dependabot[bot] opened a new pull request, #73: URL: https://github.com/apache/pekko-quickstart-scala.g8/pull/73
Bumps [coursier/cache-action](https://github.com/coursier/cache-action) from 8.2.0 to 9.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/coursier/cache-action/releases";>coursier/cache-action's releases</a>.</em></p> <blockquote> <h2>v9.0.1</h2> <h2>Highlights</h2> <h3><code>COURSIER_CACHE</code> is respected</h3> <p>If the <code>COURSIER_CACHE</code> environment variable is set when the action runs, for example in your workflow's <code>env</code>, the action now caches that directory. Before, it always cached the default OS-dependent location, which coursier doesn't use when <code>COURSIER_CACHE</code> is set. The <code>path</code> input still takes precedence.</p> <h3>OS and CPU architecture in the sbt, mill and Ammonite cache keys</h3> <p>The sbt, mill and Ammonite caches are stored at the same paths on Linux and macOS. Because of that, the fallback keys could restore a cache that was saved on a different OS or CPU architecture, even though these caches can hold platform-specific files such as native launchers. Their keys now include the runner's OS and architecture right after the cache name:</p> <pre lang="text"><code>sbt-ivy2-cache-linux-x64-test-matrix-<matrix hash>-<build files hash> </code></pre> <p>The coursier cache keys don't change. Its path already differs per OS, and its content can be shared across architectures.</p> <blockquote> <p>[!NOTE] The first run after upgrading starts the sbt, mill and Ammonite caches from scratch, because the new keys don't share a prefix with the old ones. Later runs restore and save caches as usual.</p> </blockquote> <h3>Missing inputs declared in <code>action.yml</code></h3> <p>The action already read <code>extraCoursierKey</code>, <code>extraCoursierHashedContent</code> and <code>read-cs-cache-files</code>, but <code>action.yml</code> didn't declare them, so GitHub warned about unexpected inputs whenever they were passed. All three are now declared and documented in the README:</p> <ul> <li><code>extraCoursierKey</code>: an extra value added only to the coursier cache key</li> <li><code>extraCoursierHashedContent</code>: extra content hashed only into the coursier cache key</li> <li><code>read-cs-cache-files</code> (default <code>true</code>): set it to <code>false</code> to ignore <code>.github/cs-cache-files</code></li> </ul> <h2>Fixes and internal changes</h2> <ul> <li>The coursier cache location is now detected with <code>process.platform</code> instead of running <code>uname</code>, so the action no longer needs a <code>uname</code> executable on <code>PATH</code>. Windows runners without Git Bash don't provide one.</li> <li>Extra hashed content (<code>extraHashedContent</code> and related inputs) is now hashed in memory. Before, it was written to a temporary <code>.tmp-cs-cache-key</code> file in the workspace, and that file was left behind if hashing failed. Keys that combine build files with extra hashed content may change once. The previous cache is still restored through the fallback keys.</li> <li>Removed dead and duplicated code: <code>extraMillFiles</code> was added to the mill globs twice, and an unused helper was dropped. The <code>@actions/exec</code> dependency is gone.</li> <li>Moved cache key computation into its own module and added unit tests for cache keys and the cache mode handling (<code>npm test</code> now runs them).</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/coursier/cache-action/compare/v9.0.0...v9.0.1";>https://github.com/coursier/cache-action/compare/v9.0.0...v9.0.1</a></p> <h2>9.0.0</h2> <h2>Highlights</h2> <p>This is a major release because <strong>existing caches will mostly not be reused</strong>: the Coursier cache path changed, and the way cache keys are computed changed for some setups. Expect cache misses on the first run after upgrading. Workflow files need no other changes.</p> <h3>Only Coursier's <code>v1</code> directory is cached (<a href="https://redirect.github.com/coursier/cache-action/issues/875";>#875</a>)</h3> <p>The action now caches only the Coursier cache itself (<code>~/.cache/coursier/v1</code> on Linux, <code>~/Library/Caches/Coursier/v1</code> on macOS, <code>~\AppData\Local\Coursier\Cache\v1</code> on Windows). It no longer caches the whole Coursier directory, which also holds the archive cache (<code>arc</code>). Its contents are re-extracted from the archives in <code>v1</code> when needed.</p> <p>This makes caches smaller and saving them more reliable.</p> <h3>Same cache keys with CRLF and LF line endings (<a href="https://redirect.github.com/coursier/cache-action/issues/875";>#875</a>)</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coursier/cache-action/commit/ee0650f98295f27a505e4bfd284c9bfaa913a465";><code>ee0650f</code></a> Update dist (<a href="https://redirect.github.com/coursier/cache-action/issues/881";>#881</a>)</li> <li><a href="https://github.com/coursier/cache-action/commit/c60a1bc311bed2a2dcefb9a8772accbf98e42ff2";><code>c60a1bc</code></a> Use Node.js 24 for dist updates (<a href="https://redirect.github.com/coursier/cache-action/issues/880";>#880</a>)</li> <li><a href="https://github.com/coursier/cache-action/commit/8303f141fca4b9e73c563ebe0bbc158f99c10cfb";><code>8303f14</code></a> Merge pull request <a href="https://redirect.github.com/coursier/cache-action/issues/879";>#879</a> from alexarchambault/improve-cache-action</li> <li><a href="https://github.com/coursier/cache-action/commit/5f046a01af7fe34d37fdd3f6e19e68c817aa683d";><code>5f046a0</code></a> Add unit tests for cache keys and cache mode</li> <li><a href="https://github.com/coursier/cache-action/commit/2ea70b16febe1123360a4cb99254b0670a13d116";><code>2ea70b1</code></a> Move the cache key computation to its own module</li> <li><a href="https://github.com/coursier/cache-action/commit/69aafd404766edb843fa34bcdb4f106a9c6e278a";><code>69aafd4</code></a> Add the OS and CPU architecture to the sbt, mill and Ammonite cache keys</li> <li><a href="https://github.com/coursier/cache-action/commit/398468c6cf185f6acea5b6b3e0d7c9cbba46457b";><code>398468c</code></a> Hash extra content in memory, rather than via a temporary file</li> <li><a href="https://github.com/coursier/cache-action/commit/1793d3060ddd77db5a19d96f1575abd4222a11f6";><code>1793d30</code></a> Declare and document the extraCoursierKey, extraCoursierHashedContent and rea...</li> <li><a href="https://github.com/coursier/cache-action/commit/7a7a97ebbd372ea420de2a49d9913d723f6e722d";><code>7a7a97e</code></a> Cache the directory COURSIER_CACHE points to, if it is set</li> <li><a href="https://github.com/coursier/cache-action/commit/8bd515248ae82f85ff020598e84a4dd44f547f5b";><code>8bd5152</code></a> Use process.platform to find the coursier cache location</li> <li>Additional commits viewable in <a href="https://github.com/coursier/cache-action/compare/057d08c2f9a2c4e7a4d33df3aae657b7db88b8cc...ee0650f98295f27a505e4bfd284c9bfaa913a465";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
