chore(deps): update actions/cache action to v6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	major	v5 → v6

---

Release Notes

actions/cache (actions/cache)

v6.0.0

Compare Source

What's Changed

• Update packages, migrate to ESM by @​Samirat in #​1760

Full Changelog: actions/cache@v5...v6.0.0

v6

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Chores
  • Updated CI/CD infrastructure to use newer versions of cache management tools, improving build reliability and performance.

[coderabbitai]

📝 Walkthrough

Walkthrough

Two GitHub Actions configuration files have actions/cache updated from v5 to v6: the "Restore artifact cache" step in .github/actions/artifact-cache/action.yml and the "Cache pip (LLM requirements)" step in .github/workflows/agents-auto-pilot.yml.

Changes

Cache Action Version Bump

Layer / File(s)	Summary
Bump actions/cache to v6 in CI configs .github/actions/artifact-cache/action.yml, .github/workflows/agents-auto-pilot.yml	The actions/cache reference is changed from @v5 to @v6 in the artifact-cache restore step and the agents-auto-pilot pip cache step.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the main change: updating the actions/cache GitHub Action from v5 to v6 across multiple files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/actions-cache-6.x

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[agents-workflows-bot]

Workflow source needed

PR #651 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/agents-auto-pilot.yml:
- Line 225: The modification to the actions/cache version pin in the
agents-auto-pilot.yml file should not be made locally since this workflow file
is automatically synced from the upstream stranske/Workflows repository where
the same line still pins v5. Instead, revert the local change to this file and
apply the actions/cache version update in the stranske/Workflows repository
first, then allow the sync mechanism to update this consumer repository with the
change. Do not modify agents-*.yml workflow files directly in the consumer repo.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e620a757-979a-4a57-921f-66b7def58508

📥 Commits

Reviewing files that changed from the base of the PR and between 9a3f583 and 5e49f57.

📒 Files selected for processing (2)

• .github/actions/artifact-cache/action.yml
• .github/workflows/agents-auto-pilot.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)
• stranske/Template (auto-detected)

📜 Review details

🧰 Additional context used

📓 Path-based instructions (6)

{pyproject.toml,.github/workflows/**/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Ensure coverage threshold settings in pyproject.toml [tool.coverage.report] fail_under match the coverage-min settings in workflow files to prevent threshold conflicts

Files:

• .github/workflows/agents-auto-pilot.yml

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For startup_failure GitHub Actions workflow errors, verify YAML syntax validity, avoid permissions: block on workflow_call reusable workflows, and check for circular workflow references

Files:

• .github/workflows/agents-auto-pilot.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Use @main reference for reusable workflows from stranske/Workflows unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-auto-pilot.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

agents-*.yml workflow files should be fixed in stranske/Workflows, not locally in the consumer repo

Files:

• .github/workflows/agents-auto-pilot.yml

**/.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

**/.github/workflows/*.yml: Most workflow logic for this repository should live in stranske/Workflows, not in the consumer repo. Only carry repo-specific configuration unless explicitly documented otherwise.
Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-auto-pilot.yml

**/.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (AGENTS.md)

agents-*.yml workflow files should be fixed in stranske/Workflows, not locally in the consumer repo.

Files:

• .github/workflows/agents-auto-pilot.yml

🔀 Multi-repo context stranske/Workflows, stranske/Template

Now I have enough context. Let me create a final summary document with the key findings:

Linked repositories findings

stranske/Workflows (upstream repository)

Critical Finding - Incomplete Migration:
The Workflows repository still contains 12 instances of actions/cache@v5 across 4 files that are NOT included in this PR update [::stranske/Workflows::]:

• .github/workflows/health-42-actionlint.yml:87,106 — 2 instances
• .github/workflows/maint-52-validate-workflows.yml:27 — 1 instance
• .github/workflows/reusable-10-ci-python.yml:470,872,1193,1406,1547,1853,1867 — 7 instances
• .github/workflows/reusable-agents-verifier.yml:670,979 — 2 instances

Syncing Relationships:

• .github/actions/artifact-cache/ is explicitly listed in the sync-manifest as a synced directory to consumer repos [::stranske/Workflows::]
• agents-auto-pilot.yml is also listed in sync-manifest and synced to consumer repos [::stranske/Workflows::]
• Consumer repo templates at ./templates/consumer-repo/ contain the same 2 files being updated in this PR, both currently still referencing v5 [::stranske/Workflows::]

stranske/Template (consumer/mirror repository)

Files Modified in This PR:

1. .github/actions/artifact-cache/action.yml:62 — Updates actions/cache@v5 to v6 [::stranske/Template::]
2. .github/workflows/agents-auto-pilot.yml:225 — Updates pinned SHA for actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 to v6 [::stranske/Template::]

Upstream Sync Relationship:

• Template syncs from Workflows repository (recent commit: 2cf5ba5 chore: sync workflow templates from Workflows repo (#859)) [::stranske/Template::]
• Both files being updated are synchronized from Workflows, not locally maintained [::stranske/Template::]

Risk Analysis:

• The artifact-cache action is used by multiple workflows in the ecosystem (maint-coverage-guard.yml, agents-weekly-metrics.yml, reusable-10-ci-python.yml reference it indirectly)
• The artifact-cache.js script in the action has no v5-specific code and should be compatible with v6 [::stranske/Workflows::]

---

🔇 Additional comments (1)

.github/actions/artifact-cache/action.yml (1)

62-62: 📐 Maintainability & Code Quality

This file is not synchronized from upstream; it's maintained independently in this repository.

Inv-Man-Intake is not listed in the Workflows repository's sync-manifest and does not sync from stranske/Workflows. This is an independent repository, so the v6 update here is a local change with no sync contract to break. The recommendation to first update Workflows doesn't apply to this repo.

			> Likely an incorrect or invalid review comment.

[coderabbitai]

📐 Maintainability & Code Quality | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check if agents-auto-pilot.yml exists and get its content around line 225
if [ -f ".github/workflows/agents-auto-pilot.yml" ]; then
  echo "=== agents-auto-pilot.yml exists ==="
  sed -n '220,230p' .github/workflows/agents-auto-pilot.yml | cat -n
else
  echo "agents-auto-pilot.yml not found"
fi

# Look for sync configuration/manifest files
echo -e "\n=== Looking for sync configuration ==="
find . -name "*sync*" -o -name "*manifest*" | head -20

Repository: stranske/Inv-Man-Intake

Length of output: 1004

---

🏁 Script executed:

#!/bin/bash
# Check if agents-auto-pilot.yml exists in Workflows
if [ -f ".github/workflows/agents-auto-pilot.yml" ]; then
  echo "=== Workflows/agents-auto-pilot.yml exists ==="
  sed -n '220,230p' .github/workflows/agents-auto-pilot.yml | cat -n
else
  echo "agents-auto-pilot.yml not found in Workflows"
fi

# Look for sync manifest in Workflows
echo -e "\n=== Looking for sync configuration ==="
find . -name "*sync*" -o -name "*manifest*" | head -20

Repository: stranske/Workflows

Length of output: 1697

---

🏁 Script executed:

#!/bin/bash
# Read the sync-manifest to understand which files are synced
cat .github/sync-manifest.yml | grep -A 5 -B 5 "agents-auto-pilot"

Repository: stranske/Workflows

Length of output: 2992

---

Do not patch agents-*.yml locally; update upstream Workflows repo first.

Line 225 changes a synchronized agents-auto-pilot.yml workflow in the consumer repo. This file is actively synced from stranske/Workflows (per sync-manifest), where the same line still pins v5. Updating it locally will be overwritten on the next sync.

Fix this in stranske/Workflows first, then sync down. As per coding guidelines: "agents-*.yml workflow files should be fixed in stranske/Workflows, not locally in the consumer repo."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/agents-auto-pilot.yml at line 225, The modification to the
actions/cache version pin in the agents-auto-pilot.yml file should not be made
locally since this workflow file is automatically synced from the upstream
stranske/Workflows repository where the same line still pins v5. Instead, revert
the local change to this file and apply the actions/cache version update in the
stranske/Workflows repository first, then allow the sync mechanism to update
this consumer repository with the change. Do not modify agents-*.yml workflow
files directly in the consumer repo.

Sources: Coding guidelines, Linked repositories

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/artifact-cache/action.yml:
- Line 62: This file is synced from the upstream stranske/Workflows repository
and should not be updated locally. Instead, navigate to the upstream Workflows
repository and update all instances of actions/cache@v5 to actions/cache@v6
across the files mentioned: health-42-actionlint.yml (2 instances),
maint-52-validate-workflows.yml (1 instance), reusable-10-ci-python.yml (7
instances), and reusable-agents-verifier.yml (2 instances). Once all 12
instances in the upstream repository are updated consistently to v6, sync those
changes back to this consumer repository rather than making local modifications
that will be overwritten on the next sync.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 88e6e96f-b1c0-4da1-9e8c-0442433a12bf

📥 Commits

Reviewing files that changed from the base of the PR and between 5e49f57 and d45bb5b.

📒 Files selected for processing (2)

• .github/actions/artifact-cache/action.yml
• .github/workflows/agents-auto-pilot.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)
• stranske/Template (auto-detected)

📜 Review details

🧰 Additional context used

📓 Path-based instructions (6)

{pyproject.toml,.github/workflows/**/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Ensure coverage threshold settings in pyproject.toml [tool.coverage.report] fail_under match the coverage-min settings in workflow files to prevent threshold conflicts

Files:

• .github/workflows/agents-auto-pilot.yml

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For startup_failure GitHub Actions workflow errors, verify YAML syntax validity, avoid permissions: block on workflow_call reusable workflows, and check for circular workflow references

Files:

• .github/workflows/agents-auto-pilot.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Use @main reference for reusable workflows from stranske/Workflows unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-auto-pilot.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

agents-*.yml workflow files should be fixed in stranske/Workflows, not locally in the consumer repo

Files:

• .github/workflows/agents-auto-pilot.yml

**/.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

**/.github/workflows/*.yml: Most workflow logic for this repository should live in stranske/Workflows, not in the consumer repo. Only carry repo-specific configuration unless explicitly documented otherwise.
Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-auto-pilot.yml

**/.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (AGENTS.md)

agents-*.yml workflow files should be fixed in stranske/Workflows, not locally in the consumer repo.

Files:

• .github/workflows/agents-auto-pilot.yml

🔀 Multi-repo context stranske/Workflows, stranske/Template

Based on the previous research provided, I can see thorough exploration has already been conducted across the linked repositories. Let me structure the findings in the required output format:

Linked repositories findings

stranske/Workflows (upstream repository)

Incomplete Migration - Inconsistent Version Updates:
The Workflows repository contains 12 additional instances of actions/cache@v5 across 4 files that are NOT included in this PR update [::stranske/Workflows::]:

• .github/workflows/health-42-actionlint.yml:87,106 — 2 instances
• .github/workflows/maint-52-validate-workflows.yml:27 — 1 instance
• .github/workflows/reusable-10-ci-python.yml:470,872,1193,1406,1547,1853,1867 — 7 instances
• .github/workflows/reusable-agents-verifier.yml:670,979 — 2 instances

Sync Governance Issue:
Both files being updated in this PR (.github/actions/artifact-cache/ and agents-auto-pilot.yml) are explicitly listed in the sync-manifest as synced directories to consumer repositories [::stranske/Workflows::]. Template repositories at ./templates/consumer-repo/ currently reference v5 versions of both files [::stranske/Workflows::].

stranske/Template (consumer/mirror repository)

Files Being Modified:

1. .github/actions/artifact-cache/action.yml:62 — Updates actions/cache@v5 to v6 [::stranske/Template::]
2. .github/workflows/agents-auto-pilot.yml:225 — Updates pinned SHA for actions/cache@v5 to v6 [::stranske/Template::]

Upstream Dependency:
Both files are synchronized from the Workflows repository, not locally maintained [::stranske/Template::]. This means the Template repo will pull these v6 updates on next sync, but will continue to receive v5 references from the 12 unupdated locations in Workflows.

Cross-Repo Risk:
The artifact-cache action is referenced indirectly by multiple workflows across the ecosystem (maint-coverage-guard.yml, agents-weekly-metrics.yml, reusable-10-ci-python.yml), creating potential for inconsistent caching behavior if some workflows pin v5 while others use v6 [::stranske/Workflows::].

---

🔇 Additional comments (1)

.github/workflows/agents-auto-pilot.yml (1)

225-225: Previously flagged: Update in upstream Workflows repository.

This concern has already been raised in a previous review. As noted, agents-auto-pilot.yml is synced from stranske/Workflows and should be updated there first, not locally in the consumer repo.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Do not update synced files locally; fix in upstream Workflows repository first.

This action file is synced from stranske/Workflows and should be updated there, not in the consumer repo. Additionally, the linked repository research shows 12 other actions/cache@v5 instances in the Workflows repository that are not included in this update:

• health-42-actionlint.yml (2 instances)
• maint-52-validate-workflows.yml (1 instance)
• reusable-10-ci-python.yml (7 instances)
• reusable-agents-verifier.yml (2 instances)

This incomplete migration creates version inconsistency across your caching infrastructure, with some workflows using v6 while others remain on v5. The next sync from Workflows will overwrite this local change back to v5, creating churn.

Resolution: Apply the v6 update in the upstream stranske/Workflows repository across all cache action instances, then sync to consumer repos.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/artifact-cache/action.yml at line 62, This file is synced
from the upstream stranske/Workflows repository and should not be updated
locally. Instead, navigate to the upstream Workflows repository and update all
instances of actions/cache@v5 to actions/cache@v6 across the files mentioned:
health-42-actionlint.yml (2 instances), maint-52-validate-workflows.yml (1
instance), reusable-10-ci-python.yml (7 instances), and
reusable-agents-verifier.yml (2 instances). Once all 12 instances in the
upstream repository are updated consistently to v6, sync those changes back to
this consumer repository rather than making local modifications that will be
overwritten on the next sync.

Sources: Coding guidelines, Linked repositories

[stranske]

Closing as superseded: superseded by stranske/Workflows#2520, which updates actions/cache v6 in the Workflows source/template before Maint 68 syncs consumers. Direct consumer PRs for synced workflow files would create ownership drift; the replacement should come from the Workflows source PR and the next Maint 68 sync wave.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 6.x releases. But if you manually upgrade to 6.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.