Update GitHub Workflows (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v5 → v7
actions/github-script	action	major	v8 → v9
opentofu/setup-opentofu	action	major	v1 → v2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v6

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/github-script (actions/github-script)

v9.0.0

Compare Source

New features:

• getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
• Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

• require('@​actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@​actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@​actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
• getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
• If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

• Add ACTIONS_ORCHESTRATION_ID to user-agent string by @​Copilot in #​695
• ci: use deployment: false for integration test environments by @​salmanmkc in #​712
• feat!: add getOctokit to script context, upgrade @​actions/github v9, @​octokit/core v7, and related packages by @​salmanmkc in #​700

New Contributors

• @​Copilot made their first contribution in #​695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v9

Compare Source

opentofu/setup-opentofu (opentofu/setup-opentofu)

v2.0.2

Compare Source

What's Changed

• feat: verify download against published SHA256SUMS by default by @​somaz94 in #​121

New Contributors

• @​somaz94 made their first contribution in #​121

Full Changelog: opentofu/setup-opentofu@v2...v2.0.2

v2.0.1

Compare Source

What's Changed

• dependencies bump by @​diofeher in #​96
• feat(error-handling): error notification for network failures by @​hoivikaj in #​94
• Update README with latest action versions. by @​ab in #​99
• chore(ci): dependabot actions ecosystem, conventional commits by @​hoivikaj in #​98
• feat: added support for providing optional checksums for ZIP validation by @​Snafuh in #​107
• feat(acc): Add provider_acceptance_tests input for automated acceptance test setup by @​hoivikaj in #​97

New Contributors

• @​hoivikaj made their first contribution in #​94
• @​ab made their first contribution in #​99
• @​Snafuh made their first contribution in #​107

Full Changelog: opentofu/setup-opentofu@v2...v2.0.1

v2.0.0

Compare Source

What's Changed

• Update Node.js runtime to 24 by @​Yantrio in #​91

New Contributors

• @​Yantrio made their first contribution in #​91

Full Changelog: opentofu/setup-opentofu@v1...v2.0.0

v2

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

OpenTofu Format and Style 🖌success

OpenTofu Initialization ⚙️success

OpenTofu Validation 🤖success

Validation Output

Success! The configuration is valid.

OpenTofu Plan 📖success

Show Plan

tofu
civo_object_store_credential.cloudnativenow-backup: Refreshing state... [id=2085a5d9-2c85-4412-9153-6592a6daa8c0]
civo_network.cloudnativenow: Refreshing state... [id=2307557a-b07f-4d7c-9c38-b5ebee2f59c7]
civo_object_store.cloudnativenow-backup: Refreshing state... [id=923e220e-cc49-4616-83ef-684682f621bd]
civo_firewall.cloudnativenow: Refreshing state... [id=5ba41838-5fc3-4da0-9dae-3b7d8d16ef09]
civo_database.cloudnativenow: Refreshing state... [id=5eee285c-486b-469c-8b79-3dc66dff0185]
civo_kubernetes_cluster.cloudnativenow: Refreshing state... [id=371c04de-235e-4fa2-bd53-8ba42bc460d3]
flux_bootstrap_git.cloudnativenow: Refreshing state... [id=flux-system]
kubernetes_secret.ghost-database-password: Refreshing state... [id=ghost/ghost-database]
kubernetes_secret.cluster-autoscaler: Refreshing state... [id=kube-system/cluster-autoscaler-civo]
kubernetes_secret.ghost-backup-creds: Refreshing state... [id=ghost/ghost-backup-creds]

Note: Objects have changed outside of OpenTofu

OpenTofu detected the following changes made outside of OpenTofu since the
last "tofu apply" which may have affected this plan:

  # civo_kubernetes_cluster.cloudnativenow has changed
  ~ resource "civo_kubernetes_cluster" "cloudnativenow" {
        id                     = "371c04de-235e-4fa2-bd53-8ba42bc460d3"
      ~ kubeconfig             = (sensitive value)
        name                   = "CloudNative.now"
        # (16 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)

OpenTofu will perform the following actions:

  # civo_firewall.cloudnativenow will be updated in-place
  ~ resource "civo_firewall" "cloudnativenow" {
        id                   = "5ba41838-5fc3-4da0-9dae-3b7d8d16ef09"
        name                 = "cloudnativenow-firewall"
        # (3 unchanged attributes hidden)

      - ingress_rule {
          - action   = "allow" -> null
          - cidr     = [
              - "0.0.0.0/0",
            ] -> null
          - id       = "8c6f464e-7e4b-4772-b901-b7c809df07eb" -> null
          - label    = "ping" -> null
          - protocol = "icmp" -> null
        }
      - ingress_rule {
          - action     = "allow" -> null
          - cidr       = [
              - "88.97.214.159/32",
            ] -> null
          - id         = "df88ccbf-0a8b-4781-88d9-a22d54cecfa5" -> null
          - label      = "Local" -> null
          - port_range = "3306" -> null
          - protocol   = "tcp" -> null
        }
      + ingress_rule {
          + action   = "allow"
          + cidr     = [
              + "0.0.0.0/0",
            ]
          + id       = "8c6f464e-7e4b-4772-b901-b7c809df07eb"
          + label    = "ping"
          + protocol = "icmp"
        }
      + ingress_rule {
          + action     = "allow"
          + cidr       = [
              + "88.97.210.216/32",
            ]
          + id         = (known after apply)
          + label      = "local"
          + port_range = "3306"
          + protocol   = "tcp"
        }

        # (11 unchanged blocks hidden)
    }

  # civo_kubernetes_cluster.cloudnativenow will be updated in-place
  ~ resource "civo_kubernetes_cluster" "cloudnativenow" {
        id                     = "371c04de-235e-4fa2-bd53-8ba42bc460d3"
      ~ kubernetes_version     = "1.36.0-k3s1" -> "1.30.5-k3s1"
        name                   = "CloudNative.now"
        # (16 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # flux_bootstrap_git.cloudnativenow will be updated in-place
  ~ resource "flux_bootstrap_git" "cloudnativenow" {
        id                   = "flux-system"
      ~ repository_files     = {
          ~ "flux/flux-system/gotk-sync.yaml"       = <<-EOT
              - 
              + # This manifest was generated by flux. DO NOT EDIT.
              + ---
              + apiVersion: source.toolkit.fluxcd.io/v1
              + kind: GitRepository
              + metadata:
              +   name: flux-system
              +   namespace: flux-system
              + spec:
              +   interval: 1m0s
              +   ref:
              +     branch: main
              +   secretRef:
              +     name: flux-system
              +   url: https://github.com/NamelessPlanet/CloudNativeNow-Gitops.git
              + ---
              + apiVersion: kustomize.toolkit.fluxcd.io/v1
              + kind: Kustomization
              + metadata:
              +   name: flux-system
              +   namespace: flux-system
              + spec:
              +   interval: 10m0s
              +   path: ./flux
              +   prune: true
              +   sourceRef:
              +     kind: GitRepository
              +     name: flux-system
            EOT
            # (2 unchanged elements hidden)
        }
      ~ version              = "v2.5.1" -> "v2.9.3"
        # (13 unchanged attributes hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

Changes to Outputs:
  ~ kubernetes_kubeconfig   = (sensitive value)

Warning: Flux resources GitRepository and Kustomization in flux-system namespace are not ready and Flux will be redeployed

  with flux_bootstrap_git.cloudnativenow,
  on main.tf line 168, in resource "flux_bootstrap_git" "cloudnativenow":
 168: resource "flux_bootstrap_git" "cloudnativenow" {

Kustomization/flux-system:
CustomResourceDefinition/ocirepositories.source.toolkit.fluxcd.io dry-run
failed (Invalid): CustomResourceDefinition.apiextensions.k8s.io
"ocirepositories.source.toolkit.fluxcd.io" is invalid:
status.storedVersions[0]: Invalid value: "v1beta2": missing from
spec.versions; v1beta2 was previously a storage version, and must remain in
spec.versions until a storage migration ensures no data remains persisted in
v1beta2 and removes v1beta2 from status.storedVersions


─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.