare/v8...v8.0.1> ### [`v8.0.0`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.0) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8...v8) #### v8 - What's new > \[!IMPORTANT] > actions/download-artifact\@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes. > \[!IMPORTANT] > Hash mismatches will now error by default. Users can override this behavior with a setting change (see below). ##### Direct downloads To support direct uploads in `actions/upload-artifact`, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the `Content-Type` header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new `skip-decompress` parameter to `true`. ##### Enforced checks (breaking) A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the `digest-mismatch` parameter. To be secure by default, we are now defaulting the behavior to `error` which will fail the workflow run. ##### ESM To support new versions of the @actions/\* packages, we've upgraded the package to ESM. #### What's Changed - Don't attempt to un-zip non-zipped downloads by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#460](https://redirect.github.com/actions/download-artifact/pull/460) - Add a setting to specify what to do on hash mismatch and default it to `error` by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#461](https://redirect.github.com/actions/download-artifact/pull/461) **Full Changelog**: <https://github.com/actions/download-artifact/compare/v7...v8.0.0> ### [`v8`](https://redirect.github.com/actions/download-artifact/compare/v7.0.0...v8) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v7.0.0...v8) </details> <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v7.0.0...v7.0.0) ##### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@gowridurgad](https://redirect.github.com/gowridurgad) in [#1577](https://redirect.github.com/actions/setup-node/pull/1577) - Migrate to ESM and upgrade dependencies by [@gowridurgad](https://redirect.github.com/gowridurgad) in [#1574](https://redirect.github.com/actions/setup-node/pull/1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@gowridurgad](https://redirect.github.com/gowridurgad) in [#1558](https://redirect.github.com/actions/setup-node/pull/1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@deiga](https://redirect.github.com/deiga) in [#1548](https://redirect.github.com/actions/setup-node/pull/1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#1536](https://redirect.github.com/actions/setup-node/pull/1536) - docs: Update restore-only cache documentation by [@priya-kinthali](https://redirect.github.com/priya-kinthali) in [#1550](https://redirect.github.com/actions/setup-node/pull/1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#1567](https://redirect.github.com/actions/setup-node/pull/1567) ##### Dependency update: - Upgrade [@actions/cache](https://redirect.github.com/actions/cache) to 5.1.0, log cache write denied by [@jasongin](https://redirect.github.com/jasongin) in [#1569](https://redirect.github.com/actions/setup-node/pull/1569) ##### New Contributors - [@chiranjib-swain](https://redirect.github.com/chiranjib-swain) made their first contribution in [#1536](https://redirect.github.com/actions/setup-node/pull/1536) - [@deiga](https://redirect.github.com/deiga) made their first contribution in [#1548](https://redirect.github.com/actions/setup-node/pull/1548) - [@jasongin](https://redirect.github.com/jasongin) made their first contribution in [#1569](https://redirect.github.com/actions/setup-node/pull/1569) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v7.0.0> ### [`v7`](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v6.5.0...v7.0.0) </details> <details> <summary>actions/upload-artifact (actions/upload-artifact)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.1) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v7...v7.0.1) #### What's Changed - Update the readme with direct upload details by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#795](https://redirect.github.com/actions/upload-artifact/pull/795) - Readme: bump all the example versions to v7 by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#796](https://redirect.github.com/actions/upload-artifact/pull/796) - Include changes in typespec/ts-http-runtime 0.3.5 by [@yacaovsnc](https://redirect.github.com/yacaovsnc) in [#797](https://redirect.github.com/actions/upload-artifact/pull/797) **Full Changelog**: <https://github.com/actions/upload-artifact/compare/v7...v7.0.1> ### [`v7.0.0`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.0) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v7...v7) #### v7 What's new ##### Direct Uploads Adds support for uploading single files directly (unzipped). Callers can set the new `archive` parameter to `false` to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The `name` parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file. ##### ESM To support new versions of the `@actions/*` packages, we've upgraded the package to ESM. #### What's Changed - Add proxy integration test by [@Link-](https://redirect.github.com/Link-) in [#754](https://redirect.github.com/actions/upload-artifact/pull/754) - Upgrade the module to ESM and bump dependencies by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#762](https://redirect.github.com/actions/upload-artifact/pull/762) - Support direct file uploads by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#764](https://redirect.github.com/actions/upload-artifact/pull/764) #### New Contributors - [@Link-](https://redirect.github.com/Link-) made their first contribution in [#754](https://redirect.github.com/actions/upload-artifact/pull/754) **Full Changelog**: <https://github.com/actions/upload-artifact/compare/v6...v7.0.0> ### [`v7`](https://redirect.github.com/actions/upload-artifact/compare/v6.0.0...v7) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v6.0.0...v7) </details> <details> <summary>softprops/action-gh-release (softprops/action-gh-release)</summary> ### [`v3.0.2`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v3.0.2) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v3.0.1...v3.0.2) `3.0.2` is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since `3.0.1`. This release fixes [#795](https://redirect.github.com/softprops/action-gh-release/issues/795), [#438](https://redirect.github.com/softprops/action-gh-release/issues/438), and [#803](https://redirect.github.com/softprops/action-gh-release/issues/803). The upload transport hardening covers the historical failure reported in [#790](https://redirect.github.com/softprops/action-gh-release/issues/790), although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to [#786](https://redirect.github.com/softprops/action-gh-release/issues/786) and does not claim a reproducible release-creation fix. ##### What's Changed ##### Exciting New Features 🎉 - feat: improve release error reporting and test coverage by [@chenrui333](https://redirect.github.com/chenrui333) in [#813](https://redirect.github.com/softprops/action-gh-release/pull/813) ##### Bug fixes 🐛 - fix: publish existing draft releases as prereleases by [@godfengliang](https://redirect.github.com/godfengliang) in [#801](https://redirect.github.com/softprops/action-gh-release/pull/801) - fix: upload small checksum assets reliably by [@chenrui333](https://redirect.github.com/chenrui333) in [#815](https://redirect.github.com/softprops/action-gh-release/pull/815) - fix: replace existing release assets on Gitea by [@chenrui333](https://redirect.github.com/chenrui333) in [#816](https://redirect.github.com/softprops/action-gh-release/pull/816) - fix: clarify release creation 404 errors by [@chenrui333](https://redirect.github.com/chenrui333) in [#817](https://redirect.github.com/softprops/action-gh-release/pull/817) ##### Other Changes 🔄 - chore(deps): upgrade TypeScript to 7 by [@chenrui333](https://redirect.github.com/chenrui333) in [#812](https://redirect.github.com/softprops/action-gh-release/pull/812) - chore(deps): remove unused TypeScript tooling by [@chenrui333](https://redirect.github.com/chenrui333) in [#814](https://redirect.github.com/softprops/action-gh-release/pull/814) - dependency, Node 24 pin, and CI maintenance merged since `3.0.1` ### [`v3.0.1`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v3.0.1) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v3...v3.0.1) #### 3.0.1 - maintenance release with updated dependencies ### [`v3.0.0`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v3.0.0) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v3...v3) `3.0.0` is a major release that moves the action runtime from Node 20 to Node 24. Use `v3` on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on `v2.6.2`. #### What's Changed ##### Other Changes 🔄 - Move the action runtime and bundle target to Node 24 - Update `@types/node` to the Node 24 line and allow future Dependabot updates - Keep the floating major tag on `v3`; `v2` remains pinned to the latest `2.x` release ### [`v3`](https://redirect.github.com/softprops/action-gh-release/compare/v2.6.2...v3) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v2.6.2...v3) </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - "every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/imagecraft).

Evaluation history

Date	Model	Scores	Action	Summary
2026-08-15 02:02 AM UTC	qwen/qwen3.6-35b-a3b	—	—	Merged automated dependency update via Renovate, upgrading six GitHub Actions to major versions. All CI checks passed, and the changes were auto-merged into main.
2026-08-12 05:41 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 5 Complexity: 10 Confidence: 90	needs review	Automated dependency update for GitHub Actions (cache, checkout, download-artifact, setup-node, upload-artifact, softprops/action-gh-release) to latest major versions. Currently pending maintainer review with CI checks passing.
2026-08-12 03:52 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 5 Complexity: 15 Confidence: 95	needs review	Updates GitHub Actions to major versions (cache v5→v6, checkout v6→v7, download-artifact v7→v8, setup-node v6→v7, upload-artifact v6→v7, softprops/action-gh-release v2→v3). Currently pending maintainer review with all CI checks passing.
2026-08-12 03:52 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 5 Complexity: 10 Confidence: 90	needs review	Automated dependency update upgrading six GitHub Actions to their latest major versions. All CI checks are passing. Awaiting maintainer review.
2026-08-12 03:41 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 5 Complexity: 15 Confidence: 90	needs review	Updates six GitHub Actions to major versions. CI is passing, automerge is enabled, and the PR awaits maintainer review.
2026-08-12 03:31 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 5 Complexity: 10 Confidence: 90	needs review	Updates several GitHub Actions to their latest major versions. Currently pending maintainer review with CI checks passing.
2026-08-11 05:31 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 5 Complexity: 15 Confidence: 85	needs review	Updates major versions of six GitHub Actions in CI workflows. Currently pending maintainer review with CI failing on OSV-scanner and a Renovate check.
2026-08-11 05:20 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 5 Complexity: 15 Confidence: 85	needs review	Updates multiple GitHub Actions to their latest major versions. Currently pending maintainer review with zero comments. CI shows minor failures in Renovate and OSV-scanner checks.
2026-08-09 11:01 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 0 Complexity: 15 Confidence: 90	needs review	Updates six GitHub Actions to major versions. Currently awaiting maintainer review with one failing OSV security scan and pending CI jobs.

Update history

Date	Change
2026-08-13 12:42 AM UTC	updated
2026-08-12 05:40 PM UTC	updated
2026-08-12 03:42 PM UTC	updated
2026-08-12 03:33 PM UTC	updated
2026-08-12 03:30 PM UTC	updated
2026-08-11 05:22 PM UTC	updated
2026-08-11 05:12 PM UTC	updated
2026-08-09 10:52 PM UTC	created

Related issues

Issue	Project	State	Summary	Similarity
#1306 build(deps): update github actions (main) (major)	rockcraft	open	Renovate PR updating 10 GitHub Actions to latest major versions. All CI checks passing, automerge enabled, no reviews yet.	91%