Skip to content

chore(deps): bump actions/cache from 5 to 6#1271

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/actions/cache-6
Open

chore(deps): bump actions/cache from 5 to 6#1271
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/actions/cache-6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 24, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps actions/cache from 5 to 6.

Release notes

Sourced from actions/cache's releases.

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Summary by CodeRabbit

  • Chores
    • Updated the caching step in two CI workflows to a newer version, helping keep build pipelines current and reliable.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 24, 2026
@openshift-ci openshift-ci Bot requested a review from alexeykazakov June 24, 2026 12:32
@openshift-ci

openshift-ci Bot commented Jun 24, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign metlos for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot requested a review from rajivnathan June 24, 2026 12:32
@openshift-ci

openshift-ci Bot commented Jun 24, 2026

Copy link
Copy Markdown

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a codeready-toolchain member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@coderabbitai

coderabbitai Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d76d915d-7357-488b-a46b-c62194595907

📥 Commits

Reviewing files that changed from the base of the PR and between 574a3b6 and 27196c1.

📒 Files selected for processing (2)
  • .github/workflows/operator-cd.yml
  • .github/workflows/publish-components-for-e2e-tests.yml
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

✅ Files skipped from review due to trivial changes (1)
  • .github/workflows/publish-components-for-e2e-tests.yml
📜 Recent review details
⏰ Context from checks skipped due to timeout. (3)
  • GitHub Check: GolangCI Lint
  • GitHub Check: test
  • GitHub Check: Build & push operator bundles & dashboard image for e2e tests
🧰 Additional context used
🪛 zizmor (1.26.1)
.github/workflows/operator-cd.yml

[error] 29-29: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🔀 Multi-repo context codeready-toolchain/registration-service, codeready-toolchain/member-operator, codeready-toolchain/toolchain-e2e, codeready-toolchain/api, codeready-toolchain/toolchain-common

Linked repositories findings

codeready-toolchain/registration-service

Inspected the PR branch refs/pull/601/head.

  • .github/workflows/operator-cd.yml
  • .github/workflows/publish-components-for-e2e-tests.yml

Both still use actions/cache@v5, matching the workflow change in the PR and suggesting this repo should be updated in the same way. [::codeready-toolchain/registration-service::]

codeready-toolchain/member-operator

Inspected the PR branch refs/pull/748/head.

  • .github/workflows/operator-cd.yml
  • .github/workflows/publish-components-for-e2e-tests.yml

Both still use actions/cache@v5, so this repo has the same pending cache-action bump. [::codeready-toolchain/member-operator::]

codeready-toolchain/toolchain-e2e

Inspected the PR branch refs/pull/1289/head.

  • .github/workflows/publish-components-for-e2e-tests.yml

This workflow still uses actions/cache@v5, aligning with the PR’s workflow update. [::codeready-toolchain/toolchain-e2e::]

codeready-toolchain/api

No related workflow or actions/cache@v5/v6 references found. [::codeready-toolchain/api::]

codeready-toolchain/toolchain-common

No related workflow or actions/cache@v5/v6 references found. [::codeready-toolchain/toolchain-common::]

🔇 Additional comments (1)
.github/workflows/operator-cd.yml (1)

29-29: 🔒 Security & Privacy

Confirm this cache is only used on trusted refs.

The broad restore-keys prefix is a known cache-poisoning pattern if this workflow can run on untrusted branches or PRs. Please verify the trigger/permissions model before keeping this cache path as-is. (github.com)

Source: Linters/SAST tools

Walkthrough

Two GitHub Actions workflows update their dependency cache step from actions/cache@v5 to actions/cache@v6.

Changes

Workflow cache version bump

Layer / File(s) Summary
Cache action version update
.github/workflows/operator-cd.yml, .github/workflows/publish-components-for-e2e-tests.yml		 Both workflows switch their dependency caching step from actions/cache@v5 to actions/cache@v6.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: MatousJobanek

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: upgrading actions/cache from v5 to v6.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dependabot/github_actions/actions/cache-6

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot added the ci Add or update CI/CD configuration label Jun 24, 2026
@coderabbitai coderabbitai Bot mentioned this pull request Jun 25, 2026
Open
@dependabot
chore(deps): bump actions/cache from 5 to 6
27196c1 
Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5...v6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/github_actions/actions/cache-6 branch from 574a3b6 to 27196c1 Compare July 8, 2026 08:01
@sonarqubecloud

sonarqubecloud Bot commented Jul 8, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@coderabbitai coderabbitai Bot mentioned this pull request Jul 8, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@alexeykazakov alexeykazakov Awaiting requested review from alexeykazakov
@rajivnathan rajivnathan Awaiting requested review from rajivnathan

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

ci Add or update CI/CD configuration dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code needs-ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants