chore(deps): update github actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
JS-DevTools/npm-publish	action	major	v1 -> v3
actions/checkout	action	major	v3 -> v4
actions/setup-node	action	major	v3 -> v4
actions/stale	action	major	v7 -> v9
codecov/codecov-action	action	major	v3 -> v5
suzuki-shunsuke/github-action-renovate-config-validator	action	major	v0.1.3 -> v1.1.1

---

Release Notes

JS-DevTools/npm-publish (JS-DevTools/npm-publish)

v3

Compare Source

v2

Compare Source

actions/checkout (actions/checkout)

v4

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in https://github.com/actions/checkout/pull/1924

actions/setup-node (actions/setup-node)

v4

Compare Source

actions/stale (actions/stale)

v9

Compare Source

v8

Compare Source

codecov/codecov-action (codecov/codecov-action)

v5

Compare Source

What's Changed

• fix: use HEAD_REPO by @​thomasrockhu-codecov in https://github.com/codecov/codecov-action/pull/1690

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.6..v5.0.7

v4

Compare Source

suzuki-shunsuke/github-action-renovate-config-validator (suzuki-shunsuke/github-action-renovate-config-validator)

v1.1.1

Compare Source

Bug Fixes

#​768 #​770 #​772 Fixed a bug strict doesn't work

renovate-config-validator has an issue aboutRENOVATE_CONFIG_FILE.

• https://github.com/renovatebot/renovate/issues/30418

And now renovate-config-validator can accept files via positional arguments.

• https://github.com/renovatebot/renovate/pull/16475

Unlike RENOVATE_CONFIG_FILE, positional arguments can pass multiple files, so we don't need to run renovate-config-validator by file.
So this release replaces RENOVATE_CONFIG_FILE with positional arguments.

v1.1.0

Compare Source

Features

#​699 #​701 Support validating multiple files

You can validate multiple files by setting multiple lines to config_file_path.
Leading spaces on each line are removed.

e.g.

with:
  config_file_path: |
    default.json
    foo.json

You can pass config_file_path through output command.

e.g.

      - id: files
        run: |
          set -euo pipefail
          files=$(git ls-files | grep renovate.json)

### https://stackoverflow.com/a/74232400
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          {
            echo "files<<$EOF"
            echo "$files"
            echo "$EOF"
          } >> "$GITHUB_OUTPUT"
      - name: Pass files through output
        uses: suzuki-shunsuke/[email protected]
        with:
          config_file_path: ${{ steps.files.outputs.files }}

v1.0.1

Compare Source

Fixes

#​551 Suppress npx warnings using --yes option @​TWiStErRob

This action executes renovate-config-validator via npx, then the following warning was outputted.

npm WARN exec The following package was not found and will be installed: [email protected]

To suppress the warning, we set npx's --yes option.

https://docs.npmjs.com/cli/v8/commands/npx

If any requested packages are not present in the local project dependencies, then they are installed to a folder in the npm cache, which is added to the PATH environment variable in the executed process.
A prompt is printed (which can be suppressed by providing either --yes or --no).

To prevent security and user-experience problems from mistyping package names, npx prompts before installing anything.
Suppress this prompt with the -y or --yes option.
The --no-install option is deprecated, and will be converted to --no.

🎉 New contributors

Thank you for your contribution!

@​TWiStErRob #​551

v1.0.0

Compare Source

⚠️ Breaking Changes

#​531 renovate-config-validator's --strict option is enabled by default.

How to migrate

There are several options.

1. Recommended: Fix Renovate configuration according to the error message
2. Unrecommended: Set false to the input strict to disable --strict option

⚠️ Security Improvement

#​530 Pass inputs via environment variables to prevent malicious injection

Features

#​531 Add the input strict.

You can enable renovate-config-validator's --strict option.

---

Configuration

📅 Schedule: Branch creation - "before 3am every weekday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.83%. Comparing base (4d4a912) to head (62aa272).
Report is 3 commits behind head on main.

❗ Current head 62aa272 differs from pull request most recent head d7ac410. Consider uploading reports for the commit d7ac410 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #19      +/-   ##
==========================================
- Coverage   95.94%   95.83%   -0.11%     
==========================================
  Files          22       22              
  Lines         913      889      -24     
  Branches      258      252       -6     
==========================================
- Hits          876      852      -24     
  Misses         37       37              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.