[main] Update GitHub Actions Dependencies (major)

[ospk8s-renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v5 → v7
actions/checkout	action	major	v4 → v7
actions/setup-go	action	major	v6 → v7
redhat-actions/openshift-tools-installer	action	major	v1 → v3

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

v7

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

v6.0.0

Compare Source

• Persist creds to a separate file by @​ericsciple in #​2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in #​2248

v6

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/setup-go (actions/setup-go)

v7.0.0

Compare Source

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​771

New Contributors

• @​philip-gai made their first contribution in #​771

Full Changelog: actions/setup-go@v6...v7.0.0

v7

Compare Source

redhat-actions/openshift-tools-installer (redhat-actions/openshift-tools-installer)

v3.0

Compare Source

Breaking Changes

• Removed kam client — the redhat-developer/kam project is abandoned (last release Oct 2023) #​169
• Switched kamel and operator-sdk to GitHub-only sources — the OpenShift mirror versions are significantly behind upstream. Using source: mirror with these clients will now produce an error #​170
• Switched tkn from the stale v4 clients mirror to the CGW pipelines mirror — versions prior to 1.15.4 are no longer available via mirror #​161

Features

• Add argocd client from the CGW openshift-gitops mirror #​161
• Add Content Gateway (CGW) mirror support for Helm 4.x — users can now install Helm 4 with helm: "4" #​161
• Support multiple mirror base URLs per client, enabling version resolution across both the v4 clients mirror and CGW #​161

Bug Fixes

• Fix isHashMissing check to short-circuit before fetching hash files — previously it only applied when no hash file existed in the directory, but CGW pipelines has an incompatible hash file format #​168
• Fix js-yaml CVE-2026-59870 via npm override #​167
• Fix octokit openapi-types 28.x type compatibility #​167
• Fix Dependabot PR CI failures #​156
• Fix npm audit vulnerabilities and simplify security scan #​160

Dependencies

• Bump @octokit/openapi-types from 27.0.0 to 28.0.0 #​163
• Bump @octokit/plugin-paginate-rest from 14.0.0 to 15.0.0 #​165
• Bump brace-expansion to 5.0.8 and js-yaml to 5.2.2 #​151
• Bump dev-dependencies group #​158

v3

Compare Source

Breaking Changes

• Removed kam client — the redhat-developer/kam project is abandoned (last release Oct 2023) #​169
• Switched kamel and operator-sdk to GitHub-only sources — the OpenShift mirror versions are significantly behind upstream. Using source: mirror with these clients will now produce an error #​170
• Switched tkn from the stale v4 clients mirror to the CGW pipelines mirror — versions prior to 1.15.4 are no longer available via mirror #​161

Features

• Add argocd client from the CGW openshift-gitops mirror #​161
• Add Content Gateway (CGW) mirror support for Helm 4.x — users can now install Helm 4 with helm: "4" #​161
• Support multiple mirror base URLs per client, enabling version resolution across both the v4 clients mirror and CGW #​161

Bug Fixes

• Fix isHashMissing check to short-circuit before fetching hash files — previously it only applied when no hash file existed in the directory, but CGW pipelines has an incompatible hash file format #​168
• Fix js-yaml CVE-2026-59870 via npm override #​167
• Fix octokit openapi-types 28.x type compatibility #​167
• Fix Dependabot PR CI failures #​156
• Fix npm audit vulnerabilities and simplify security scan #​160

Dependencies

• Bump @octokit/openapi-types from 27.0.0 to 28.0.0 #​163
• Bump @octokit/plugin-paginate-rest from 14.0.0 to 15.0.0 #​165
• Bump brace-expansion to 5.0.8 and js-yaml to 5.2.2 #​151
• Bump dev-dependencies group #​158

v2.0

Compare Source

• See release notes

v2

Compare Source

• See release notes

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[openshift-ci]

Hi @ospk8s-renovate[bot]. Thanks for your PR.

I'm waiting for a openstack-k8s-operators member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[lpiwowar]

/ok-to-test

[lpiwowar]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lpiwowar, ospk8s-renovate[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [lpiwowar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment