Skip to content

chore(deps): update github actions#23

Closed
bootc-bot[bot] wants to merge 3909 commits intomainfrom
bootc-renovate/github-actions
Closed

chore(deps): update github actions#23
bootc-bot[bot] wants to merge 3909 commits intomainfrom
bootc-renovate/github-actions

Conversation

@bootc-bot
Copy link
Copy Markdown
Contributor

@bootc-bot bootc-bot bot commented Dec 9, 2025

This PR contains the following updates:

Package Type Update Change
actions/checkout action major v4v6
actions/configure-pages action major v5v6
actions/create-github-app-token action major v2v3
actions/deploy-pages action major v4v5
actions/download-artifact action major v6.0.0v8.0.1
actions/upload-artifact action major v5v7
crazy-max/ghaction-import-gpg action major v6v7
peter-evans/create-pull-request action major v7v8

Release Notes

actions/checkout (actions/checkout)

v6

Compare Source

v5

Compare Source

actions/configure-pages (actions/configure-pages)

v6

Compare Source

actions/create-github-app-token (actions/create-github-app-token)

v3

Compare Source

actions/deploy-pages (actions/deploy-pages)

v5

Compare Source

actions/download-artifact (actions/download-artifact)

v8.0.1

Compare Source

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

Compare Source

v8 - What's new

[!IMPORTANT]
actions/download-artifact@​v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @​actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

Compare Source

v7 - What's new

[!IMPORTANT]
actions/download-artifact@​v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed
New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

actions/upload-artifact (actions/upload-artifact)

v7

Compare Source

v6

Compare Source

crazy-max/ghaction-import-gpg (crazy-max/ghaction-import-gpg)

v7

Compare Source

peter-evans/create-pull-request (peter-evans/create-pull-request)

v8

Compare Source


Configuration

📅 Schedule: Branch creation - "on sunday" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

henrywang and others added 30 commits September 10, 2025 20:55
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
ostree: Set parent of merge commit to base commit if present
- Removed `From<bytes::Parameter>` implementation for
  `utf8::Parameter` and similar for `utf8::ParameterKey`.  This was
  public and would allow end-users to construct utf8 parameters from
  non-utf8 data.  Replaced internally with `from_bytes` in the places
  where we know we can safely convert known-UTF-8 data.

- Added `TryFrom<bytes::Paramter>` implementation for
  `utf8::Parameter` to allow checked conversions, plus tests.

- Added `iter_utf8` and `find_utf8` to `bytes::Cmdline`, plus tests.

- Updated `find_root_args_to_inherit` in bootc to use these
  improvements.  Notably bootc will now allow non-UTF8 data in the
  kernel cmdline, *unless* it occurs in parameters that bootc is
  explicitly looking for.

- Added more tests to `find_root_args_to_inherit` to validate expected
  functionality with non-UTF-8 data.

- Fixed a parser bug that gemini pointed out with unmatched quotes,
  plus tests to check for that.

Signed-off-by: John Eckersberg <jeckersb@redhat.com>
kernel_cmdline: Refactor into separate `bytes` and `utf8` modules
test: Add integration test running on github runner
Add `add_or_modify` and `remove` methods to `Cmdline` in both `bytes`
and `utf8` modules, along with unit tests.

Closes: #1596
Signed-off-by: John Eckersberg <jeckersb@redhat.com>
kernel_cmdline: Add parameter manipulation methods
No functional changes, prep for further work.

Signed-off-by: Colin Walters <walters@verbum.org>
store: Move inner merge commit writing to a helper function
Over in bootc-dev/bootc#1607
I actually *just* deduplicated this code, but that isn't
ready to merge yet.

Signed-off-by: Colin Walters <walters@verbum.org>
integration: Copy distro-sync from main Dockerfile
See the updates to `Justfile` for how to use this.

Closes: #1428

Assisted-By: Claude Code (opus + sonnet)
Signed-off-by: Colin Walters <walters@verbum.org>
Switch to hand-written man pages with auto option sync
…sible

Signed-off-by: John Eckersberg <jeckersb@redhat.com>
We already impl AsRef<str> but this just makes it more convenient to
render the command line for users.

Signed-off-by: John Eckersberg <jeckersb@redhat.com>
There's no reason these need to be owned.

Signed-off-by: John Eckersberg <jeckersb@redhat.com>
The (now-named) parse_one method is not particularly useful outside of
`CmdlineIter`.  Almost always end users don't care about extra
unparsed content, they just want the `Option<Parameter>`.

This greatly improves ergnomics for users so they can create
parameters like...

`Parameter::parse("foo=bar").unwrap()`

... knowing at the call-site that "foo=bar" is a valid parameter so
the `unwrap()` is safe.

Signed-off-by: John Eckersberg <jeckersb@redhat.com>
This adds a new off-by default feature to enable
a new composefs-native backend for bootc. This
is all still a live work in progress, but
we're landing this first tranche of work to help
avoid continual issues with rebasing.

Thanks to everyone who worked on it!

xref bootc-dev/bootc#1190

Co-authored-by: John Eckersberg <jeckersb@redhat.com>
Co-authored-by: Robert Sturla <robertsturla@outlook.com>
Co-authored-by: Colin Walters <walters@verbum.org>
Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>
cmdline tweaks and improvements
I was hitting a compliation error which *looks*
like it was actaully an incremental compilation bug?
Or it might have been rust-analyzer and local builds
fighting over enabled features.

Anyways, this ensures that we're gating on the composefs
backend compiling.

Signed-off-by: Colin Walters <walters@verbum.org>
If we find UKI addons in the boot entries list, write them to ESP along
with the UKI

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>
We don't need to write Grub menuentries for systemd-boot. For now the
operation is a no-op, but later we would want to have .conf files in
`ESP/loader/entries` so we can control the order of entries.

Regarding that, we would also need to place the UKIs in a separate
directory and not inside `ESP/EFI/Linux`, if we don't want duplicate
entries, as systemd-boot will simply list all .efi files placed in
EFI/Linux unconditionally

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>
A key thing for me is that the `Justfile` should be a one-stop
shop for development of the project. It can't have everything but
it should answer the basic questions of "how do I build and test
this project".

This aligns the recently added tmt-on-GHA flow a *bit* more closely
with some of that. Biggest is to use the `just build-integration-test-image` as the canonical
way to build a container image with our testing stuff in it;
which uses our main Dockerfile

Other cleanups:
- Change test script to move into tests/tmt/ as a workaround for
  teemtee/tmt#3037 (comment)
- Change the qemu logic to use SMBIOS credentials so we don't
  have to carry around both a disk image and a SSH key
- Change qemu to use `-snapshot` so we can reuse disks
- Change the scripts to accept data via argv[1] and not environment
- Drop the hardcoded testing directory and use `target/` as
  a generic build artifact dir

Signed-off-by: Colin Walters <walters@verbum.org>
Followup to bootc-dev/bootc#1587
Closes: bootc-dev/bootc#1616

Signed-off-by: Colin Walters <walters@verbum.org>
This should reduce the flake rate.

Signed-off-by: Colin Walters <walters@verbum.org>
- Remove duplicated logic between xtask and makefile
  for converting markdown; it needs to be in xtask
  as we handle the version substitution there and
  some other tweaks
- Really just make the developer entrypoint `just update-generated`
  in general
- Fix the rendering of booleans
- Remove unnecessary emoji from prints

Signed-off-by: Colin Walters <walters@verbum.org>
I broke this a while ago.

Signed-off-by: Colin Walters <walters@verbum.org>
cgwalters and others added 12 commits November 19, 2025 16:59
Since other tests are hitting it.

Signed-off-by: Colin Walters <walters@verbum.org>
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
Add check to prevent soft reboot when SELinux policies differ
between booted and target deployments, since policy is not
reloaded across soft reboots.

Assisted-by: Cursor (Auto)
Signed-off-by: gursewak1997 <gursmangat@gmail.com>
Right now touching e.g. xtask.rs causes a build phase when
it shouldn't, this helps bypassing that.

Signed-off-by: Colin Walters <walters@verbum.org>
We need to run most of our tests in a separate provisioned machine,
which means it needs an individual plan. And then we need a test
for that plan. And then we need the *actual test code*.

This "triplication" is a huge annoying pain.

TMT is soooo complicated, yet as far as I can tell it doesn't offer
us any tools to solve this. So we'll do it here, cut over to
generating the TMT stuff from metadata defined in the test file.

Hence adding a test is just:

- Write a new tests/booted/foo.nu
- `cargo xtask update-generated`

Signed-off-by: Colin Walters <walters@verbum.org>
…tion

Move TMT test runner code from xtask.rs to tmt module:
- `run_tmt()` and `tmt_provision()` functions
- Helper functions for VM management and SSH connectivity
- Related constants

Also refactor `update_integration()` to use serde_yaml::Value for
building YAML structures instead of string concatenation.

Add detailed error reporting for failed TMT tests:
- Assign run IDs using `tmt run --id`
- Display verbose reports with `tmt run -i {id} report -vvv`

Assisted-by: Claude Code (Sonnet 4.5)
Signed-off-by: Colin Walters <walters@verbum.org>
Otherwise we compile many dependencies twice unnecessarily.

Signed-off-by: Colin Walters <walters@verbum.org>
To make it easier to do upgrade tests.

Signed-off-by: Colin Walters <walters@verbum.org>
This ensures it all can work much more elegantly/naturally
with sealed UKI builds - we don't want to do the build-on-target
thing.

Signed-off-by: Colin Walters <walters@verbum.org>
Signed-off-by: Colin Walters <walters@verbum.org>
1. Fix variable issue in test-bound-storage
2. Fix permission issue in logically-bound-switch,
   image-pushpull-upgrade, soft-reboot and custom-selinux-policy

Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@bootc-bot bootc-bot bot requested a review from ckyrouac December 9, 2025 21:12
@bootc-bot bootc-bot bot changed the title chore(deps): update peter-evans/create-pull-request action to v8 chore(deps): update github actions Dec 12, 2025
@bootc-bot bootc-bot bot force-pushed the bootc-renovate/github-actions branch from fc788c9 to 5967bf9 Compare December 12, 2025 19:11
Add a workflow_dispatch-triggered workflow for interactive debugging
on arm64 GitHub runners using action-upterm for SSH access.

This is for investigating the bootc-ubuntu-setup failure on arm64
where the plucky apt repository uses the wrong mirror URL
(azure.archive.ubuntu.com instead of ports.ubuntu.com).

See: https://github.com/cgwalters/service-gator/actions/runs/21484445531

Assisted-by: OpenCode (Claude claude-opus-4-5)
Test the proposed fix for the bootc-ubuntu-setup action on arm64.
The issue is that azure.archive.ubuntu.com only hosts amd64 packages,
so arm64 needs to use ports.ubuntu.com/ubuntu-ports instead.

Assisted-by: OpenCode (Claude claude-opus-4-5)
@bootc-bot bootc-bot bot force-pushed the bootc-renovate/github-actions branch from 5967bf9 to 92e4095 Compare January 29, 2026 18:23
Copy the bootc-ubuntu-setup action locally and fix:
1. Use correct apt mirror for arm64 (ports.ubuntu.com/ubuntu-ports)
2. Handle missing /dev/kvm on arm64 runners gracefully

Also syncs other improvements from upstream actions repo.

Assisted-by: OpenCode (Claude claude-opus-4-5)
@bootc-bot bootc-bot bot force-pushed the bootc-renovate/github-actions branch 3 times, most recently from f0ba31b to 2bc8cc3 Compare March 2, 2026 12:23
@bootc-bot bootc-bot bot force-pushed the bootc-renovate/github-actions branch 2 times, most recently from 69b6d5e to 42d61ca Compare March 14, 2026 00:42
@bootc-bot bootc-bot bot force-pushed the bootc-renovate/github-actions branch from 42d61ca to 1b6d47e Compare March 25, 2026 17:30
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
@bootc-bot bootc-bot bot force-pushed the bootc-renovate/github-actions branch from 1b6d47e to 49ee18f Compare March 27, 2026 18:28
@cgwalters cgwalters closed this Apr 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.