chore(deps): update actions/setup-node action to v6.5.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	minor	v6.4.0 → v6.5.0

---

Release Notes

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 11:59 AM, only on Monday (* 8-11 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bito-code-review]

Code Review Agent Run #e2e5da

Actionable Suggestions - 0

Review Details

• Files reviewed - 7 · Commit Range: afd48fa..afd48fa

  • .github/workflows/commitlint.yaml
  • .github/workflows/main-pipeline.yaml
  • .github/workflows/publish-android.yaml
  • .github/workflows/publish-docs.yml
  • .github/workflows/publish-npm.yaml
  • .github/workflows/publish-spm.yaml
  • .github/workflows/release-please.yaml
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Impact Analysis by Bito

Cross-Repository Impact Analysis

What Changed	Impact of Change	Suggested Review Actions
Bump actions/setup-node from SHA-pinned v6.4.0 to SHA-pinned v6.5.0 across all 7 CI workflow files in the optimization repo. Inputs (node-version-file: '.nvmrc', package-manager-cache: false) remain unchanged.	- agents-api/.github/workflows/techdocs-publish.yml:46 still pins the OLD v6.4.0 SHA (48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e) — agents-api CONSUMES actions/setup-node v6.4.0 directly, not via optimization, so this PR does not change agents-api behavior, but the org-wide inconsistency is worth flagging.: agents-api is the only other Contentful repo that SHA-pins setup-node (verified via mcp_BitoAIArchitect_searchCode). It uses the same inputs (node-version-file: '.nvmrc', cache: 'npm') so a parallel bump is safe. - No cross-repo consumers of optimization's CI workflows exist. Other Contentful repos (webhooks-stack, extensibility-stack, create-contentful-app, node-apps-toolkit, extensibility-api) use major-version tags (v3/v4/v5/v6) for setup-node and are unaffected by this SHA bump.: Verified via mcp_BitoAIArchitect_searchCode across *.yaml and *.yml: zero hits for the old SHA outside optimization+agents-api; zero hits for the new SHA anywhere; major-tag users auto-update independently.	- Confirm v6.5.0 release notes (actions/setup-node) are reviewed for any breaking input changes — optimization uses 'package-manager-cache: false' which is a v6.4+ input, so behavior should be preserved. - Optionally file a follow-up PR in agents-api to bump techdocs-publish.yml from the same old SHA to the new SHA for org-wide consistency. - Verify the first CI run on this PR passes for all 7 affected workflows (commitlint, main-pipeline with ~22 jobs, publish-android, publish-docs, publish-npm, publish-spm, release-please).

Code Paths Analyzed

Impact:
Pure CI-only dependency bump. No application code, SDK API, or runtime behavior changes. All 7 affected workflows continue to use the same inputs (node-version-file: '.nvmrc' resolving to 24.15.0, package-manager-cache: false) and the same downstream steps (pnpm/action-setup@v6.0.3, pnpm install, build/test/publish).

Flow:
GitHub Actions runner → actions/setup-node@v6.5.0 (new SHA) → resolves Node 24.15.0 from .nvmrc → pnpm/action-setup@v6.0.3 → pnpm install --prefer-offline --frozen-lockfile → existing build/test/publish steps. No external service or data-store interaction introduced or removed.

Direct Changes (Diff Files):
• .github/workflows/commitlint.yaml [21] — Bump actions/setup-node SHA v6.4.0 → v6.5.0 (1 occurrence)
• .github/workflows/main-pipeline.yaml [21, 24, 33, 42, 51, 60, 69, 78, 87, 96, 105, 114, 123, 132, 141, 150, 159, 168, 177, 186, 195, 204, 213, 222, 231, 240, 249] — Bump actions/setup-node SHA v6.4.0 → v6.5.0 across ~27 job steps (build, unit, lock, all 11 e2e_* jobs, swift_package, android_library, knowledge)
• .github/workflows/publish-android.yaml [38] — Bump actions/setup-node SHA v6.4.0 → v6.5.0 (1 occurrence)
• .github/workflows/publish-docs.yml [37] — Bump actions/setup-node SHA v6.4.0 → v6.5.0 (1 occurrence)
• .github/workflows/publish-npm.yaml [43, 96] — Bump actions/setup-node SHA v6.4.0 → v6.5.0 (2 occurrences: pre-resolution + publish step)
• .github/workflows/publish-spm.yaml [40] — Bump actions/setup-node SHA v6.4.0 → v6.5.0 (1 occurrence)
• .github/workflows/release-please.yaml [26] — Bump actions/setup-node SHA v6.4.0 → v6.5.0 (1 occurrence)

Repository Impact:
• CI/CD pipeline only (.github/workflows/)**: All changes are confined to GitHub Actions workflow YAML files. No source code, package manifests, or runtime configuration is touched.

Cross-Repository Dependencies:
• agents-api (techdocs-publish.yml still uses old SHA): agents-api is the only other Contentful repo that SHA-pins actions/setup-node; it independently pins v6.4.0 and is unaffected by this PR, but the divergence is worth noting.

Database/Caching Impact:
• None

API Contract Violations:
• None. No SDK, HTTP, gRPC, message, or data contracts are touched. The 'package-manager-cache' input (introduced in v6.4) is preserved as 'false', so no behavior change is expected from the v6.4.0 → v6.5.0 bump.

Infrastructure Dependencies:
• GitHub-hosted runner image (ubuntu-latest for most jobs, macos-latest for publish-spm, namespace-profile-linux-8-vcpu-16-gb-ram-optimal for main-pipeline). No runner image change. Node version still resolved from .nvmrc (24.15.0).

Additional Insights:
• Renovate bot scheduling: renovate.json schedules github-actions updates for Monday 8-11 Europe/Berlin. This PR appears to be a manual or pre-emptive bump ahead of Renovate's automated PR, which is consistent with the SHA-pinning discipline already in place.

Testing Recommendations

Frontend Impact:
• No frontend impact — no UI, SDK, or browser-facing code changed.

Service Integration:
• Run the full main-pipeline once on this PR to validate all ~27 setup-node invocations resolve cleanly under v6.5.0 with Node 24.15.0.

Data Serialization:
• No data serialization changes.

Privacy Compliance:
• No privacy or PII handling changes.

Backward Compatibility:
• Spot-check publish-npm.yaml (the only workflow with two setup-node invocations and a registry-url: 'https://npm.pkg.github.com' + scope: 'Contentful (@contentful)' block) to confirm v6.5.0 still honors the GitHub Packages registry auth flow.

OAuth Functionality:
• None

Cross-Service Communication:
• No cross-service communication changes.

Reliability Testing:
• None

Additional Insights:
• Verify the v6.5.0 release notes for actions/setup-node (GitHub) before merge — confirm no input renames or removals affect 'node-version-file' or 'package-manager-cache'.
• Consider opening a tracking issue to bump agents-api/.github/workflows/techdocs-publish.yml from the same old SHA to the new SHA for org-wide consistency.

_{Analysis based on known dependency patterns and edges. Actual impact may vary.}

[bito-code-review]

Code Review Agent Run #a78100

Actionable Suggestions - 0

Review Details

• Files reviewed - 7 · Commit Range: 82876da..82876da

  • .github/workflows/commitlint.yaml
  • .github/workflows/main-pipeline.yaml
  • .github/workflows/publish-android.yaml
  • .github/workflows/publish-docs.yml
  • .github/workflows/publish-npm.yaml
  • .github/workflows/publish-spm.yaml
  • .github/workflows/release-please.yaml
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Code Review Agent Run #a381a8

Actionable Suggestions - 0

Review Details

• Files reviewed - 7 · Commit Range: 99a8e07..99a8e07

  • .github/workflows/commitlint.yaml
  • .github/workflows/main-pipeline.yaml
  • .github/workflows/publish-android.yaml
  • .github/workflows/publish-docs.yml
  • .github/workflows/publish-npm.yaml
  • .github/workflows/publish-spm.yaml
  • .github/workflows/release-please.yaml
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by