gha: Bump deprecated GHA workflow dependencies
What the developer wrote
Authored by Tim Ruffing
gha: Bump deprecated GHA workflow dependencies
Deprecation notice:
https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Changelogs (no entries relevant to us):
* https://github.com/docker/setup-buildx-action/releases/tag/v4.0.0
* https://github.com/docker/build-push-action/releases/tag/v7.0.0
* https://github.com/actions/cache#v5
What changed, and why it matters
This commit simply updates several GitHub Actions workflow dependencies to newer major versions because the older versions rely on a Node.js runtime that GitHub is deprecating. It does not change any cryptographic code, build logic, or project behavior. There is no security vulnerability being fixed here.
No security action needed. Treat as routine CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch bumps three GitHub Actions references in CI configuration files: actions/cache from v4 to v5, docker/setup-buildx-action from v3 to v4, and docker/build-push-action from v6 to v7. The commit message explicitly frames this as a response to GitHub’s deprecation of Node 20 on runners and notes the changelogs contain no relevant entries. No source code, build scripts, or cryptographic operations are modified.
Changed components
.github/actions/install-homebrew-valgrind/action.yml.github/actions/run-in-docker-action/action.yml.github/workflows/ci.ymlInspect captured patch +6 / −6
diff --git a/.github/actions/install-homebrew-valgrind/action.yml b/.github/actions/install-homebrew-valgrind/action.yml
index ce10eb2..e9aa615 100644
--- a/.github/actions/install-homebrew-valgrind/action.yml
+++ b/.github/actions/install-homebrew-valgrind/action.yml
@@ -16,7 +16,7 @@ runs:
cat valgrind_fingerprint
shell: bash
- - uses: actions/cache@v4
+ - uses: actions/cache@v5
id: cache
with:
path: ${{ env.CI_HOMEBREW_CELLAR_VALGRIND }}
diff --git a/.github/actions/run-in-docker-action/action.yml b/.github/actions/run-in-docker-action/action.yml
index bbbcf32..f0eb981 100644
--- a/.github/actions/run-in-docker-action/action.yml
+++ b/.github/actions/run-in-docker-action/action.yml
@@ -13,9 +13,9 @@ inputs:
runs:
using: "composite"
steps:
- - uses: docker/setup-buildx-action@v3
+ - uses: docker/setup-buildx-action@v4
- - uses: docker/build-push-action@v6
+ - uses: docker/build-push-action@v7
id: main_builder
continue-on-error: true
with:
@@ -24,7 +24,7 @@ runs:
load: true
cache-from: type=gha,scope=${{ inputs.scope }}
- - uses: docker/build-push-action@v6
+ - uses: docker/build-push-action@v7
id: retry_builder
if: steps.main_builder.outcome == 'failure'
with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44c2754..152f9a1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,14 +73,14 @@ jobs:
run: echo "period=$((10#$(date +%V) / 4))" >> "$GITHUB_OUTPUT"
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
+ uses: docker/setup-buildx-action@v4
with:
# See: https://github.com/moby/buildkit/issues/3969.
driver-opts: |
network=host
- name: Build container
- uses: docker/build-push-action@v6
+ uses: docker/build-push-action@v7
with:
file: ./ci/linux-debian.Dockerfile
cache-from: type=gha,scope=${{ runner.arch }}-${{ steps.cache_timestamp.outputs.period }}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.