From 5d90805a08d361a9b960c52d4b45e06cdbd378f9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 17:56:03 +0000 Subject: [PATCH] [develop-2023]: Bump the gha group with 6 updates Bumps the gha group with 6 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6` | `7` | | [actions/setup-node](https://github.com/actions/setup-node) | `6` | `7` | | [crowdin/github-action](https://github.com/crowdin/github-action) | `2.16.0` | `3.3.0` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4` | `5` | | [actions/cache](https://github.com/actions/cache) | `5` | `6` | | [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `8.0.0` | `8.3.0` | Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) Updates `actions/setup-node` from 6 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v6...v7) Updates `crowdin/github-action` from 2.16.0 to 3.3.0 - [Release notes](https://github.com/crowdin/github-action/releases) - [Commits](https://github.com/crowdin/github-action/compare/7ca9c452bfe9197d3bb7fa83a4d7e2b0c9ae835d...9c23991700c0ec5256fd41089b9d9d7d540e424e) Updates `actions/dependency-review-action` from 4 to 5 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/v4...v5) Updates `actions/cache` from 5 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v5...v6) Updates `SonarSource/sonarqube-scan-action` from 8.0.0 to 8.3.0 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/59db25f34e16620e48ab4bb9e4a5dce155cb5432...d209202bc7d53ff1cc128f7f907dac145c9d6ae9) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: crowdin/github-action dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: actions/dependency-review-action dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha ... Signed-off-by: dependabot[bot] --- .github/workflows/alpha.yaml | 4 ++-- .github/workflows/codeql.yml | 2 +- .github/workflows/crowdin.yaml | 4 ++-- .github/workflows/dependency-review.yaml | 4 ++-- .github/workflows/lint.yaml | 4 ++-- .github/workflows/main.yaml | 4 ++-- .github/workflows/preview.yaml | 2 +- .github/workflows/promote.yaml | 6 +++--- .github/workflows/sonar.yaml | 8 ++++---- .github/workflows/storybook.yaml | 4 ++-- .github/workflows/sync-release-to-dev.yaml | 2 +- .github/workflows/test.yaml | 4 ++-- 12 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/alpha.yaml b/.github/workflows/alpha.yaml index 6cbcbb6614..82189880c9 100644 --- a/.github/workflows/alpha.yaml +++ b/.github/workflows/alpha.yaml @@ -27,9 +27,9 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: 24 registry-url: 'https://packages.nuxeo.com/repository/npm-public/' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b5f70480c0..192f44b160 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -57,7 +57,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 # Add any setup steps before running the `github/codeql-action/init` action. # This includes steps like installing compilers or runtimes (`actions/setup-node` diff --git a/.github/workflows/crowdin.yaml b/.github/workflows/crowdin.yaml index b6a8ba0419..2c672712c7 100644 --- a/.github/workflows/crowdin.yaml +++ b/.github/workflows/crowdin.yaml @@ -40,13 +40,13 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: develop-2023 - name: Crowdin Action id: crowdin-sync - uses: crowdin/github-action@7ca9c452bfe9197d3bb7fa83a4d7e2b0c9ae835d # v2.16.0 + uses: crowdin/github-action@9c23991700c0ec5256fd41089b9d9d7d540e424e # v3.3.0 with: # Disable 'git checkout "${GITHUB_REF#refs/heads/}"' skip_ref_checkout: true diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml index f35eec6517..6255fd47d7 100644 --- a/.github/workflows/dependency-review.yaml +++ b/.github/workflows/dependency-review.yaml @@ -16,9 +16,9 @@ jobs: name: Dependency Review runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Review dependency changes - uses: actions/dependency-review-action@v4 + uses: actions/dependency-review-action@v5 with: fail-on-severity: moderate diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 7a0b7f5d24..bb8988894d 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -23,13 +23,13 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: # Honour an explicit workflow_call branch. Empty on pull_request, which leaves # checkout on the PR merge commit instead of the head branch. ref: ${{ inputs.branch }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: 24 registry-url: 'https://packages.nuxeo.com/repository/npm-public/' diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml index 26ff67dd8b..3ae3ea2ca1 100644 --- a/.github/workflows/main.yaml +++ b/.github/workflows/main.yaml @@ -74,9 +74,9 @@ jobs: ;; esac - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: 24 registry-url: 'https://packages.nuxeo.com/repository/npm-public/' diff --git a/.github/workflows/preview.yaml b/.github/workflows/preview.yaml index f397f23ae4..4ed741a0e1 100644 --- a/.github/workflows/preview.yaml +++ b/.github/workflows/preview.yaml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest if: (github.event.action == 'labeled' && github.event.label.name == 'webui-preview') || contains(github.event.pull_request.labels.*.name, 'webui-preview') steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Prepare environment run: | diff --git a/.github/workflows/promote.yaml b/.github/workflows/promote.yaml index d08b8037dd..ccfd7145ff 100644 --- a/.github/workflows/promote.yaml +++ b/.github/workflows/promote.yaml @@ -25,13 +25,13 @@ jobs: promote: runs-on: ubuntu-latest steps: - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: 24 registry-url: 'https://packages.nuxeo.com/repository/npm-public/' scope: '@nuxeo' - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: v${{ github.event.inputs.version }} token: ${{ secrets.GIT_ADMIN_TOKEN }} @@ -81,7 +81,7 @@ jobs: run: | npx ${{ env.LERNA }} exec --ignore @nuxeo/nuxeo-elements-storybook -- npm publish --@nuxeo:registry=https://packages.nuxeo.com/repository/npm-public/ - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: token: ${{ secrets.GIT_ADMIN_TOKEN }} ref: ${{ github.event.inputs.referenceBranch }} diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml index af9b740b22..fae8d40c1b 100644 --- a/.github/workflows/sonar.yaml +++ b/.github/workflows/sonar.yaml @@ -39,7 +39,7 @@ jobs: comment_on_pr: false - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: ${{ inputs.branch }} fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis @@ -48,14 +48,14 @@ jobs: run: git config user.name "nuxeo-webui-jx-bot" && git config user.email "webui@hyland.com" - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@v7 with: registry-url: 'https://packages.nuxeo.com/repository/npm-public/' node-version: 24 scope: '@nuxeo' - name: Cache npm packages - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.npm key: ${{ runner.os }}-node-${{ hashFiles('**/package.json') }} @@ -94,7 +94,7 @@ jobs: id: sonar_scan env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0 + uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0 with: projectBaseDir: ${{ github.workspace }} args: > diff --git a/.github/workflows/storybook.yaml b/.github/workflows/storybook.yaml index 22c10945c2..33a4e00c9e 100644 --- a/.github/workflows/storybook.yaml +++ b/.github/workflows/storybook.yaml @@ -26,13 +26,13 @@ jobs: storybook: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: # Honour an explicit workflow_call branch. Empty on pull_request, which leaves # checkout on the PR merge commit instead of the head branch. ref: ${{ inputs.branch }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: 24 registry-url: 'https://packages.nuxeo.com/repository/npm-public/' diff --git a/.github/workflows/sync-release-to-dev.yaml b/.github/workflows/sync-release-to-dev.yaml index 3b5569482d..50c0be468c 100644 --- a/.github/workflows/sync-release-to-dev.yaml +++ b/.github/workflows/sync-release-to-dev.yaml @@ -31,7 +31,7 @@ jobs: sync: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 0e60343b63..61ffea2a4e 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -26,13 +26,13 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: # Honour an explicit workflow_call branch. Empty on pull_request, which leaves # checkout on the PR merge commit instead of the head branch. ref: ${{ inputs.branch }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: 24 registry-url: 'https://packages.nuxeo.com/repository/npm-public/'