chore(deps): update actions/setup-node action to v7 - #41
Conversation
dawsontoth
left a comment
There was a problem hiding this comment.
Approving — verified the digest is genuine and the major is safe for our release setup.
Digest check: 820762786026740c76f36085b0efc47a31fe5020 matches the real actions/setup-node@v7.0.0 tag upstream.
The one behavioural change worth checking is #1558, "Remove dummy NODE_AUTH_TOKEN export". Our release workflows set registry-url and publish via OIDC / Trusted Publisher (id-token: write, npm publish --provenance, no NPM_TOKEN anywhere), so that's exactly the path this touched. It turns out to be a fix for this setup rather than a risk — previously the action injected a placeholder XXXXX-XXXXX-XXXXX-XXXXX token that, per the PR, "could corrupt the user's .npmrc by injecting a non-functional token value into the environment, potentially causing confusing behavior during OIDC publish." v7 only exports the variable when it's actually set.
Flagging for awareness: this PR edits release.yaml, and PR CI never exercises the publish path — so the first real proof will be the next release. The remaining v7 changes (ESM migration, @actions/cache 5.1.0, two new cache-key outputs) are all runner-side and fine on GitHub-hosted runners.
Local verification on this branch (Node 24.17, npm ci): suite passes 10 files / 56 tests.
|
🎉 This PR is included in version 1.1.4 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This PR contains the following updates:
v6.5.0→v7.0.0Release Notes
actions/setup-node (actions/setup-node)
v7.0.0Compare Source
What's Changed
Enhancements:
Bug fixes:
mirrorTokeningetManifestif it's provided by @deiga in #1548Documentation updates:
Dependency update:
New Contributors
Full Changelog: actions/setup-node@v6...v7.0.0
v7Compare Source
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.