Update GitHub Actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	major	v3 -> v4
actions/stale	action	major	v8 -> v9
github/codeql-action	action	major	v2 -> v3
suzuki-shunsuke/github-action-renovate-config-validator	action	major	v0.1.2 -> v1.1.1

---

Release Notes

actions/setup-node (actions/setup-node)

v4

Compare Source

actions/stale (actions/stale)

v9

Compare Source

github/codeql-action (github/codeql-action)

v3

Compare Source

suzuki-shunsuke/github-action-renovate-config-validator (suzuki-shunsuke/github-action-renovate-config-validator)

v1.1.1

Compare Source

Bug Fixes

#​768 #​770 #​772 Fixed a bug strict doesn't work

renovate-config-validator has an issue aboutRENOVATE_CONFIG_FILE.

• https://github.com/renovatebot/renovate/issues/30418

And now renovate-config-validator can accept files via positional arguments.

• https://github.com/renovatebot/renovate/pull/16475

Unlike RENOVATE_CONFIG_FILE, positional arguments can pass multiple files, so we don't need to run renovate-config-validator by file.
So this release replaces RENOVATE_CONFIG_FILE with positional arguments.

v1.1.0

Compare Source

Features

#​699 #​701 Support validating multiple files

You can validate multiple files by setting multiple lines to config_file_path.
Leading spaces on each line are removed.

e.g.

with:
  config_file_path: |
    default.json
    foo.json

You can pass config_file_path through output command.

e.g.

      - id: files
        run: |
          set -euo pipefail
          files=$(git ls-files | grep renovate.json)

### https://stackoverflow.com/a/74232400
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          {
            echo "files<<$EOF"
            echo "$files"
            echo "$EOF"
          } >> "$GITHUB_OUTPUT"
      - name: Pass files through output
        uses: suzuki-shunsuke/[email protected]
        with:
          config_file_path: ${{ steps.files.outputs.files }}

v1.0.1

Compare Source

Fixes

#​551 Suppress npx warnings using --yes option @​TWiStErRob

This action executes renovate-config-validator via npx, then the following warning was outputted.

npm WARN exec The following package was not found and will be installed: [email protected]

To suppress the warning, we set npx's --yes option.

https://docs.npmjs.com/cli/v8/commands/npx

If any requested packages are not present in the local project dependencies, then they are installed to a folder in the npm cache, which is added to the PATH environment variable in the executed process.
A prompt is printed (which can be suppressed by providing either --yes or --no).

To prevent security and user-experience problems from mistyping package names, npx prompts before installing anything.
Suppress this prompt with the -y or --yes option.
The --no-install option is deprecated, and will be converted to --no.

🎉 New contributors

Thank you for your contribution!

@​TWiStErRob #​551

v1.0.0

Compare Source

⚠️ Breaking Changes

#​531 renovate-config-validator's --strict option is enabled by default.

How to migrate

There are several options.

1. Recommended: Fix Renovate configuration according to the error message
2. Unrecommended: Set false to the input strict to disable --strict option

⚠️ Security Improvement

#​530 Pass inputs via environment variables to prevent malicious injection

Features

#​531 Add the input strict.

You can enable renovate-config-validator's --strict option.

v0.1.3

Compare Source

#​316 Support .renovaterc.json5 by default

https://docs.renovatebot.com/configuration-options/#configuration-options

---

Configuration

📅 Schedule: Branch creation - "before 3am every weekday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Automatically marking pull request as stale due to lack of activity