chore(deps): update grafana/plugin-ci-workflows/ci-cd-workflows action to v7.0.0

[renovate-sh-app]

This PR contains the following updates:

Package	Type	Update	Change
grafana/plugin-ci-workflows	action	major	ci-cd-workflows/v5.1.0 → ci-cd-workflows/v7.0.0
grafana/plugin-ci-workflows	action	major	ci-cd-workflows/v6.1.1 → ci-cd-workflows/v7.0.0

---

Release Notes

grafana/plugin-ci-workflows (grafana/plugin-ci-workflows)

vci-cd-workflows/v7.0.0: ci-cd-workflows: v7.0.0

Compare Source

🚨 IMPORTANT NOTE

This version of plugin-ci-workflows comes with some major improvements to the CD GitHub Actions Workflow and the Argo Workflow for provisioned plugins.
The CD GitHub Actions Workflow and its complementary Argo Workflow for deploying to Grafana Cloud can now be customized to accommodate for different release flows.

We highly recommend reading the "Concepts" and "Customization" sections in the EngHub docs to understand how deployments work and how to customize them.

⚠ BREAKING CHANGES

• deps: remove "v" prefix from mage-version input (#​576)

🎉 Features

• cd: argo: support per-environment auto-approval durations, add input to deploy only to prod when targeting prod (rather than all envs) (#​544) (07d2504)
• plugin-validator: provide a better default plugin-validator config (#​600) (2a407c4)

🐛 Bug Fixes

• remove gcs artifact exists step (#​590) (264b037)

🔧 Chores

• deps: remove "v" prefix from mage-version input (#​576) (093ef76)
• deps: update actions/attest-build-provenance action to v4 (#​597) (d41630f)
• deps: update actions/attest-build-provenance action to v4.1.0 (#​604) (847aaf6)
• deps: update actions/setup-go action to v6.3.0 (#​596) (b5d1276)
• deps: update dependency actionlint to v1.7.11 (#​578) (35f5b60)
• deps: update dependency golangci-lint to v2.10.1 (#​584) (e6e0e96)
• deps: update dependency trufflehog to v3.93.4 (#​586) (97dbc0b)
• deps: update dependency trufflehog to v3.93.5 (#​603) (3ece790)
• deps: update dependency trufflehog to v3.93.6 (#​606) (bc2067b)
• deps: update grafana/shared-workflows/get-vault-secrets action to v1.3.1 (#​587) (331d439)
• deps: update grafana/shared-workflows/trigger-argo-workflow action to v1.2.2 (#​585) (60f35d3)
• deps: update step-security/harden-runner action to v2.15.0 (#​595) (1783a6d)

vci-cd-workflows/v6.1.1: ci-cd-workflows: v6.1.1

Compare Source

🐛 Bug Fixes

• ci: fix plugin-validator failing with non-standard frontend build tooling error (#​564) (fc2c645)

✅ Tests

• act: add cd deployment logic tests (#​509) (2ca4b67)
• add tests for workflows consistency (#​568) (3de0393)

🔧 Chores

• act: remove DO-NOT-USE-gcom-api-url and use workflow mutator instead (#​548) (52bd8cf)
• act: run act tests when actions or cd workflow change (#​526) (9d2b383)
• bumping e2e version package (#​546) (95d139e)
• ci: pin plugin-validator to 0.37.1 rather than using the latest version from main (#​566) (cf1d120)
• deps: configure renovate for nektos/act (#​550) (cf54bbf)
• deps: update actions/attest-build-provenance action to v3.2.0 (#​555) (cf43518)
• deps: update actions/cache action to v5.0.2 (#​543) (fedc555)
• deps: update actions/cache action to v5.0.3 (#​557) (3a8eba4)
• deps: update actions/checkout action to v6.0.2 (#​529) (352ce11)
• deps: update actions/setup-go action to v6.2.0 (#​540) (6af0e79)
• deps: update actions/setup-node action to v6.2.0 (#​541) (e029b6b)
• deps: update dependency act to v0.2.84 (#​560) (a1bcdf9)
• deps: update dependency actionlint to v1.7.10 (#​561) (6d8b6a2)
• deps: update dependency golangci-lint to v2.8.0 (#​562) (d5db4fc)
• deps: update dependency golangci-lint to v2.9.0 (#​575) (16aa7b7)
• deps: update dependency trufflehog to v3.92.5 (#​563) (9bdb106)
• deps: update dependency trufflehog to v3.93.0 (#​569) (c9ff19d)
• deps: update dependency trufflehog to v3.93.1 (#​571) (7c9c73d)
• deps: update dependency trufflehog to v3.93.3 (#​574) (109184c)
• deps: update peter-evans/create-pull-request action to v8.1.0 (#​545) (de45ad3)
• deps: update step-security/harden-runner action to v2.14.1 (#​552) (27c6a06)
• deps: update step-security/harden-runner action to v2.14.2 (#​572) (64ef0b5)
• renovate: handle default go, node and tooling versions in workflows via renovate (#​533) (e8bea40)

vci-cd-workflows/v6.1.0: ci-cd-workflows: v6.1.0

Compare Source

🎉 Features

• cd: export ci outputs in cd job (#​518) (ce2d1bb)

vci-cd-workflows/v6.0.0: ci-cd-workflows: v6.0.0

Compare Source

⚠ BREAKING CHANGES

• playwright: remove version and image arguments (#​507)

GRAFANA_VERSION and GRAFANA_IMAGE aren't being passed to Playwright anymore.

For consumers of the shared workflows that wants to detect Grafana version within plugin-e2e tests, there's an alternative approach using the official API:

test('should be possible to enable advanced mode', async ({ grafanaVersion, alertRuleEditPage }) => {
   test.skip(semver.lt(grafanaVersion, '11.6.0'), 'Advanced mode is not supported in Grafana versions < 11.6.0');
   // test code
});

---

• cd: allow releasing to prod from non-main branches (#​378)

Calls to cd.yml must be adjusted to include an additional permission: pull-requests: read, otherwise the workflow will fail with the following error:

Invalid workflow file: ...
The workflow is not valid. .github/workflows/publish.yaml (...): Error calling workflow 'grafana/plugin-ci-workflows/.github/workflows/cd.yml@.... The workflow is requesting 'pull-requests: read', but is only allowed 'pull-requests: none'.

Example on the required changes to cd.yml:

jobs:
  cd:
    name: CD
    uses: grafana/plugin-ci-workflows/.github/workflows/cd.yml@main
    permissions:
      contents: write
+     pull-requests: read
      id-token: write
      attestations: write

---

🎉 Features

• cd: allow releasing to prod from non-main branches (#​378) (e1cf5f6)
• ci: add warning when ci and cd workflows are not on the same reference (#​492) (4e9ca04)
• ci: support react image in e2e matrix (#​496) (6d8cb8c)
• playwright: remove version and image arguments (#​507) (f70e822)

✅ Tests

• act: add gcom mock, cd.yml changes for testing (#​501) (e3f1779)
• act: fix validator tests (#​506) (3c93dda)

🔧 Chores

• ci: run golangci-lint on internal go packages (#​485) (303148f)
• deps: update actions/attest-build-provenance action to v3.1.0 (#​484) (ba9c56e)
• deps: update actions/cache action to v5 (#​481) (3eaee5a)
• deps: update stefanzweifel/git-auto-commit-action action to v7.1.0 (#​483) (f9a22aa)
• deps: update step-security/harden-runner action to v2.14.0 (#​477) (cdab179)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.