Skip to content

chore(deps): bump MetaMask/action-checkout-and-setup from 2 to 3 - #5

Merged
ulissesferreira merged 2 commits into
mainfrom
dependabot/github_actions/main/MetaMask/action-checkout-and-setup-3
Aug 6, 2026
Merged

chore(deps): bump MetaMask/action-checkout-and-setup from 2 to 3#5
ulissesferreira merged 2 commits into
mainfrom
dependabot/github_actions/main/MetaMask/action-checkout-and-setup-3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026

Copy link
Copy Markdown
Contributor

Bumps MetaMask/action-checkout-and-setup from 2 to 3.

Release notes

Sourced from MetaMask/action-checkout-and-setup's releases.

3.0.0

Changed

  • BREAKING: Security fix, removes the inputs yarn-custom-url, use-yarn-hydrate, and yarn-hydrate-command -- replaced with yarn-tarball (#57)
  • BREAKING: Made things faster when there's a cache hit, but now requires either .nvmrc or inputs.node-version (#54)

2.0.1

Fixed

  • Use environment variables for script inputs (#44)
Changelog

Sourced from MetaMask/action-checkout-and-setup's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[3.3.0]

Added

  • Add persist-credentials input (#69)
    • This is forwarded to actions/checkout, and defaults to false.

Fixed

  • Restore support for private repositories (#68)
  • Include Yarn install state when restoring cache (#66)

[3.2.0]

Added

  • Allow high-risk the option to save cache without reading cache (#64)

[3.1.0]

Added

  • Add force-setup option to always perform checkout and setup (#61)

[3.0.1]

Fixed

  • Fix Windows runner compatibility by using curl instead of wget (#59)

[3.0.0]

Changed

  • BREAKING: Security fix, removes the inputs yarn-custom-url, use-yarn-hydrate, and yarn-hydrate-command -- replaced with yarn-tarball (#57)
  • BREAKING: Made things faster when there's a cache hit, but now requires either .nvmrc or inputs.node-version (#54)

[2.0.1]

Fixed

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.


Maintainer notes

force-setup: true on the prepare job

action-checkout-and-setup@v3 can skip checkout and dependency setup when a node_modules cache already exists (cache-node-modules: true). That optimization is meant for cache-warming jobs that end immediately.

Our prepare job in lint-build-test.yml uses cache-node-modules: true and runs yarn workspaces list in the same job, so we set force-setup: true to always check out the repo and restore the workspace. Without it, CI can pass on a cold cache and then fail once the cache warms up.

This matches the pattern used in MetaMask/core.

Other usages in this repo

Workflow Version force-setup needed?
lint-build-test.yml (prepare) v3 (this PR) Yes — added in this PR
lint-build-test.yml (other jobs) v3 (this PR) No — no cache-node-modules
publish-release.yml v3 (this PR) No — is-high-risk-environment: true disables cache reads
ensure-blocking-pr-labels-absent.yml v3 (this PR) No — no cache-node-modules
update-changelogs.yml v3 (already on main) No — no cache-node-modules; checks out separately first

No application or snap runtime code is affected — this is CI-only.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 8, 2026
@dependabot
dependabot Bot temporarily deployed to default-branch June 8, 2026 19:07 Inactive
@dependabot dependabot Bot changed the title Bump MetaMask/action-checkout-and-setup from 2 to 3 chore(deps): bump MetaMask/action-checkout-and-setup from 2 to 3 Jun 9, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/MetaMask/action-checkout-and-setup-3 branch from 7be12a3 to a9fc7cd Compare June 9, 2026 09:33
@dependabot
dependabot Bot requested a review from a team as a code owner June 9, 2026 09:33
@ulissesferreira

Copy link
Copy Markdown
Contributor

@dependabot rebase

Bumps [MetaMask/action-checkout-and-setup](https://github.com/metamask/action-checkout-and-setup) from 2 to 3.
- [Release notes](https://github.com/metamask/action-checkout-and-setup/releases)
- [Changelog](https://github.com/MetaMask/action-checkout-and-setup/blob/main/CHANGELOG.md)
- [Commits](MetaMask/action-checkout-and-setup@v2...v3)

---
updated-dependencies:
- dependency-name: MetaMask/action-checkout-and-setup
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@ulissesferreira
ulissesferreira force-pushed the dependabot/github_actions/main/MetaMask/action-checkout-and-setup-3 branch from a9fc7cd to 796b1ad Compare August 6, 2026 08:42
@ulissesferreira
ulissesferreira requested a review from a team as a code owner August 6, 2026 08:42
@dependabot @github

dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

Comment thread .github/workflows/ensure-blocking-pr-labels-absent.yml Dismissed
Comment thread .github/workflows/lint-build-test.yml Dismissed
Comment thread .github/workflows/lint-build-test.yml Dismissed
Comment thread .github/workflows/lint-build-test.yml Dismissed
Comment thread .github/workflows/lint-build-test.yml Dismissed
Comment thread .github/workflows/lint-build-test.yml Dismissed
Comment thread .github/workflows/lint-build-test.yml Dismissed
Comment thread .github/workflows/publish-release.yml Dismissed
Comment thread .github/workflows/publish-release.yml Dismissed
Comment thread .github/workflows/publish-release.yml Dismissed
v3 can skip checkout and setup when the node_modules cache already exists.
The prepare job still runs yarn workspaces list in the same job, so force
setup is required to keep the workspace available after a cache hit.
with:
is-high-risk-environment: false
cache-node-modules: true
force-setup: true

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is important for this job. Same as in Core.

@ulissesferreira
ulissesferreira added this pull request to the merge queue Aug 6, 2026
Merged via the queue into main with commit b7ad390 Aug 6, 2026
49 checks passed
@ulissesferreira
ulissesferreira deleted the dependabot/github_actions/main/MetaMask/action-checkout-and-setup-3 branch August 6, 2026 09:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants