• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Updates the action versions in the workflow files for Github. This is done by AI and the changelog is also generated by it. Additionally it has performed a security check about the changes and found nothing suspicious.

Changelog

Updates the GitHub Actions used in our workflows to their latest releases. All actions stay pinned to full commit hashes.

Major updates

• actions/cache v6: migrates to ESM and updates its packages. v6.1.0 also handles read-only cache access.
• actions/checkout v7: blocks checking out fork PRs on pull_request_target and workflow_run by default (details). This does not affect us: merge-conflicts.yml is our only pull_request_target workflow and has no checkout step, and we have no workflow_run workflows.
• actions/setup-node v7: migrates to ESM and no longer exports a dummy NODE_AUTH_TOKEN. Our workflows do not use that variable. v7.1.0 also adds Node version validation and retries for manifest fetches.

Other notable changes

• actions/upload-artifact: better retries on HTTP 429 responses, honoring valid Retry-After headers.
• crate-ci/typos: monthly dictionary updates from May to October 2026, plus several false-positive and crash fixes.
• eps1lon/actions-label-merge-conflict: moves to Node.js 24.
• shivammathur/setup-php: adds PHP 8.7 nightly and Ubuntu 26.04 support, and improves Windows installs with cached builds.
• shogo82148/actions-setup-mysql: adds Ubuntu 26.04 builds and new MySQL and MariaDB versions, and escapes the user and password in CREATE USER and GRANT statements.

Security Review

I compared the old and new pinned commit of each updated action and found nothing malicious. This was a targeted review, not a full audit: the actions were not run, and their bundles were not rebuilt from source. actions/github-script is unchanged, so it was not reviewed.

Checked

• Commit history: each new pin descends directly from the old one, and its version tag points at that commit. There is no sign of a moved tag.
• Authors: commits come mainly from the projects' regular maintainers and dependency bots. Outside contributions to crate-ci/typos were reviewed by title or diff stat and appear to be small fixes.
• Install scripts and files: no new install hooks in package.json, and no new binaries or unexpected scripts.
• Network destinations: new domains in runtime code are mostly documentation links or placeholder URLs from bundled libraries. The exceptions are gh.io (a link in a checkout warning message) and src.fedoraproject.org (below).
• Known incidents: web searches found no reported compromise of these actions, though search coverage was limited.

Flagged and reviewed as benign

• shivammathur/setup-php process inspection: new code reads /proc/$pid/exe and looks for Runner.Worker. It only checks for a Blacksmith or Depot runner for an opt-in cache, and it reads that runner's .runner config, not process memory.
• shivammathur/setup-php token handling: GITHUB_TOKEN is read to set up Composer authentication, and that code runs with trace logging turned off.
• shivammathur/setup-php patches: new downloads from src.fedoraproject.org are pinned to a specific commit and are used to build the GEOS extension.
• Base64 blobs in dist/: these decode to valid WebAssembly, with the same two hashes in all five bundles that contain them. They look like the undici HTTP parser, but were not compared to upstream.
• shogo82148/actions-setup-mysql: the SQL changes match the announced escaping fix. The Windows mariadb-10.4.34 download and checksum used by our integration tests are unchanged.
• eps1lon/actions-label-merge-conflict: dist/ is unchanged, and the only runtime change is the move from Node 20 to Node 24.

Security-relevant behaviour change

actions/checkout v7 blocks checking out fork PRs on pull_request_target and workflow_run by default. This does not affect our workflows: merge-conflicts.yml is the only pull_request_target workflow and has no checkout step.

Not covered

• Bundled code: dist/ files were scanned for domains and risky patterns, not read line by line, so well-obfuscated code could be missed.
• Signatures: commit signatures could not be verified locally, and the crate-ci/typos release commit is unsigned.
• Runtime downloads: commit pins do not cover files fetched during a run. crate-ci/typos downloads a prebuilt binary, shogo82148/actions-setup-mysql downloads MariaDB (its version list includes a SHA-256 for each build), and shivammathur/setup-php downloads PHP and its tools.
• Recent releases: crate-ci/typos v1.52.0 (2026-11-02) and shogo82148/actions-setup-mysql v1.56.2 (2026-11-01) are only days old, so a compromise may not have been noticed yet.