Skip to content

chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 - #234

Merged
SSHdotCodes merged 2 commits into
mainfrom
dependabot/github_actions/actions/setup-node-7.1.0
Oct 13, 2026
Merged

chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0#234
SSHdotCodes merged 2 commits into
mainfrom
dependabot/github_actions/actions/setup-node-7.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 10, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-node from 7.0.0 to 7.1.0.

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0
f5894ea 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 10, 2026
@devin-ai-integration

devin-ai-integration Bot commented Oct 10, 2026

Copy link
Copy Markdown
Contributor

E2E review: no defects found

Tested SHA: f5894eaf0af2fa4a741956ace2cef998b54cfc7e (base main @ ec55a32). Scope: the PR changes one line, the actions/setup-node pin in .github/workflows/publish-npm.yml (v7.0.0 8207627 → v7.1.0 949feb2). It changes no runtime, CLI, SDK, MCP or browser code; src/, scripts/ and tests/ are byte-identical to base.

What actually ran (Linux x64, disposable, no credentials)

  • I checked the pins against upstream with git ls-remote https://github.com/actions/setup-node: refs/tags/v7.1.0 = 949feb2… (also current v7) and refs/tags/v7.0.0 = 8207627…. Both use node24. The only action.yml change is the node-version-file description, which now mentions mise.toml.
  • I ran the real action dist/setup/index.js (main) and dist/cache-save/index.js (post) on Node v24.21.0. The runner was simulated: RUNNER_TEMP/RUNNER_TOOL_CACHE, GITHUB_ENV/PATH/OUTPUT/STATE. Inputs matched the workflow (node-version: 22.18.0, registry-url: https://registry.npmjs.org). I ran v7.1.0 and the base v7.0.0.
  • After that I ran the workflow's next steps using the PATH and env that setup-node exported: npm install --global npm@11.5.1, bun install --frozen-lockfile --ignore-scripts, the read-only npm view existing-version check and bun run build. Finally I ran npm publish --dry-run, which used no token and uploaded nothing.
Journey Result
setup-node v7.1.0 installs Node 22.18.0 / npm 10.9.3 and puts it on PATH passed
.npmrc (//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}, registry=…) and NPM_CONFIG_USERCONFIG export passed, identical to v7.0.0
node-version output, post step (no cache configured → no-op) passed, identical to v7.0.0
npm 11.5.1 upgrade, bun install, build, npm publish --dry-run (betterwright@2.8.8, 186 files) passed under both versions
Base vs PR diff of PATH / env / outputs / .npmrc / npm config identical
Local lint / typecheck / check:versions passed
Local test:unit 1322 pass / 24 skip / 2 fail. Both failures are in chromium-package.test.ts and come from my environment, not the PR (see below)
PR CI (Node tests, Worker copies in sync, 6× cross-platform unit tests, dependency audit) 9/9 passed
Real trusted publish (OIDC → npm) blocked: production publish, deliberately not run

Recording (MP4, 36 s, tested SHA f5894ea). It runs v7.0.0 then v7.1.0 and ends with "IDENTICAL runner outputs/env/.npmrc": e2e-pr234-f5894ea-setup-node-v7.1.0.mp4. GitHub cannot host the MP4 directly from this tool, so this link opens as a Devin attachment and may need Devin sign-in. The same recording as a preview:

E2E recording preview

Findings

  • No confirmed bugs, so there is no fix PR.
  • Environment issues, not caused by this PR:
    • The two local unit-test failures happen because scripts/chromium/package-runtime.py uses hashlib.file_digest, which needs Python ≥3.11, and this VM has Python 3.10.12. The same tests pass in CI.
    • setup-node's manifest fetch from actions/node-versions hit GitHub's unauthenticated API rate limit, because no token was supplied locally. v7.1.0's new retry (3 attempts) and its fallback to nodejs.org/dist both worked as expected. On Actions, github.token avoids the rate limit.
  • Not tested:
    • the real GitHub-hosted runner run of publish-npm.yml, which only triggers on release or dispatch
    • the OIDC Trusted Publishing upload
    • the browser integration suite inside the publish job, because setup-node does not affect it

Ready for a human decision on merging; this review does not merge.

Written by Devin

@devin-ai-integration

devin-ai-integration Bot commented Oct 10, 2026

Copy link
Copy Markdown
Contributor

I found no defects in PR #234 at f5894ea, so there is no fix PR. The setup-node v7.1.0 step produced the same results as v7.0.0 when I ran them side by side. The report is posted on the PR as comment 6092221308.

How it was tested: I downloaded the setup-node action at both pinned commits and checked them against the upstream v7.0.0 and v7.1.0 tags. I ran each version's main and post steps on a simulated GitHub runner, with the same inputs publish-npm.yml uses. I then ran the workflow steps that follow it, up to npm publish --dry-run (no token, nothing uploaded). Both versions gave the same PATH, env, outputs and .npmrc. All 9 CI checks on the PR passed, and local lint, typecheck and version checks passed.

Issues caused by my environment, not the PR:

  • 2 local unit-test failures in chromium-package.test.ts: a packaging script needs Python 3.11 and this VM has 3.10. The same tests pass in CI.
  • setup-node rate limit: the action hit GitHub's API rate limit because no token was supplied locally. It retried and fell back to downloading Node from nodejs.org, which worked.

Not tested:

  • A real publish-npm.yml run on a GitHub-hosted runner (it only runs on release or manual dispatch).
  • The actual npm publish through Trusted Publishing.
  • The publish job's browser integration suite, which this change doesn't affect.

Video:

  • The 36-second MP4 is attached here. On the PR it's a Devin attachment link, which may need Devin sign-in, because I couldn't attach the MP4 to GitHub directly.
  • The comment also embeds an animated WebP version.
  • I confirmed the comment was posted but couldn't open either link to check it renders. The VM can't reach app.devin.ai, and GitHub's API was rate-limited.

Merging is your call; I haven't approved or merged anything.

This response includes attachments — view them in Devin

@SSHdotCodes
SSHdotCodes merged commit 5a4590a into main Oct 13, 2026
9 checks passed
@devin-ai-integration

devin-ai-integration Bot commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

E2E re-review at new head: no defects found

Tested SHA: 99cd4e5f44df2162ac2ff1f80291c16aec66328b. Base is main @ 8619e15. The previous E2E run covered f5894ea (comment). Since then the only new commit is a clean merge of main, which brought in #233 (the upload-artifact pin in ci.yml). The PR's diff against main is unchanged: one line in .github/workflows/publish-npm.yml that moves actions/setup-node from 8207627 (v7.0.0) to 949feb2 (v7.1.0). No runtime, CLI, SDK, MCP or browser code changed, so those layers don't apply.

What actually ran (disposable Linux VM, Bun 1.4.0, no npm or GitHub credentials):

  • Pin integrity: I downloaded the codeload tarballs for both pinned SHAs and for the upstream v7.0.0 and v7.1.0 tags, then diffed them recursively. Each SHA is identical to its tag. Both actions use node24, with the same main and post entrypoints.
  • Simulated runner: I ran each version's dist/setup/index.js under Node 24.11.0, with the inputs publish-npm.yml passes (node-version: 22.18.0, registry-url: https://registry.npmjs.org). Then, using the PATH and env each version exported, I ran the steps that follow it in the workflow:
    • npm install --global npm@11.5.1
    • bun install --frozen-lockfile --ignore-scripts
    • the npm view existing-version check
    • bun run build
    • npm publish --dry-run --ignore-scripts --access public
  • Results were identical for v7.0.0 and v7.1.0 once version labels, SHAs and temp UUIDs were normalized:
    • Node v22.18.0 from the tool cache, with npm upgraded to 11.5.1.
    • The same GITHUB_PATH, the same NPM_CONFIG_USERCONFIG env var, and the same node-version output.
    • The same .npmrc: _authToken=${NODE_AUTH_TOKEN} and registry=https://registry.npmjs.org/.
    • The same dry-run tarball: 186 files, 774.8 kB, "Publishing to https://registry.npmjs.org/ … (dry-run)".
  • How the dry-run was done: betterwright@2.8.8 is already on npm (published=true), so the real workflow would skip the publish step. For the dry-run only, I set a throwaway local version (2.8.8-e2e.0, beta tag) and restored package.json afterwards. The fake NODE_AUTH_TOKEN was a placeholder, and nothing was uploaded.
  • Local checks at the head SHA: bun run lint, typecheck, check:versions (betterwright 2.8.8, bun 1.4.0, BetterChromium 153.0.8010.36, playwright-core 1.61.1) and build all passed.
  • bun run test:unit: 1322 passed, 24 skipped, and 2 failed (chromium-package.test.ts). Both failures come from the VM, not the PR:
    • They fail the same way on base 8619e15.
    • The cause is that the VM's Python 3.10 has no hashlib.file_digest. With Python 3.11 on PATH, that file passes 3/3.
    • In one run, optional-peer.test.ts also failed, but only because the worktree directory name was 2 characters long, which breaks the test's prefix-slicing premise. Under a longer worktree name it passes 6/6.
  • GitHub CI on 99cd4e5: 9/9 required checks passed.

Journey matrix

Journey Result
setup-node pin matches upstream v7.1.0 tag passed
publish job: setup-node → npm 11.5.1 → install → existence check → build → npm publish --dry-run passed (output identical to v7.0.0)
lint / typecheck / version pins / build passed
unit suite passed (2 failures from the VM's Python 3.10, also on base)
Real npm publish with OIDC Trusted Publishing / provenance blocked: not run, by design (would mutate the registry, and OIDC can't be run outside GitHub Actions)
Real ubuntu-latest runner and its Actions cache service not tested: simulated locally, and cache was skipped ("unable to contact cache service"), as in the workflow, which does not enable caching
bun run test browser integration suite not applicable: no change in browser or runtime code
CLI / SDK / MCP / browser UI not applicable

Confirmed defects: none, so there is no fix PR.

Recording (21 s, real terminal capture of both versions' runs at 99cd4e5, ending in the normalized diff "IDENTICAL"):

PR 234 E2E recording at 99cd4e5

Merging is left to a maintainer.

Written by Devin

@dependabot
dependabot Bot deleted the dependabot/github_actions/actions/setup-node-7.1.0 branch October 13, 2026 02:00
@devin-ai-integration

devin-ai-integration Bot commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

PR #234 at the new head 99cd4e5 has no defects, so there is no fix PR. The E2E report is posted as comment 6136463873.

What changed since the last review: the only new commit merges main into the branch (it brings in the upload-artifact bump from #233). The PR itself is still one line: the actions/setup-node pin in publish-npm.yml, v7.0.0 → v7.1.0. The previous run covered f5894ea.

How it was tested:

  • Pins: the two pinned commits have exactly the same contents as the upstream v7.0.0 and v7.1.0 releases.
  • Workflow run: I ran both setup-node versions on a simulated runner with the workflow's inputs, then ran the steps after it, up to npm publish --dry-run (no token, nothing uploaded). Output from v7.0.0 and v7.1.0 was identical.
  • Local checks: lint, typecheck, version checks and build all pass.
  • CI: all 9 required checks on the PR pass.
  • Unit tests: 2 local failures come from this machine having Python 3.10 instead of 3.11. They also fail on main, and pass once 3.11 is used.

Not tested:

  • A real publish to npm. It can only run inside GitHub Actions, and it would put a real release on npm.
  • A real GitHub-hosted runner and its cache.
  • CLI, SDK, MCP and browser layers — the PR doesn't touch them.

Video: the 21-second MP4 is attached here. On the PR it's a Devin attachment link (may need Devin sign-in) plus an animated WebP preview, because I couldn't attach the MP4 to GitHub directly. The PR page loads, but I couldn't check that either video link works, because this machine can't reach app.devin.ai.

Merging is up to a maintainer.

This response includes attachments — view them in Devin

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SSHdotCodes