build(deps): bump actions/setup-go from 6 to 7 - #340
Conversation
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
masutaka
left a comment
masutaka
left a comment
There was a problem hiding this comment.
Overview
- Package: actions/setup-go 6 → 7
- Dependency type: Development dependency (GitHub Actions workflows:
.github/workflows/test.ymland.github/workflows/release.yml) - Version change: Major
Key Findings
- Breaking Changes: Effectively none. The upstream
v6...v7range contains only 2 commits: migrating the action's internals to ESM (actions/setup-go#763) and bumping@actions/cacheto 6.2.0 (actions/setup-go#771). The README states explicitly: "Migrated action internals to ESM for compatibility with latest@actions/*packages. No changes to action inputs, outputs, or behavior." Indeed,action.ymlis completely unchanged from v6 — inputs, outputs, andruns.using: node24are all identical — so thego-version-fileinput used here is unaffected. - Security: None. There are 0 open Dependabot alerts, and no alert is linked to this PR. This is an ordinary version-bump PR, not a security update.
- Supported versions: Unchanged. The runner execution environment was already
node24in v6 and stays the same in v7. The workflows run onubuntu-latest/ubuntu-slim, so there is no issue. - CI status: Pass. actionlint, CodeQL (actions), dependency_review, and test all succeeded. No failures.
- Cascading updates: None. The diff is just the two lines changing
setup-go@v6tosetup-go@v7(+2 / -2).
Impact
No impact on the Go application code. Only the CI/release workflow steps that set up Go are affected, and the go-version-file: "go.mod" setting is left as is.
The upstream src/ diff consists solely of mechanical changes accompanying the ESM migration: adding .js extensions to import paths, replacing __dirname with import.meta.url, importing getVersionsDist directly instead of via module.exports, and adding {cause} to Error constructions. The version resolution, download, and caching logic itself is unchanged. The dist/ diff is large (over 80,000 lines), but that is the result of regenerating the bundler output as ESM and is not unusual. No suspicious URLs, added scripts, or commits from unknown authors were found.
Conclusion
No problems.
Despite being a major version bump, the actual content is limited to an internal ESM migration and a dependency update; the action's inputs, outputs, behavior, and required runtime are all unchanged. CI passes across the board, so this is safe to merge as is.
1 participant
Bumps actions/setup-go from 6 to 7.
Release notes
Sourced from actions/setup-go's releases.
... (truncated)
Commits
b7ad1dachore(deps): bump@actions/cacheto 6.2.0 (#771)0778a10Migrate to ESM and upgrade dependencies (#763)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)