chore(deps): update astral-sh/ruff-action action to v4 (#202)

renovate[bot] · web-flow · commit c0e3f6485959 · 2026-04-16T07:04:43.000+12:00
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [astral-sh/ruff-action](https://redirect.github.com/astral-sh/ruff-action) | action | major | `v3.5.1` → `v4.0.0` | --- ### Release Notes <details> <summary>astral-sh/ruff-action (astral-sh/ruff-action)</summary> ### [`v4.0.0`](https://redirect.github.com/astral-sh/ruff-action/releases/tag/v4.0.0): 🌈 Immutable releases, node24 and manifest-file [Compare Source](https://redirect.github.com/astral-sh/ruff-action/compare/v3.6.1...v4.0.0) ### This is the first immutable release of `ruff-action` 🥳 All future releases are also immutable, if you want to know more about what this means checkout [the docs](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases). This action now also supports the [mainfest-file](https://redirect.github.com/astral-sh/ruff-action?tab=readme-ov-file#install-using-a-custom-manifest-url) input which lets you define custom ruff versions and custom download locations. Last but not least this action now runs on node24. This might be a breaking change on very old self-hosted runners. #### 🚨 Breaking changes - Migrate to ESMBundler and node 24 [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;345](https://redirect.github.com/astral-sh/ruff-action/issues/345)) #### 🚀 Enhancements - Add manifest-file input [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;352](https://redirect.github.com/astral-sh/ruff-action/issues/352)) #### 🧰 Maintenance - chore: update known checksums for 0.15.10 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;351](https://redirect.github.com/astral-sh/ruff-action/issues/351)) - Add a release workflow [@&#8203;zanieb](https://redirect.github.com/zanieb) ([#&#8203;349](https://redirect.github.com/astral-sh/ruff-action/issues/349)) - chore: update known checksums for 0.15.9 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;348](https://redirect.github.com/astral-sh/ruff-action/issues/348)) - chore: update known checksums for 0.15.8 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;344](https://redirect.github.com/astral-sh/ruff-action/issues/344)) - chore: update known checksums for 0.15.7 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;342](https://redirect.github.com/astral-sh/ruff-action/issues/342)) - chore: update known checksums for 0.15.6 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;337](https://redirect.github.com/astral-sh/ruff-action/issues/337)) - chore: update known checksums for 0.15.5 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;331](https://redirect.github.com/astral-sh/ruff-action/issues/331)) - chore: update known checksums for 0.15.4 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;328](https://redirect.github.com/astral-sh/ruff-action/issues/328)) - chore: update known checksums for 0.15.2 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;325](https://redirect.github.com/astral-sh/ruff-action/issues/325)) - chore: update known checksums for 0.15.1 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;323](https://redirect.github.com/astral-sh/ruff-action/issues/323)) - chore: update known checksums for 0.15.0 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;320](https://redirect.github.com/astral-sh/ruff-action/issues/320)) #### ⬆️ Dependency updates - Bump release-drafter/release-drafter from 6.2.0 to 7.2.0 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;350](https://redirect.github.com/astral-sh/ruff-action/issues/350)) - Bump eifinger/actionlint-action from 1.10.0 to 1.10.2 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;347](https://redirect.github.com/astral-sh/ruff-action/issues/347)) - Bump zizmorcore/zizmor-action from 0.4.1 to 0.5.2 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;333](https://redirect.github.com/astral-sh/ruff-action/issues/333)) ### [`v3.6.1`](https://redirect.github.com/astral-sh/ruff-action/releases/tag/v3.6.1): 🌈 fix automatic minor tag updates [Compare Source](https://redirect.github.com/astral-sh/ruff-action/compare/v3.6.0...v3.6.1) #### Changes This is just a bugfix release for the release process - fix: persist credentials for git push in update-major-minor-tags workflow [@&#8203;eifinger-bot](https://redirect.github.com/eifinger-bot) ([#&#8203;312](https://redirect.github.com/astral-sh/ruff-action/issues/312)) #### 🧰 Maintenance - ci: add zizmor security linting [@&#8203;eifinger-bot](https://redirect.github.com/eifinger-bot) ([#&#8203;313](https://redirect.github.com/astral-sh/ruff-action/issues/313)) ### [`v3.6.0`](https://redirect.github.com/astral-sh/ruff-action/releases/tag/v3.6.0): 🌈 search for pyproject.toml in parent dirs [Compare Source](https://redirect.github.com/astral-sh/ruff-action/compare/v3.5.1...v3.6.0) #### Changes This release brings some bug fixes like - support for hashes in requirement.txt files - ignoring environment markers in version specifiers like `"ruff~=0.13 ; python_version >= '3.11'"` to prevent them from breaking the version resolver. If you have a usecase for needing the environment markers to derive the correct ruff version this action should use please add your voice to [#&#8203;256](https://redirect.github.com/astral-sh/ruff-action/issues/256) In case no pyproject.toml is in the configured `src` this action now also walks up the directory tree to search for it, just like the "normal" ruff does. This is limited to the current workspace to prevent this action from trying to access private data outside the GitHub Actions runner. EDIT: Oh I forgot to mention that the error matcher now properly detects invalid formatting and displays the correct line number etc in the GitHub UI. #### 🐛 Bug fixes - search in parent dir [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;306](https://redirect.github.com/astral-sh/ruff-action/issues/306)) - ignore environment markers in dep specs [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;295](https://redirect.github.com/astral-sh/ruff-action/issues/295)) - Support hashes in requirement files for version-file [@&#8203;mulmat](https://redirect.github.com/mulmat) ([#&#8203;287](https://redirect.github.com/astral-sh/ruff-action/issues/287)) - Don't warn on no version found in pyproject.toml [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;209](https://redirect.github.com/astral-sh/ruff-action/issues/209)) #### 🚀 Enhancements - Update the ruff-format matcher to properly extract all info [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;293](https://redirect.github.com/astral-sh/ruff-action/issues/293)) #### 🧰 Maintenance - chore: update known checksums for 0.14.13/0.14.14 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;297](https://redirect.github.com/astral-sh/ruff-action/issues/297)) - Fix CI: Pin ruff version to stable 0.13.x in test fixture [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;305](https://redirect.github.com/astral-sh/ruff-action/issues/305)) - chore: update known checksums for 0.14.11 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;292](https://redirect.github.com/astral-sh/ruff-action/issues/292)) - chore: update known checksums for 0.14.10 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;289](https://redirect.github.com/astral-sh/ruff-action/issues/289)) - chore: update known checksums for 0.14.9 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;284](https://redirect.github.com/astral-sh/ruff-action/issues/284)) - chore: update known checksums for 0.14.8 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;280](https://redirect.github.com/astral-sh/ruff-action/issues/280)) - chore: use `npm ci --ignore-scripts` in CI and scripts [@&#8203;woodruffw](https://redirect.github.com/woodruffw) ([#&#8203;276](https://redirect.github.com/astral-sh/ruff-action/issues/276)) - chore: update known checksums for 0.14.7 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;275](https://redirect.github.com/astral-sh/ruff-action/issues/275)) - chore: update known checksums for 0.14.6 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;271](https://redirect.github.com/astral-sh/ruff-action/issues/271)) - chore: update known checksums for 0.14.5 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;266](https://redirect.github.com/astral-sh/ruff-action/issues/266)) - chore: update known checksums for 0.14.4 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;265](https://redirect.github.com/astral-sh/ruff-action/issues/265)) - chore: update known checksums for 0.14.3 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;263](https://redirect.github.com/astral-sh/ruff-action/issues/263)) - chore: update known checksums for 0.14.2 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;258](https://redirect.github.com/astral-sh/ruff-action/issues/258)) - chore: update known checksums for 0.14.1 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;252](https://redirect.github.com/astral-sh/ruff-action/issues/252)) - chore: update known checksums for 0.13.3/0.14.0 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;239](https://redirect.github.com/astral-sh/ruff-action/issues/239)) - chore: update known checksums for 0.13.2 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;232](https://redirect.github.com/astral-sh/ruff-action/issues/232)) - Don't assume all test passed if cancelled [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;236](https://redirect.github.com/astral-sh/ruff-action/issues/236)) - chore: update known checksums for 0.13.1 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;230](https://redirect.github.com/astral-sh/ruff-action/issues/230)) - chore: update known checksums for 0.13.0 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;223](https://redirect.github.com/astral-sh/ruff-action/issues/223)) - chore: update known checksums for 0.12.12 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;218](https://redirect.github.com/astral-sh/ruff-action/issues/218)) - chore: update known checksums for 0.12.11 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;214](https://redirect.github.com/astral-sh/ruff-action/issues/214)) - chore: update known checksums for 0.12.10 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;210](https://redirect.github.com/astral-sh/ruff-action/issues/210)) - chore(ci): address all lint findings [@&#8203;woodruffw](https://redirect.github.com/woodruffw) ([#&#8203;206](https://redirect.github.com/astral-sh/ruff-action/issues/206)) - chore: update known checksums for 0.12.9 @&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#&#8203;204](https://redirect.github.com/astral-sh/ruff-action/issues/204)) #### ⬆️ Dependency updates - Bump dependencies and actions [@&#8203;eifinger](https://redirect.github.com/eifinger) ([#&#8203;311](https://redirect.github.com/astral-sh/ruff-action/issues/311)) - Bump actions/checkout from 5.0.0 to 6.0.1 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;278](https://redirect.github.com/astral-sh/ruff-action/issues/278)) - Bump github/codeql-action from 3.30.5 to 4.31.10 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;294](https://redirect.github.com/astral-sh/ruff-action/issues/294)) - Bump actions/setup-node from 6.0.0 to 6.2.0 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;296](https://redirect.github.com/astral-sh/ruff-action/issues/296)) - Bump eifinger/actionlint-action from 1.9.3 to 1.10.0 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;291](https://redirect.github.com/astral-sh/ruff-action/issues/291)) - Bump peter-evans/create-pull-request from 7.0.9 to 8.0.0 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;283](https://redirect.github.com/astral-sh/ruff-action/issues/283)) - Bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;273](https://redirect.github.com/astral-sh/ruff-action/issues/273)) - Bump eifinger/actionlint-action from 1.9.2 to 1.9.3 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;272](https://redirect.github.com/astral-sh/ruff-action/issues/272)) - Bump eifinger/actionlint-action from 1.9.1 to 1.9.2 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;247](https://redirect.github.com/astral-sh/ruff-action/issues/247)) - Bump actions/setup-node from 4.4.0 to 6.0.0 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;249](https://redirect.github.com/astral-sh/ruff-action/issues/249)) - Bump github/codeql-action from 3.29.11 to 3.30.5 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;234](https://redirect.github.com/astral-sh/ruff-action/issues/234)) - Bump github/codeql-action from 3.29.9 to 3.29.11 @&#8203;[dependabot\[bot\]](https://redirect.github.com/apps/dependabot) ([#&#8203;211](https://redirect.github.com/astral-sh/ruff-action/issues/211)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DrupalSecurityTeam/drupal-advisory-database).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -45,11 +45,11 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1
+      - uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
         with:
           version-file: 'pyproject.toml'
           args: 'check'
-      - uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1
+      - uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
         with:
           version-file: 'pyproject.toml'
           args: 'format --check --diff'
