Skip to content

Update actions (major) - #24956

Open
renovate[bot] wants to merge 2 commits into
masterfrom
renovate/major-actions
Open

Update actions (major)#24956
renovate[bot] wants to merge 2 commits into
masterfrom
renovate/major-actions

Conversation

@renovate

@renovate renovate Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/checkout action major v6.0.2 → v7.0.1
actions/checkout action major v4.4.0 → v7.0.1
actions/setup-python action major v6.2.0 → v7.0.0
actions/setup-python action major v5.6.0 → v7.0.0
astral-sh/setup-uv action major v9.0.0 → v10.0.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

v6.1.0

Compare Source

v6.0.3

Compare Source

actions/setup-python (actions/setup-python)

v7.0.0

Compare Source

v6.3.0

Compare Source

What's Changed
Enhancement
Dependency update
Documentation
New Contributors

Full Changelog: actions/setup-python@v6...v6.3.0

astral-sh/setup-uv (astral-sh/setup-uv)

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in #​984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 6am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner August 24, 2026 00:44
@renovate renovate Bot added qa/skip-qa Automatically skip this PR for the next QA renovate/actions Renovate update of GitHub actions labels Aug 24, 2026
@github-actions

github-actions Bot commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Warning

This PR changes Agent dependencies. Do not merge it until the wheels are promoted.

Dependency inputs changed, so the dependency resolution and wheel build workflow runs on this branch. It takes 1.5 to 3 hours and finishes by committing updated lockfiles. The wheels it builds then have to be promoted before the Agent can use them.

Steps to take, in order:

  1. Wait for the resolution workflow to finish and commit the lockfiles to this branch.
  2. Review the Agent build triggered by that commit (default-pipeline in GitLab), especially static_quality_gate.
  3. Get the PR approved.
  4. Promote the wheels: 
    ddev dep promote https://github.com/DataDog/integrations-core/pull/24956
  5. Wait for dependency-wheel-promotion to turn green. Only then merge.

Merging before promotion leaves the Agent unable to install the wheels these lockfiles pin. dependency-wheel-promotion is a required check: if it is pending or red, that is intentional. Do not bypass it and do not ask for an admin merge.

Pushing again to this branch invalidates the promotion, so if you push after step 4 you have to promote again.

Head commit f205a1fdbc1ee646539cf75f7f651c2b18764842. Full process: Dependency Updates. This comment is updated automatically as promotion progresses.

@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented Aug 24, 2026 •
edited by datadog-prod-us1-6 Bot
Loading

Copy link
Copy Markdown
Contributor

Tests  Code Coverage

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 88.76% (+0.11%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f205a1f | Docs | View more details | Give us feedback!

@cit-pr-commenter-54b7da

cit-pr-commenter-54b7da Bot commented Aug 24, 2026

Copy link
Copy Markdown

evalya-impact-summary

evalya impact analysis 
Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   1 (always emitted)
Diff (6 files):
  .github/actions/setup-ddev/action.yml
  .github/workflows/build-ddev.yml
  .github/workflows/cache-shared-deps.yml
  .github/workflows/notify-new-integration.yml
  .github/workflows/resolve-build-deps.yaml
  .github/workflows/zz-test-worker-poc.yaml

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering

@dd-octo-sts
dd-octo-sts Bot requested a review from a team as a code owner August 24, 2026 01:59
@dd-octo-sts

dd-octo-sts Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Validation Report

All 21 validations passed.

Show details
Validation Description Status
agent-reqs Verify check versions match the Agent requirements file ✅
ci Validate CI configuration and code coverage settings ✅
codeowners Validate every integration has a CODEOWNERS entry ✅
config Validate default configuration files against spec.yaml ✅
dep Verify dependency pins are consistent and Agent-compatible ✅
http Validate integrations use the HTTP wrapper correctly ✅
imports Validate check imports do not use deprecated modules ✅
integration-style Validate check code style conventions ✅
jmx-metrics Validate JMX metrics definition files and config ✅
labeler Validate PR labeler config matches integration directories ✅
legacy-signature Validate no integration uses the legacy Agent check signature ✅
license-headers Validate Python files have proper license headers ✅
licenses Validate third-party license attribution list ✅
metadata Validate metadata.csv metric definitions ✅
models Validate configuration data models match spec.yaml ✅
openmetrics Validate OpenMetrics integrations disable the metric limit ✅
package Validate Python package metadata and naming ✅
qa-label Validate the pull request declares whether it needs QA for the next Agent release ✅
readmes Validate README files have required sections ✅
saved-views Validate saved view JSON file structure and fields ✅
version Validate version consistency between package and changelog ✅

View full run

@renovate

renovate Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

aiuto
aiuto reviewed Aug 24, 2026
View reviewed changes

@aiuto aiuto left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Something feels wrong about updating the actions and what looks like unrelated dependencies in the same PR.
ISTM that this should be two distinct things.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aiuto aiuto aiuto left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dev/testing dev/tooling ecosystems/review-requested product/review-requested qa/skip-qa Automatically skip this PR for the next QA renovate/actions Renovate update of GitHub actions team/agent-build team/agent-integrations

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@aiuto