chore(actions): update github-actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v6 → v7
actions/download-artifact	action	major	v7 → v8
actions/upload-artifact	action	major	v6 → v7
azure/setup-helm	action	major	v4 → v5
docker/build-push-action	action	major	v6 → v7
docker/login-action	action	major	v3 → v4
docker/metadata-action	action	major	v5 → v6
docker/setup-buildx-action	action	major	v3 → v4

---

Release Notes

actions/checkout (actions/checkout)

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

actions/download-artifact (actions/download-artifact)

v8.0.1

Compare Source

What's Changed

• Support for CJK characters in the artifact name by @​danwkennedy in #​471
• Add a regression test for artifact name + content-type mismatches by @​danwkennedy in #​472

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

Compare Source

v8 - What's new

[!IMPORTANT]
actions/download-artifact@​v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @​actions/* packages, we've upgraded the package to ESM.

What's Changed

• Don't attempt to un-zip non-zipped downloads by @​danwkennedy in #​460
• Add a setting to specify what to do on hash mismatch and default it to error by @​danwkennedy in #​461

Full Changelog: actions/download-artifact@v7...v8.0.0

v8

Compare Source

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in #​754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in #​762
• Support direct file uploads by @​danwkennedy in #​764

New Contributors

• @​Link- made their first contribution in #​754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v7

Compare Source

azure/setup-helm (azure/setup-helm)

v5.0.1

Compare Source

v5.0.0

Compare Source

Changed

• #​259 Update Node.js runtime from node20 to node24
• #​263 Bump undici
• #​257 Bump undici and @​actions/http-client
• #​256 Bump minimatch
• #​248 Bump the actions group with 2 updates
• #​247 Bump the actions group with 3 updates
• #​246 Bump @​types/node from 25.0.2 to 25.0.3 in the actions group
• #​245 Bump the actions group with 3 updates
• #​243 Bump the actions group with 2 updates
• #​240 Bump prettier from 3.6.2 to 3.7.3 in the actions group
• #​229 Bump the actions group across 1 directory with 3 updates
• #​231 Bump js-yaml from 3.14.1 to 3.14.2
• #​234 Bump glob from 10.4.5 to 10.5.0
• #​225 Fix build error
• #​222 Bump @​types/node from 24.7.2 to 24.8.1 in the actions group
• #​220 Bump the actions group across 1 directory with 4 updates
• #​216 Bump the actions group across 1 directory with 4 updates
• #​213 Bump the actions group with 2 updates
• #​211 Bump undici
• #​212 Bump jest from 30.0.5 to 30.1.2 in the actions group
• #​210 Bump @​types/node from 24.2.1 to 24.3.0 in the actions group

v5

Compare Source

docker/build-push-action (docker/build-push-action)

v7.3.0

Compare Source

v7.2.0

Compare Source

• Bump @​actions/core from 3.0.0 to 3.0.1 in #​1525
• Bump @​docker/actions-toolkit from 0.87.0 to 0.90.0 in #​1517
• Bump brace-expansion from 2.0.2 to 5.0.6 in #​1534
• Bump fast-xml-builder from 1.1.4 to 1.2.0 in #​1529
• Bump fast-xml-parser from 5.5.7 to 5.8.0 in #​1521
• Bump postcss from 8.5.6 to 8.5.10 in #​1526
• Bump tar from 6.2.1 to 7.5.15 in #​1533

Full Changelog: docker/build-push-action@v7.1.0...v7.2.0

v7.1.0

Compare Source

• Git context query format support by @​crazy-max in #​1505
• Bump @​docker/actions-toolkit from 0.79.0 to 0.87.0 by @​crazy-max in #​1505
• Bump brace-expansion from 1.1.12 to 1.1.13 in #​1500
• Bump fast-xml-parser from 5.4.2 to 5.5.7 in #​1489
• Bump flatted from 3.3.3 to 3.4.2 in #​1491
• Bump glob from 10.3.12 to 10.5.0 in #​1490
• Bump handlebars from 4.7.8 to 4.7.9 in #​1497
• Bump lodash from 4.17.23 to 4.18.1 in #​1510
• Bump picomatch from 4.0.3 to 4.0.4 in #​1496
• Bump undici from 6.23.0 to 6.24.1 in #​1486
• Bump vite from 7.3.1 to 7.3.2 in #​1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

v7.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​1470
• Remove deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs by @​crazy-max in #​1473
• Remove legacy export-build tool support for build summary by @​crazy-max in #​1474
• Switch to ESM and update config/test wiring by @​crazy-max in #​1466
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​1454
• Bump @​docker/actions-toolkit from 0.62.1 to 0.79.0 in #​1453 #​1472 #​1479
• Bump minimatch from 3.1.2 to 3.1.5 in #​1463

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

v7

Compare Source

docker/login-action (docker/login-action)

v4.4.0

Compare Source

v4.3.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​1022
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1076.0 #​999 #​1030
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​1004 #​1027
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​1023
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​1029
• Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #​1017
• Bump js-yaml from 4.1.1 to 5.2.0 in #​1028
• Bump sigstore from 4.1.0 to 4.1.1 in #​1031
• Bump tmp from 0.2.5 to 0.2.7 in #​1002
• Bump undici from 6.24.1 to 6.27.0 in #​1020
• Bump vite from 7.3.3 to 7.3.6 in #​1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

v4.2.0

Compare Source

• Bump @​actions/core from 3.0.0 to 3.0.1 in #​976
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1050.0 in #​960
• Bump @​docker/actions-toolkit from 0.86.0 to 0.90.0 in #​970
• Bump brace-expansion from 2.0.1 to 5.0.6 in #​993
• Bump fast-xml-builder from 1.1.4 to 1.2.0 in #​985
• Bump fast-xml-parser from 5.3.6 to 5.8.0 in #​963
• Bump http-proxy-agent and https-proxy-agent to 9.0.0 in #​961
• Bump postcss from 8.5.6 to 8.5.10 in #​979
• Bump tar from 6.2.1 to 7.5.15 in #​991
• Bump vite from 7.3.1 to 7.3.3 in #​986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

v4.1.0

Compare Source

• Fix scoped Docker Hub cleanup path when registry is omitted by @​crazy-max in #​945
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1020.0 in #​930
• Bump @​docker/actions-toolkit from 0.77.0 to 0.86.0 in #​932 #​936
• Bump brace-expansion from 1.1.12 to 1.1.13 in #​952
• Bump fast-xml-parser from 5.3.4 to 5.3.6 in #​942
• Bump flatted from 3.3.3 to 3.4.2 in #​944
• Bump glob from 10.3.12 to 10.5.0 in #​940
• Bump handlebars from 4.7.8 to 4.7.9 in #​949
• Bump http-proxy-agent and https-proxy-agent to 8.0.0 in #​937
• Bump lodash from 4.17.23 to 4.18.1 in #​958
• Bump minimatch from 3.1.2 to 3.1.5 in #​941
• Bump picomatch from 4.0.3 to 4.0.4 in #​948
• Bump undici from 6.23.0 to 6.24.1 in #​938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

v4.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​929
• Switch to ESM and update config/test wiring by @​crazy-max in #​927
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​919
• Bump @​aws-sdk/client-ecr from 3.890.0 to 3.1000.0 in #​909 #​920
• Bump @​aws-sdk/client-ecr-public from 3.890.0 to 3.1000.0 in #​909 #​920
• Bump @​docker/actions-toolkit from 0.63.0 to 0.77.0 in #​910 #​928
• Bump @​isaacs/brace-expansion from 5.0.0 to 5.0.1 in #​921
• Bump js-yaml from 4.1.0 to 4.1.1 in #​901

Full Changelog: docker/login-action@v3.7.0...v4.0.0

v4

Compare Source

docker/metadata-action (docker/metadata-action)

v6.2.0

Compare Source

v6.1.0

Compare Source

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in #​613
• Bump brace-expansion from 1.1.12 to 5.0.6 in #​658 #​630
• Bump csv-parse from 6.1.0 to 6.2.1 in #​617
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​620
• Bump flatted from 3.3.3 to 3.4.2 in #​623
• Bump glob from 10.3.15 to 10.5.0 in #​621
• Bump handlebars from 4.7.8 to 4.7.9 in #​629
• Bump lodash from 4.17.23 to 4.18.1 in #​639
• Bump moment-timezone from 0.6.0 to 0.6.1 in #​619
• Bump picomatch from 4.0.3 to 4.0.4 in #​626
• Bump postcss from 8.5.6 to 8.5.10 in #​649
• Bump tar from 6.2.1 to 7.5.15 in #​657
• Bump undici from 6.23.0 to 6.25.0 in #​614
• Bump vite from 7.3.1 to 7.3.2 in #​637

Full Changelog: docker/metadata-action@v6.0.0...v6.1.0

v6.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​605
• List inputs now preserve # inside values while still supporting full-line # comments by @​crazy-max in #​607
• Switch to ESM and update config/test wiring by @​crazy-max in #​602
• Bump lodash from 4.17.21 to 4.17.23 in #​588
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​599
• Bump @​actions/github from 6.0.1 to 9.0.0 in #​597
• Bump @​docker/actions-toolkit from 0.68.0 to 0.79.0 in #​604
• Bump @​isaacs/brace-expansion from 5.0.0 to 5.0.1 in #​600
• Bump semver from 7.7.3 to 7.7.4 in #​603

Full Changelog: docker/metadata-action@v5.10.0...v6.0.0

v6

Compare Source

docker/setup-buildx-action (docker/setup-buildx-action)

v4.2.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​572
• Bump @​actions/core from 3.0.0 to 3.0.1 in #​551
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​557 #​580
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​573
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​576
• Bump js-yaml from 4.1.1 to 5.2.0 in #​562
• Bump sigstore from 4.1.0 to 4.1.1 in #​577
• Bump tmp from 0.2.5 to 0.2.7 in #​556
• Bump undici from 6.25.0 to 6.27.0 in #​570
• Bump vite from 7.3.2 to 7.3.6 in #​569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

v4.1.0

Compare Source

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in #​489
• Bump brace-expansion from 1.1.12 to 5.0.6 in #​547 #​508
• Bump fast-xml-builder from 1.0.0 to 1.2.0 in #​540
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​496
• Bump flatted from 3.3.3 to 3.4.2 in #​499
• Bump glob from 10.3.12 to 13.0.6 in #​495
• Bump handlebars from 4.7.8 to 4.7.9 in #​504
• Bump lodash from 4.17.23 to 4.18.1 in #​523
• Bump picomatch from 4.0.3 to 4.0.4 in #​503
• Bump postcss from 8.5.6 to 8.5.10 in #​537
• Bump tar from 6.2.1 to 7.5.15 in #​545
• Bump undici from 6.23.0 to 6.25.0 in #​492
• Bump vite from 7.3.1 to 7.3.2 in #​520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

v4.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​483
• Remove deprecated inputs/outputs by @​crazy-max in #​464
• Switch to ESM and update config/test wiring by @​crazy-max in #​481
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​475
• Bump @​docker/actions-toolkit from 0.63.0 to 0.79.0 in #​482 #​485
• Bump js-yaml from 4.1.0 to 4.1.1 in #​452
• Bump lodash from 4.17.21 to 4.17.23 in #​472
• Bump minimatch from 3.1.2 to 3.1.5 in #​480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

v4

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.