From 450eeeb2d2424a3a1de05825f593f7ba9c2b896b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 15 Jul 2026 20:48:56 +0000 Subject: [PATCH] build(deps): bump the github-actions group with 7 updates Bumps the github-actions group with 7 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6` | `7` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `3.0.3` | `4.0.2` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.82.6` | `2.83.2` | | [j178/prek-action](https://github.com/j178/prek-action) | `dec4adcd2fa1db9d50a39668b22112a37235e730` | `c4fa77110131e365aa6c7c78641ec120ccb1762a` | | [actions/cache](https://github.com/actions/cache) | `5.1.0` | `6.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) Updates `dorny/paths-filter` from 3.0.3 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](https://github.com/dorny/paths-filter/compare/d1c1ffe0248fe513906c8e24db8ea791d46f8590...7b450fff21473bca461d4b92ce414b9d0420d706) Updates `taiki-e/install-action` from 2.82.6 to 2.83.2 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/9bcaee1dcae34154180f412e2fa69355a7cda9f6...43aecc8d72668fbcfe75c31400bc4f890f1c5853) Updates `j178/prek-action` from dec4adcd2fa1db9d50a39668b22112a37235e730 to c4fa77110131e365aa6c7c78641ec120ccb1762a - [Release notes](https://github.com/j178/prek-action/releases) - [Commits](https://github.com/j178/prek-action/compare/dec4adcd2fa1db9d50a39668b22112a37235e730...c4fa77110131e365aa6c7c78641ec120ccb1762a) Updates `actions/cache` from 5.1.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/caa296126883cff596d87d8935842f9db880ef25...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.83.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: j178/prek-action dependency-version: c4fa77110131e365aa6c7c78641ec120ccb1762a dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 58 +++++++++++++++++------------------ .github/workflows/nightly.yml | 12 ++++---- .github/workflows/release.yml | 6 ++-- 3 files changed, 38 insertions(+), 38 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7012da2b..f37fc912 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -86,12 +86,12 @@ jobs: lint: ${{ steps.filter.outputs.lint || steps.all.outputs.forced }} tpn: ${{ steps.filter.outputs.tpn || steps.all.outputs.forced }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Filter changed paths (pull requests only) id: filter if: github.event_name == 'pull_request' - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3.0.2 + uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v3.0.2 with: filters: | # Rust-only checks (fmt, clippy, coverage). @@ -153,7 +153,7 @@ jobs: # tolerate a skipped build-and-test in their own `if:` guards. if: github.event_name != 'workflow_dispatch' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install native build deps if: needs.changes.outputs.heavy == 'true' @@ -217,7 +217,7 @@ jobs: # A manual E2E dispatch only exercises the E2E jobs; skip the rest. if: github.event_name != 'workflow_dispatch' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # `cargo xtask affected` diffs origin/...HEAD, so it needs the # base history and the real PR head (not the synthetic merge ref). @@ -239,7 +239,7 @@ jobs: - name: Install cargo-nextest if: needs.changes.outputs.rust == 'true' - uses: taiki-e/install-action@9bcaee1dcae34154180f412e2fa69355a7cda9f6 # v2.82.6 + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 with: tool: nextest @@ -276,7 +276,7 @@ jobs: # A manual E2E dispatch only exercises the E2E jobs; skip the rest. if: github.event_name != 'workflow_dispatch' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 if: needs.changes.outputs.heavy == 'true' @@ -342,7 +342,7 @@ jobs: # Exception: a manual E2E dispatch only exercises the E2E jobs; skip the rest. if: github.event_name != 'workflow_dispatch' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # cargo-fmt hook needs rustfmt (no build). - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 @@ -356,7 +356,7 @@ jobs: # it, so a tampered release can't be installed. This commit is past the # v2.0.4 tag because it is the one that added prek 0.4.5 to that map — pin # an earlier commit and the action would not know 0.4.5 and skip the check. - - uses: j178/prek-action@dec4adcd2fa1db9d50a39668b22112a37235e730 # prek 0.4.5 checksums + - uses: j178/prek-action@c4fa77110131e365aa6c7c78641ec120ccb1762a # prek 0.4.5 checksums with: prek-version: 0.4.5 extra-args: --all-files --no-group local-tools @@ -367,7 +367,7 @@ jobs: # A manual E2E dispatch only exercises the E2E jobs; skip the rest. if: github.event_name != 'workflow_dispatch' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 if: needs.changes.outputs.rust == 'true' @@ -395,7 +395,7 @@ jobs: # A manual E2E dispatch only exercises the E2E jobs; skip the rest. if: github.event_name != 'workflow_dispatch' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 if: needs.changes.outputs.tpn == 'true' @@ -409,7 +409,7 @@ jobs: - name: Cache cargo-about if: needs.changes.outputs.tpn == 'true' id: cache-cargo-about - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cargo/bin/cargo-about key: ${{ runner.os }}-cargo-about-0.9.1 @@ -429,7 +429,7 @@ jobs: # A manual E2E dispatch only exercises the E2E jobs; skip the rest. if: github.event_name != 'workflow_dispatch' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install native build deps if: needs.changes.outputs.rust == 'true' @@ -442,13 +442,13 @@ jobs: - name: Install cargo-llvm-cov if: needs.changes.outputs.rust == 'true' - uses: taiki-e/install-action@9bcaee1dcae34154180f412e2fa69355a7cda9f6 # v2.82.6 + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 with: tool: cargo-llvm-cov - name: Cache cargo registry and build if: needs.changes.outputs.rust == 'true' - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cargo/registry @@ -484,7 +484,7 @@ jobs: # A manual E2E dispatch only exercises the E2E jobs; skip the rest. if: github.event_name != 'workflow_dispatch' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 if: needs.changes.outputs.lint == 'true' @@ -528,11 +528,11 @@ jobs: # A manual E2E dispatch only exercises the E2E jobs; skip the rest. if: github.event_name != 'workflow_dispatch' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Cache hawkeye binary id: cache-hawkeye - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ env.HAWKEYE_INSTALL_DIR }} key: ${{ runner.os }}-hawkeye-${{ env.HAWKEYE_VERSION }}-${{ env.HAWKEYE_SHA256 }} @@ -563,7 +563,7 @@ jobs: # entry would stall forever. if: github.event_name == 'pull_request' || github.event_name == 'merge_group' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # PR: check out the PR head, not the synthetic refs/pull/N/merge commit @@ -623,7 +623,7 @@ jobs: && (github.event_name != 'workflow_dispatch' || inputs.platform == 'all' || inputs.platform == 'mock') steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 # Whether the real work runs this time. On push/PR/merge_group: only when # build-and-test succeeded and the change is heavy. On workflow_dispatch: @@ -661,7 +661,7 @@ jobs: - name: Upload E2E report if: always() && steps.gate.outputs.run == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: e2e-report path: tests/e2e-cucumber/results/ @@ -704,7 +704,7 @@ jobs: # a single nightly scenario (e.g. the 27B serve) without the full nightly run. E2E_INCLUDE_NIGHTLY: "${{ inputs.include_nightly && '1' || '' }}" steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 # Reclaim the GPU before running: a serve leaked by a killed/timed-out prior # run (its Drop teardown never executed) can keep an engine process spinning @@ -855,7 +855,7 @@ jobs: - name: Upload E2E report if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: e2e-gpu-report path: tests/e2e-cucumber/results/ @@ -897,7 +897,7 @@ jobs: PIP_CACHE_DIR: /home/ubuntu/actions-runner/pip-cache E2E_SERVE_TIMEOUT_SECS: "300" steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Prepare writable dirs on the nvme + reclaim GPU from stray E2E procs run: | @@ -1008,7 +1008,7 @@ jobs: - name: Upload E2E report if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: e2e-gpu-strix-ubuntu-report path: tests/e2e-cucumber/results/ @@ -1036,7 +1036,7 @@ jobs: ) continue-on-error: true steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 # setup-rust-toolchain runs an internal bash script, which this Windows # runner lacks (bash: command not found). Bootstrap rustup with the @@ -1157,7 +1157,7 @@ jobs: - name: Upload E2E report if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: e2e-gpu-strix-windows-report path: tests/e2e-cucumber/results/ @@ -1190,7 +1190,7 @@ jobs: && (needs.changes.outputs.heavy == 'true' || github.event_name == 'workflow_dispatch') steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions-rust-lang/setup-rust-toolchain@v1 @@ -1198,7 +1198,7 @@ jobs: # which `xtask e2e-report` turns into one labeled platform. The `*-report` # glob is what makes new platforms appear automatically. - name: Download all E2E reports - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: '*-report' path: e2e-artifacts @@ -1212,7 +1212,7 @@ jobs: - name: Upload consolidated report if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: e2e-consolidated-report path: consolidated/ diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index d1e8bf55..ecfc427b 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -21,7 +21,7 @@ jobs: short_sha: ${{ steps.meta.outputs.short_sha }} staging_tag: ${{ steps.staging.outputs.tag }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check for changes since last nightly id: check @@ -41,7 +41,7 @@ jobs: - name: Cache Cargo home and build artifacts if: steps.check.outputs.skip != 'true' - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cargo/bin @@ -178,7 +178,7 @@ jobs: needs: nightly if: needs.nightly.outputs.skip != 'true' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 @@ -235,7 +235,7 @@ jobs: - windows-nightly if: needs.nightly.outputs.skip != 'true' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Publish staged nightly env: @@ -327,7 +327,7 @@ jobs: # model (its cold ~54 GiB load exceeds this default). E2E_SERVE_TIMEOUT_SECS: "300" steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 # Reclaim the GPU before running: kill only e2e leftovers scoped to # /tmp/rocm-e2e-* and the e2e-target/e2e-shared trees — never the runner or @@ -385,7 +385,7 @@ jobs: - name: Upload E2E report if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: e2e-gpu-nightly-report path: tests/e2e-cucumber/results/ diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5eda7004..a32c1003 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,7 @@ jobs: outputs: version: ${{ steps.version.outputs.value }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Determine version id: version @@ -47,7 +47,7 @@ jobs: echo "value=${VERSION}" >> "$GITHUB_OUTPUT" - name: Cache Cargo home and build artifacts - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cargo/bin @@ -162,7 +162,7 @@ jobs: runs-on: windows-latest needs: release steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0