Bump the GitHub Actions group to current major versions by Evangelink · Pull Request #20382 · microsoft/aspire

Amaury Levé (Evangelink) · 2026-09-23T14:31:48Z

Description

Updates the root .github/workflows/*.yml GitHub Actions group from the CAO task to the requested target versions and immutable SHAs:

actions/create-github-app-token 3.1.1 -> 3.2.0
github/gh-aw-actions/setup and setup-cli 0.88.8 -> 0.89.15
actions/checkout 6.x -> 7.0.1
actions/upload-artifact 7.0.0 -> 7.0.1
actions/setup-node 6.3.0 -> 7.0.0
actions/setup-dotnet 5.2.0 -> 6.0.0
actions/setup-java 5.7.0 -> 6.0.1
actions/cache 5.1.0 -> 6.1.0
azure/login 3.0.0 -> 3.1.0

The update is rebased onto the current main tip, including workflow files added after the original Dependabot branch and the generated lock-file action inventories. No workflow logic, inputs, or outputs were changed. The actions/checkout v7 migration was checked against the workflow_run and pull_request_target workflows; no affected workflow checks out untrusted fork code in a privileged context. The setup-node, setup-dotnet, setup-java, and cache usages retain compatible inputs and behavior.

Validation performed locally:

Verified every active target action reference in .github/workflows/*.yml uses the requested immutable SHA.
Verified the diff is limited to root workflow files and passes git diff --check.
Full GitHub Actions validation will run for this PR before merge.

Replaces the stale Dependabot branch in #20233.

Resolves microsoft/central-agentic-ops#373

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No

Bumps the github-actions group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.1.1` | `3.2.0` | | [github/gh-aw-actions/setup](https://github.com/github/gh-aw-actions) | `0.88.8` | `0.89.15` | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.1` | | [github/gh-aw-actions/setup-cli](https://github.com/github/gh-aw-actions) | `0.88.8` | `0.89.15` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `7.0.0` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5.2.0` | `6.0.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.7.0` | `6.0.1` | | [actions/cache](https://github.com/actions/cache) | `5.1.0` | `6.1.0` | | [azure/login](https://github.com/azure/login) | `3.0.0` | `3.1.0` | Updates `actions/create-github-app-token` from 3.1.1 to 3.2.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@v3.1.1...bcd2ba4) Updates `github/gh-aw-actions/setup` from 0.88.8 to 0.89.15 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](github/gh-aw-actions@5e50858...045beb2) Updates `actions/checkout` from 6.0.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6.0.2...3d3c42e) Updates `github/gh-aw-actions/setup-cli` from 0.88.8 to 0.89.15 - [Release notes](https://github.com/github/gh-aw-actions/releases) - [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md) - [Commits](github/gh-aw-actions@5e50858...045beb2) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v7...043fb46) Updates `actions/setup-node` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6.3.0...8207627) Updates `actions/setup-dotnet` from 5.2.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@c2fa09f...a98b568) Updates `actions/setup-java` from 5.7.0 to 6.0.1 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@b6effb0...de7274f) Updates `actions/cache` from 5.1.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@caa2961...55cc834) Updates `azure/login` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@532459e...a641126) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/create-github-app-token dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-dotnet dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: azure/login dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/gh-aw-actions/setup dependency-version: 0.89.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/gh-aw-actions/setup-cli dependency-version: 0.89.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-09-23T14:32:02Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20382

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20382"

github-actions · 2026-09-23T15:16:33Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Amaury Levé (Evangelink) · 2026-09-23T15:16:54Z

Validation evidence for microsoft/central-agentic-ops#373:

Local pin audit passed for all active target action references in .github/workflows/*.yml; git diff --check passed and the diff is workflow-only.
Official PR checks completed with 424 successes and 11 skips. The full CI run is https://github.com/microsoft/aspire/actions/runs/35874852730.
The full CI run completed with failures in Infrastructure (ubuntu-latest) and the aggregate final-results checks. The Infrastructure log reports Infrastructure.Tests.CiWorkflowTests.RunTestsInstallsJavaForProjectsThatRequireIt plus SelectTests fixture/self-test failures; no workflow action step failed.
The triggered Outerloop Tests run https://github.com/microsoft/aspire/actions/runs/35874852758 failed in Acquisition on macOS, Windows, and Ubuntu because the test runner returned exit code 8 with no failed tests reported (timeout/hang-dump path).

The replacement PR remains open for review. This session cannot close or update #20233 because the authenticated identity has read-only permission on microsoft/aspire; both pull-request close/update attempts were denied. A maintainer with write permission should close the superseded Dependabot PR.

github-actions · 2026-09-23T15:24:37Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

github-actions · 2026-09-23T15:31:13Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Ankit Jain (radical) · 2026-09-24T22:00:30Z

[automated] Extended CI confidence requires action

Reviewer actions

Required before merge: Fix the final-head CI contract failures and rerun CI plus Outerloop Tests.
Done when: both pin-sensitive Infrastructure.Tests assertions pass, the Acquisition outerloop smoke runs a nonzero test count on macOS/Ubuntu/Windows, and the linked final-head runs are green.
Required before merge: Regenerate the generated gh-aw workflows with gh aw compile --dependabot.
Done when: compilation/validation succeeds for all eight changed .lock.yml files and a second regeneration leaves git diff empty.
Required before merge: Exercise the unique privileged action contexts on the final PR head, or record explicit maintainer risk acceptance where no safe run exists.
Done when: linked logs show the exact new SHAs starting successfully for azure/login OIDC, actions/create-github-app-token token/checkout usage, github/gh-aw-actions/setup, and checkout v7 under workflow_run; unsafe mutation/release paths instead have a named approver and rationale, with Actions-policy confirmation for action paths that could not be safely started.

Ready-to-use pr-testing prompt

Use the pr-testing skill to test PR #20382. Focus on final-head GitHub Actions evidence only: rerun CI after updating the two pin-sensitive Infrastructure.Tests expectations; confirm the path-triggered Outerloop Tests Acquisition smoke runs nonzero tests and passes on macOS, Ubuntu, and Windows; run the canonical gh aw compile --dependabot regeneration and verify a second compile produces no diff; and use the smallest safe dry-run/trial workflows to exercise the exact new SHAs for azure/login with OIDC, actions/create-github-app-token including token-backed checkout/cross-repo shapes, github/gh-aw-actions/setup, and checkout v7 in workflow_run context. Verify exact Download action repository log lines and relevant outputs. Do not publish, create/update issues or branches, deploy Azure resources, or execute release side effects; record explicit maintainer risk acceptance for any context that cannot be exercised safely.

Change classification

GitHub Actions workload change: 54 root workflow files update 190 executable uses: references across 10 action paths; no trigger, condition, input, output, matrix, artifact name, or workflow logic changed.
Generated workflow dependency change: eight gh-aw .lock.yml files plus the agentics maintenance workflow update github/gh-aw-actions and supporting action pins.
Specialized contexts: the diff reaches outerloop plumbing, package/artifact production, privileged App-token workflows, scheduled Azure OIDC automation, and release-only GitHub workflows; it does not change the internal Azure DevOps definition or deployment scenario behavior.

Confidence at a glance

🔴 Final-head PR checks — Applicable CI and outerloop validation failed

Why it applies: ci.yml, run-tests.yml, specialized-test-runner.yml, tests-outerloop.yml, and the action pins used by their jobs changed.
Evidence: Head 52dc1b6f8c604f53798c260aa6ca748e0be23c2f has 424 passing, 11 skipped, and 7 failing checks. CI run 35874852730 reached attempt 4; Infrastructure.Tests passed 1,306/1,308 tests but failed CiWorkflowTests.RunTestsInstallsJavaForProjectsThatRequireIt and ExtensionReleaseWorkflowTests.ExtensionReleaseWorkflowChecksOutHelpersFromWorkflowDefinitionCommit because both still expect the old setup-java/checkout SHAs. The remaining two CI failures are aggregate result checks.
Gap or disposition: Outerloop run 35874852758 loaded the exact new checkout/setup-dotnet/setup-java/upload-artifact SHAs, but Acquisition reported Zero tests ran and exit code 8 on macOS, Ubuntu, and Windows; its final-results aggregator also failed. No hang dumps were found. These three jobs plus the outerloop aggregator account for the other four failed checks.
Action: Update the pin-sensitive test expectations, determine why the outerloop smoke selected zero tests, and rerun both workflows at the final head until the substantive and aggregate checks are green.

🔴 Generated gh-aw workflows — Canonical regeneration evidence is missing

Why it applies: This is a dependency-only update to eight generated gh-aw lock workflows (analyze-ci-failure, daily-repo-status, extension-changelog, milestone-changelog, pr-docs-check, release-notes-generate, release-update-support-mdx, and repo-pulse).
Evidence: The PR records a local pin audit and git diff --check, but no gh aw compile --dependabot result or post-regeneration empty diff. The corresponding .md sources are present.
Gap or disposition: Manual pin replacement and source-reading checks do not prove generated locks match the compiler's canonical dependency resolution.
Action: Run gh aw compile --dependabot, review any additional generated changes, then run it again and record that the diff is empty.

🔴 Privileged and event-specific action shapes — Exact final-head runtime coverage is missing

Why it applies: Unique shapes include checkout v7 under workflow_run; App-token minting for the current repository and microsoft/aspire.dev, including token-backed checkout/push; scheduled Azure OIDC login; and github/gh-aw-actions/setup in generated agent workflows. Release workflows also combine App tokens with full-history/token-backed checkout and mutation steps.
Evidence: No final-head run started azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906, actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, or github/gh-aw-actions/setup@045beb2d14bda8d0c1f2e83b41527f63770d2855. The automatic workflow_run consumers execute their default-branch definitions, so the rerun comments on this PR do not exercise the PR's checkout v7 pin. Repository Actions-policy endpoints returned 403, so unstarted action paths could not be independently confirmed against the allow-list.
Gap or disposition: Static review confirms the changed workflow_run checkouts do not request fork PR code, and checkout v7's new fail-closed behavior is compatible with the declared refs. It does not prove the event-specific runtime paths, privileged token contracts, OIDC login, or unstarted action paths are accepted and functional.
Action: Use safe dry-run/trial workflows to execute representative shapes and inspect exact action download/start lines. Do not run live release, branch mutation, issue mutation, or Azure resource changes; obtain explicit policy confirmation and maintainer risk acceptance for contexts that cannot be exercised safely.

🟢 Common GitHub-hosted action shapes — Exact new SHAs executed successfully

Why it applies: Most references use ordinary GitHub-hosted checkout, tool setup, caching, and artifact upload shapes.
Evidence: Final-head runs loaded the exact new SHAs. The successful Quarantined Tests smoke exercised checkout/setup-dotnet/setup-java/upload-artifact on macOS, Ubuntu, and Windows. A successful Linux Java extension E2E job exercised checkout, setup-node, setup-dotnet, setup-java, cache v6.1.0, and upload-artifact; the cache restored successfully. TypeScript/Markdown jobs exercised setup-node v7. Native CLI archive jobs exercised checkout/setup-node/upload-artifact on Windows x64/ARM64 and uploaded the expected artifacts. The package-build job uploaded built-nugets and logs with upload-artifact v7.0.1. Copilot Setup Steps loaded the exact github/gh-aw-actions SHA through setup-cli and completed installation/build setup.
Gap or disposition: These runs also prove GitHub currently permits the exact common action SHAs and that the hosted runners satisfy their Node 24/ESM runtime requirements. They do not cover the distinct privileged shapes listed above.

🟢 Pin integrity and major-version compatibility — Tags and reviewed inputs match

Why it applies: The update crosses major versions for checkout, setup-node, setup-dotnet, setup-java, and cache.
Evidence: Upstream tags resolve exactly to every pinned SHA and displayed version: checkout v7.0.1, setup-node v7.0.0, setup-dotnet v6.0.0, setup-java v6.0.1, cache v6.1.0, upload-artifact v7.0.1, create-github-app-token v3.2.0, Azure/login v3.1.0, and gh-aw-actions v0.89.15. Primary-source notes identify checkout v7's safer pull_request_target/workflow_run default, ESM migrations, setup-java's renamed-but-compatible jdk-file alias, and hosted-runner requirements. No removed always-auth, legacy Java distribution, jdkFile, or self-hosted-runner usage was found in the affected workflows.
Gap or disposition: No pin/comment mismatch or incompatible changed input was found. Runtime gaps are isolated to the unique contexts above rather than the common action contracts.

⚪ Internal Azure DevOps definition 1602 — Not applicable

Why it applies: The PR touches GitHub package/release workflows, so the official-build boundary was checked explicitly.
Evidence: All changed paths are under .github/workflows/; no eng/pipelines/**, eng/common/**, Arcade/MSBuild plumbing, signing configuration, official-build artifact layout, or input consumed by definition 1602 changed.
Gap or disposition: A definition-1602 run would not execute or validate these GitHub Actions pins. The release-only GitHub contexts remain covered by the privileged-shape action above, not by AzDO.

⚪ Deployment end-to-end execution — Not applicable

Why it applies: deployment-tests.yml received only common checkout/setup-dotnet/upload-artifact pin replacements; no deployment scenario, Azure orchestration input, authorization contract, selector, generated AppHost, or result artifact behavior changed.
Evidence: Equivalent common action shapes ran successfully elsewhere on the final head. The only changed azure/login reference is the separate scheduled update-azure-vm-sizes.yml automation and is accounted for as a unique OIDC shape above.
Gap or disposition: A real Azure deployment would add cost and side effects without validating a distinct deployment-specific change in this diff.

Ankit Jain (radical) · 2026-09-24T22:23:07Z

Outerloop test failures are unrelated.

Ankit Jain (radical) · 2026-09-24T22:23:49Z

And the failing infrastructure tests are asserting the hash - that is excessive, so we can remove that.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Amaury Levé (Evangelink) · 2026-09-25T07:31:44Z

Addressed in d1e8527. The Infrastructure tests now verify the action identity and workflow behavior without pinning an exact action SHA; both previously failing tests pass.

github-actions · 2026-09-25T08:27:13Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Ankit Jain (radical) · 2026-09-25T19:07:57Z

[automated] Correction: github/gh-aw-actions is covered by GitHub's Allow actions created by GitHub policy, which applies to both actions/* and github/*, so it does not require an explicit allow-list entry.

The existing azure/login action is already permitted by the effective organization/enterprise policy and executed successfully in the scheduled Update Azure VM Sizes workflow. It does not appear in the repository-level specified-actions list, so its authorization is inherited from a higher-level policy rather than managed here. No repository-level allow-list change is requested for this PR.

Ankit Jain (radical)

[automated] Reviewed the GitHub Actions version and immutable-SHA updates. The changed GitHub-owned actions are covered by policy, and the existing Azure action is permitted through the effective organization/enterprise policy.

Ankit Jain (radical) · 2026-09-25T19:23:55Z

Thank you for your contribution, Amaury Levé (@Evangelink) !

dependabot Bot and others added 3 commits September 22, 2026 19:40

Merge branch 'pr-20233' into evangelink-dependabot-update-planner

37dc6f2

Align workflow pins after rebasing Dependabot update

52dc1b6

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions Bot added the area-engineering-systems infrastructure helix infra engineering repo stuff label Sep 23, 2026

github-actions Bot mentioned this pull request Sep 24, 2026

[repo-pulse] Daily Report #16404

Open

Relax workflow action version assertions

d1e8527

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Ankit Jain (radical) approved these changes Sep 25, 2026

View reviewed changes

Ankit Jain (radical) merged commit d32787c into microsoft:main Sep 25, 2026
846 of 856 checks passed

microsoft-github-policy-service Bot added this to the 14.0 milestone Sep 25, 2026

github-actions Bot locked and limited conversation to collaborators Oct 26, 2026

Conversation

Amaury Levé (Evangelink) commented Sep 23, 2026

Description

Checklist

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

Amaury Levé (Evangelink) commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

Ankit Jain (radical) commented Sep 24, 2026

Reviewer actions

Change classification

Confidence at a glance

Uh oh!

Ankit Jain (radical) commented Sep 24, 2026

Uh oh!

Ankit Jain (radical) commented Sep 24, 2026

Uh oh!

Amaury Levé (Evangelink) commented Sep 25, 2026

Uh oh!

github-actions Bot commented Sep 25, 2026

Uh oh!

Ankit Jain (radical) commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ankit Jain (radical) left a comment

Choose a reason for hiding this comment

Uh oh!

Ankit Jain (radical) commented Sep 25, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Ankit Jain (radical) commented Sep 25, 2026 •

edited

Loading