chore(deps): update actions/setup-node action to v6.5.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-node	action	minor	v6.4.0 → v6.5.0

---

Release Notes

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 11:59 AM, only on Monday (* 8-11 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bito-code-review]

Code Review Agent Run #e2e5da

Actionable Suggestions - 0

Review Details

• Files reviewed - 7 · Commit Range: afd48fa..afd48fa

  • .github/workflows/commitlint.yaml
  • .github/workflows/main-pipeline.yaml
  • .github/workflows/publish-android.yaml
  • .github/workflows/publish-docs.yml
  • .github/workflows/publish-npm.yaml
  • .github/workflows/publish-spm.yaml
  • .github/workflows/release-please.yaml
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Impact Analysis by Bito

Cross-Repository Impact Analysis

What Changed	Impact of Change	Suggested Review Actions
Bumped actions/setup-node from v6.4.0 (SHA 48b55a0…) to v6.5.0 (SHA 2499707…) across every GitHub Actions workflow in this repo (commitlint, main-pipeline, publish-android, publish-docs, publish-npm, publish-spm, release-please).	- agents-api/.github/workflows/techdocs-publish.yml:46 still references the old SHA 48b55a0… (v6.4.0) — divergent CI tooling version vs. optimization repo: Same SHA pinned in a sibling repo's workflow; not a consumer of optimization, but a parallel CI surface that may want to align to v6.5.0 for consistency. No runtime/data contract between the two repos.	- Confirm v6.5.0 release notes are reviewed (Node.js version matrix, default behavior changes) before merge — bump is across ~30 workflow steps. - Optionally align agents-api/.github/workflows/techdocs-publish.yml to the same v6.5.0 SHA in a follow-up PR to avoid CI drift. - Verify the first green run of main-pipeline (which fans out to ~20 implementation jobs: node-sdk, web-sdk, react/angular/nextjs variants, etc.) on the bumped action.

Code Paths Analyzed

Impact:
Pure CI/CD infrastructure bump — actions/setup-node v6.4.0 → v6.5.0 (SHA-pinned) across every workflow. No application code, API surface, schema, or runtime behavior changes.

Flow:
GitHub Actions runners → setup-node step (now v6.5.0) → subsequent pnpm/npm install and build/test/publish steps. Control flow unchanged; only the action version differs.

Direct Changes (Diff Files):
• .github/workflows/commitlint.yaml [L18-L20] — Bump setup-node SHA in commitlint job.
• .github/workflows/main-pipeline.yaml [L147-L1297 (≈20 job occurrences)] — Bump setup-node SHA in every main-pipeline job (lint, test, build across node-sdk / web-sdk / react / angular / nextjs variants).
• .github/workflows/publish-android.yaml [L35-L37] — Bump setup-node SHA in Android publish job.
• .github/workflows/publish-docs.yml [L34-L36] — Bump setup-node SHA in docs publish job.
• .github/workflows/publish-npm.yaml [L40-L42, L93-L95] — Bump setup-node SHA in two npm publish jobs.
• .github/workflows/publish-spm.yaml [L37-L39] — Bump setup-node SHA in SPM publish job.
• .github/workflows/release-please.yaml [L23-L25] — Bump setup-node SHA in release-please job.

Repository Impact:
• CI/CD pipeline only — no application modules, services, or libraries touched.: Diff is confined to .github/workflows/*.yaml; SHA-pinned action upgrade does not alter build outputs or runtime.

Cross-Repository Dependencies:
• agents-api (parallel CI workflow, not a runtime consumer): agents-api/.github/workflows/techdocs-publish.yml still pins the old v6.4.0 SHA; no shared contract, only shared tooling.

Database/Caching Impact:
• None

API Contract Violations:
• None — no API, schema, or data-contract surface modified.

Infrastructure Dependencies:
• GitHub Actions runner environment: actions/setup-node v6.5.0 (Node.js setup, caching behavior). Review v6.5.0 release notes for any default-behavior changes (e.g., cache key strategy, registry defaults).

Additional Insights:
• Supply-chain hygiene: SHA-pinning is preserved on bump (only the SHA + tag comment change), so the supply-chain guarantee is maintained — no new un-pinned dependency introduced.

Testing Recommendations

Frontend Impact:
• No frontend-impacting changes — no UI, component, or build-output changes.

Service Integration:
• Run the full main-pipeline once on the bumped action to confirm all ~20 implementation jobs (node-sdk, web-sdk, react/angular/nextjs variants) still pass.

Data Serialization:
• No data-serialization changes.

Privacy Compliance:
• No privacy/compliance surface changes.

Backward Compatibility:
• Verify Node.js version resolution from .nvmrc is unchanged under setup-node v6.5.0; confirm pnpm/npm cache key derivation still matches existing cache entries to avoid cold-cache rebuilds.

OAuth Functionality:
• None

Cross-Service Communication:
• No cross-service communication changes.

Reliability Testing:
• None

Additional Insights:
• Skim the actions/setup-node v6.4.0 → v6.5.0 release notes (GitHub) for any default-behavior deltas (cache, registry, auth) before merge.
• Consider a follow-up PR to align agents-api/.github/workflows/techdocs-publish.yml to the same v6.5.0 SHA to prevent CI drift.

_{Analysis based on known dependency patterns and edges. Actual impact may vary.}