Skip to content

action-allowlist-review: bump coursier/cache-action from 8.2.0 to 9.0.1 in /.github/actions/for-dependabot-triggered-reviews - #1468

Merged
potiuk merged 1 commit into
mainfrom
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/coursier/cache-action-9.0.1
Oct 29, 2026
Merged

potiuk merged 1 commit into
mainfrom
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/coursier/cache-action-9.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps coursier/cache-action from 8.2.0 to 9.0.1.

Release notes

Sourced from coursier/cache-action's releases.

v9.0.1

Highlights

COURSIER_CACHE is respected

If the COURSIER_CACHE environment variable is set when the action runs, for example in your workflow's env, the action now caches that directory. Before, it always cached the default OS-dependent location, which coursier doesn't use when COURSIER_CACHE is set. The path input still takes precedence.

OS and CPU architecture in the sbt, mill and Ammonite cache keys

The sbt, mill and Ammonite caches are stored at the same paths on Linux and macOS. Because of that, the fallback keys could restore a cache that was saved on a different OS or CPU architecture, even though these caches can hold platform-specific files such as native launchers. Their keys now include the runner's OS and architecture right after the cache name:

sbt-ivy2-cache-linux-x64-test-matrix-<matrix hash>-<build files hash>

The coursier cache keys don't change. Its path already differs per OS, and its content can be shared across architectures.

[!NOTE] The first run after upgrading starts the sbt, mill and Ammonite caches from scratch, because the new keys don't share a prefix with the old ones. Later runs restore and save caches as usual.

Missing inputs declared in action.yml

The action already read extraCoursierKey, extraCoursierHashedContent and read-cs-cache-files, but action.yml didn't declare them, so GitHub warned about unexpected inputs whenever they were passed. All three are now declared and documented in the README:

  • extraCoursierKey: an extra value added only to the coursier cache key
  • extraCoursierHashedContent: extra content hashed only into the coursier cache key
  • read-cs-cache-files (default true): set it to false to ignore .github/cs-cache-files

Fixes and internal changes

  • The coursier cache location is now detected with process.platform instead of running uname, so the action no longer needs a uname executable on PATH. Windows runners without Git Bash don't provide one.
  • Extra hashed content (extraHashedContent and related inputs) is now hashed in memory. Before, it was written to a temporary .tmp-cs-cache-key file in the workspace, and that file was left behind if hashing failed. Keys that combine build files with extra hashed content may change once. The previous cache is still restored through the fallback keys.
  • Removed dead and duplicated code: extraMillFiles was added to the mill globs twice, and an unused helper was dropped. The @actions/exec dependency is gone.
  • Moved cache key computation into its own module and added unit tests for cache keys and the cache mode handling (npm test now runs them).

Full Changelog: coursier/cache-action@v9.0.0...v9.0.1

9.0.0

Highlights

This is a major release because existing caches will mostly not be reused: the Coursier cache path changed, and the way cache keys are computed changed for some setups. Expect cache misses on the first run after upgrading. Workflow files need no other changes.

Only Coursier's v1 directory is cached (#875)

The action now caches only the Coursier cache itself (~/.cache/coursier/v1 on Linux, ~/Library/Caches/Coursier/v1 on macOS, ~\AppData\Local\Coursier\Cache\v1 on Windows). It no longer caches the whole Coursier directory, which also holds the archive cache (arc). Its contents are re-extracted from the archives in v1 when needed.

This makes caches smaller and saving them more reliable.

Same cache keys with CRLF and LF line endings (#875)

... (truncated)

Commits
  • ee0650f Update dist (#881)
  • c60a1bc Use Node.js 24 for dist updates (#880)
  • 8303f14 Merge pull request #879 from alexarchambault/improve-cache-action
  • 5f046a0 Add unit tests for cache keys and cache mode
  • 2ea70b1 Move the cache key computation to its own module
  • 69aafd4 Add the OS and CPU architecture to the sbt, mill and Ammonite cache keys
  • 398468c Hash extra content in memory, rather than via a temporary file
  • 1793d30 Declare and document the extraCoursierKey, extraCoursierHashedContent and rea...
  • 7a7a97e Cache the directory COURSIER_CACHE points to, if it is set
  • 8bd5152 Use process.platform to find the coursier cache location
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [coursier/cache-action](https://github.com/coursier/cache-action) from 8.2.0 to 9.0.1.
- [Release notes](https://github.com/coursier/cache-action/releases)
- [Commits](coursier/cache-action@057d08c...ee0650f)

---
updated-dependencies:
- dependency-name: coursier/cache-action
  dependency-version: 9.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 29, 2026
@potiuk
potiuk merged commit b90158c into main Oct 29, 2026
13 of 14 checks passed
@potiuk
potiuk deleted the dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/coursier/cache-action-9.0.1 branch October 29, 2026 22:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant