chore(deps): bump actions/setup-node from 4 to 5 #6076
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 5. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v5) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
WalkthroughBumps Changes
Sequence Diagram(s)sequenceDiagram
participant GH as GitHub Actions
participant Setup as actions/setup-node@v5
participant Corepack as corepack/yarn
participant Yarn as yarn scripts
Note over GH,Setup #E8F0FF: Workflow start (docs-check)
GH->>Setup: run setup-node (node-version: 20, package-manager-cache: false)
Setup-->>GH: node available
GH->>Corepack: corepack enable
Corepack-->>GH: corepack ready
GH->>Yarn: yarn --immutable
Yarn-->>GH: install OK
Note over GH,Yarn #E8F8E8: New additional checks
GH->>Yarn: yarn typecheck
GH->>Yarn: yarn spellcheck
GH->>Yarn: yarn format-check
GH->>Yarn: yarn build
Yarn-->>GH: checks complete
Note over GH #FFF4E6: Previous flow ended after `yarn --immutable` (no additional checks)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Comment |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
.github/workflows/docs-check.yml (1)
34-39: Guard against unintended v5 auto-caching; explicitly set package-manager-cache.setup-node v5 auto-enables package-manager caching when package.json has a packageManager field. Your prior config intentionally left caching off (comment referencing issue 1027). To preserve behavior and avoid surprise cache interactions, disable it explicitly.
Apply this diff:
- uses: actions/setup-node@v5 with: node-version: 20 + package-manager-cache: false # See https://github.com/actions/setup-node/issues/1027 # cache: yarnAlternatively, if you want caching, set a scoped dependency path (example for docs):
with: node-version: 20 package-manager-cache: true cache-dependency-path: docs/yarn.lockPlease confirm whether docs/package.json declares a packageManager field; if yes, v5 would currently auto-cache without the explicit flag. Also confirm you’re not on self-hosted runners (v5 requires runner v2.327.1+).
.github/workflows/docs-deploy.yml (1)
32-37: Disable or scope v5’s automatic package-manager cache to avoid behavior drift.Same concern as docs-check: v5 will auto-cache if packageManager is present. Explicitly disable to match previous behavior, or scope it to docs.
- uses: actions/setup-node@v5 with: node-version: 20 + package-manager-cache: false # See https://github.com/actions/setup-node/issues/1027 # cache: yarnIf opting in to caching, prefer:
with: node-version: 20 package-manager-cache: true cache-dependency-path: docs/yarn.lockConfirm whether caching is desired during deploy and that it won’t affect build determinism.
.github/workflows/docs-auto-update.yml (1)
18-23: Explicitly control v5 auto-cache; this job runs at repo root and may pick the wrong lockfile.This workflow doesn’t set a working-directory for the Yarn steps, so auto-detection may target the repo root package.json/lockfile instead of docs. Disable caching or specify the dependency path.
- uses: actions/setup-node@v5 with: node-version: 20 + package-manager-cache: falseIf enabling caching, scope it:
with: node-version: 20 package-manager-cache: true cache-dependency-path: | yarn.lock docs/yarn.lockPlease confirm where your Yarn lockfile(s) live (root vs docs) so we can set cache-dependency-path accurately.
.github/workflows/scripts-lint.yml (1)
78-83: Prevent unintended caching in lint job or scope it to the correct lockfile.setup-node v5 auto-caches if packageManager exists; for a lint-only job this is unnecessary and can add cache churn. Disable or scope explicitly.
- uses: actions/setup-node@v5 with: node-version: 20 + package-manager-cache: falseIf you prefer caching to speed up yarn yaml-check:
with: node-version: 20 package-manager-cache: true cache-dependency-path: yarn.lockConfirm whether the repository uses Yarn workspaces or multiple lockfiles; if so, list them to avoid cache key skew.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/docs-auto-update.yml(1 hunks).github/workflows/docs-check.yml(1 hunks).github/workflows/docs-deploy.yml(1 hunks).github/workflows/scripts-lint.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: tests
- GitHub Check: cargo-publish-dry-run
- GitHub Check: tests-release
- GitHub Check: All lint checks
- GitHub Check: Build MacOS
- GitHub Check: Build Ubuntu
- GitHub Check: Build forest binaries on Linux AMD64
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/docs-check.yml (1)
33-34: Optional: consider bumping actions/checkout to v5 for consistency.Not required for this PR, but aligning on the latest major of checkout reduces future churn across workflows.
Apply if desired:
- - uses: actions/checkout@v4 + - uses: actions/checkout@v5
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/docs-auto-update.yml(1 hunks).github/workflows/docs-check.yml(1 hunks).github/workflows/docs-deploy.yml(1 hunks).github/workflows/scripts-lint.yml(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (3)
- .github/workflows/scripts-lint.yml
- .github/workflows/docs-auto-update.yml
- .github/workflows/docs-deploy.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: Build forest binaries on Linux AMD64
- GitHub Check: tests-release
- GitHub Check: tests
- GitHub Check: Build MacOS
- GitHub Check: cargo-publish-dry-run
- GitHub Check: Build Ubuntu
- GitHub Check: All lint checks
- GitHub Check: Check
🔇 Additional comments (1)
.github/workflows/docs-check.yml (1)
34-37: Approve: bump actions/setup-node@v5; package-manager-cache explicitly disabled
- No remaining actions/setup-node@v4 occurrences.
- package-manager-cache: false is set in .github/workflows/scripts-lint.yml, .github/workflows/docs-deploy.yml, .github/workflows/docs-check.yml, .github/workflows/docs-auto-update.yml; docs/package.json lists packageManager: yarn@4.9.2 — disabling auto PM cache is intentional.
- Keeping node-version: 20 in the job is fine; actions/checkout@v4 is still used widely (optional separate bump).
Bumps actions/setup-node from 4 to 5.
Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
a0853c2Bump actions/checkout from 4 to 5 (#1345)b7234ccUpgrade action to use node24 (#1325)d7a1131Enhance caching in setup-node with automatic package manager detection (#1348)5e2628cBumps form-data (#1332)65becefBump undici from 5.28.5 to 5.29.0 (#1295)7e24a65Bump uuid from 9.0.1 to 11.1.0 (#1273)08f58d1Bump@octokit/request-errorand@actions/github(#1227)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit