ci(deps): bump goreleaser/goreleaser-action from 6 to 7#2
ci(deps): bump goreleaser/goreleaser-action from 6 to 7#2dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 6 to 7. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@v6...v7) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![review-cat[bot]](https://avatars.githubusercontent.com/in/3695278?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review — goreleaser/goreleaser-action v6 → v7
Clean, routine bump. The only change is the action tag; all inputs (distribution, version: "~> v2", args: release --clean) and the GITHUB_TOKEN env var remain unchanged and are fully compatible with v7.
v7 breaking change is internal-only. The feat! in v7.0.0 (node 24, ESM, rm yarn) is a runtime change to the action's own internals — it does not affect the action's public input/output API. Callers like this workflow are unaffected.
Minor (non-blocking): All three actions in this workflow (checkout@v4, setup-go@v5, goreleaser-action@v7) use mutable major-version tags rather than pinned SHAs. Pinning to a full commit SHA (e.g. goreleaser/goreleaser-action@1a80836) is the hardened approach and recommended by GitHub. Not a blocker here — this is a pre-existing pattern across the workflow, not introduced by this PR.
✅ Safe to merge.
Bumps goreleaser/goreleaser-action from 6 to 7.
Release notes
Sourced from goreleaser/goreleaser-action's releases.
... (truncated)
Commits
1a80836ci(nightly): pass GITHUB_TOKEN to nightly integration joba71152erefactor: drop legacy 'nightly' tag fallback4c6ab56feat: resolve nightly to latest vX.Y.Z-<sha>-nightly release (#558)4f96abffeat: addversion-fileinput (#556)15fa2a9test: cover install across release eras (#555)e24998bci: drop pre-cosign-v3 goreleaser versions from tests (#554)be2e8a3docs: document cosign verification in README (#553)5e53f8eci: add release-major-tag workflow (#552)4068afabuild: drop docker-bake in favor of plain npm (#551)213ec80docs: add CONTRIBUTING with pre-commit workflowDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)