chore(deps): update aquaproj/aqua-installer action to v4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aquaproj/aqua-installer	action	major	v3.1.2 → v4.1.0

---

Release Notes

aquaproj/aqua-installer (aquaproj/aqua-installer)

v4.1.0

Compare Source

SHA256 Checksum

4d3e513d42f425609c1ead6ecd40b9c62492011979dfe23d7012428a59efbe82  aqua-installer

Features

#​951 Add the packages input to install only specified packages

aqua >= v2.64.0 is required.

- uses: aquaproj/aqua-installer@82d0e83878a8657c4a6f2ff1755d3bfbfc67f329 # v4.1.0
  with:
    aqua_version: v2.64.0
    packages: |
      ghalint # Command names
      suzuki-shunsuke/tfcmt # Package names
- run: ghalint run

By default, aqua-installer runs aqua i -l, so tools are installed by lazy install when they are first run.
This has some problems:

1. Without a GitHub access token, lazy install can fail because of the GitHub API rate limit
2. Lazy install logs are mixed into the command output and become noise. This is confusing especially when a tool such as github-comment posts the output of a failed command to the pull request
3. If a GitHub access token is passed to avoid the rate limit, the token is also passed to commands that don't need it, which increases the risk of leaking it

A common workaround is to run each command with --version first to trigger lazy install, but the token is still passed to the command, it's hard to understand why the command is run, and you have to add a step for every command.

With the packages input, only the specified packages are installed up front rather than by lazy install, so you don't need to pass a GitHub access token when running them.

• Names are separated by whitespace or newlines
• Empty lines and text after # are ignored
• If packages is set and aqua_opts is the default value -l, -l isn't passed to aqua i, because -l skips installing packages

Others

#​954 Update the bootstrap version to v2.64.0

v4.0.5

Compare Source

SHA256 Checksum

451028d56959cc738564885b1dbebc2691ea038ffde04e2472e4d486a3591146  aqua-installer

Fixes

#​932 Add --force flag @​ianlewis

Others

#​935 Update the bootstrap version to v2.60.1

v4.0.4

Compare Source

Pull Requests aquaproj/aqua-installer@v4.0.3...v4.0.4

SHA256 Checksum

acd21cbb06609dd9a701b0032ba4c21fa37b0e3b5cc4c9d721cc02f25ea33a28  aqua-installer

---

#​886 Configure export-ignore in .gitattributes
#​887 Update the bootstrap version of aqua to v2.55.1

v4.0.3

Compare Source

🛡️ Starting from this release, Immutable Release is enabled!

SHA256 Checksum

d76bb5c3a23025e9d344aeba04c0a4d4ed6c9fb05e85530c8c3be2ef8e8f3a6a  aqua-installer

#​867 Update the bootstrap aqua version to v2.53.10

v4.0.2

Compare Source

SHA256 Checksum

98b883756cdd0a6807a8c7623404bfc3bc169275ad9064dc23a6e24ad398f43d  aqua-installer

Improvement

#​839 Use curl's --retry option: curl --retry 5

v4.0.1

Compare Source

SHA256 Checksum

42d5b4496020dc97856f5694cfb592ba80949d4918661fd062a5b0bb05d570ce  aqua-installer

Improvement

#​835 Update the bootstrap version of aqua to v2.53.3

As of aqua v2.53.0, aqua supported retrying download of assets.
This update enables aqua-installer to retry download of aqua.

v4.0.0

Compare Source

SHA256 Checksum

f7fa69dacb234ce9648f3008cef9120a1e59d96c37971e747668c0fada7bec68  aqua-installer

⚠️ Breaking Changes

#​822 If you pass a GitHub Access token via environment variable env, it would be overridden by the input github_token.

uses: aquaproj/aqua-installer@v2.0.0
env:
  GITHUB_TOKEN: ${{secrets.PAT}} # This is overridden by ${{github.token}}

How to migrate

Pass a GitHub access token by the input github_token.

uses: aquaproj/aqua-installer@v2.0.0
with:
  github_token: ${{secrets.PAT}}

Why is this breaking change required?

Recently, GitHub updated rate limits for unauthenticated requests.

https://github.blog/changelog/2025-05-08-updated-rate-limits-for-unauthenticated-requests/

As a result, aqua-installer often hits the API rate limit if a GitHub access token isn't passed via environment variable.

e.g. https://github.com/szksh-lab/.github/actions/runs/15082243052/job/42400373723

time="2025-05-17T05:48:24Z" level=error msg="install the registry" aqua_version=2.51.2 env=linux/amd64 error="get a file by Get GitHub Content API: status code 429" program=aqua registry_name=standard
time="2025-05-17T05:48:24Z" level=fatal msg="aqua failed" aqua_version=2.51.2 env=linux/amd64 error="it failed to install some registries" program=aqua

It failed to download the standard registry by GitHub content API.

To resolve the issue, we pass a GitHub actions token by default.
And we add the input github_token to allow you to change the access token.

Features

#​822 The input github_token is added.
You can pass a GitHub access token by input.
By default, GitHub Actions token ${{github.token}} is passed.

Others

#​823 chore: update the bootstrap version to v2.51.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Plan Result (koyashiro.jp)

CI link

No changes. Your infrastructure matches the configuration.

[github-actions]

Plan Result (koyashiro.me)

CI link

No changes. Your infrastructure matches the configuration.

[github-actions]

❌ Plan Failed (koyashiro.sh)

CI link

Error: Authentication error (10000)

  with cloudflare_record.cname_root,
  on dns_records.tf line 1, in resource "cloudflare_record" "cname_root":
   1: resource "cloudflare_record" "cname_root" {


Error: Authentication error (10000)

  with cloudflare_record.cname_dotfiles,
  on dns_records.tf line 9, in resource "cloudflare_record" "cname_dotfiles":
   9: resource "cloudflare_record" "cname_dotfiles" {


Error: Authentication error (10000)

  with cloudflare_record.txt_spf,
  on dns_records.tf line 17, in resource "cloudflare_record" "txt_spf":
  17: resource "cloudflare_record" "txt_spf" {


Error: Authentication error (10000)

  with cloudflare_record.txt_dkim,
  on dns_records.tf line 25, in resource "cloudflare_record" "txt_dkim":
  25: resource "cloudflare_record" "txt_dkim" {


Error: Authentication error (10000)

  with cloudflare_record.txt_dmarc,
  on dns_records.tf line 33, in resource "cloudflare_record" "txt_dmarc":
  33: resource "cloudflare_record" "txt_dmarc" {


Error: Authentication error (10000)

  with cloudflare_record.txt_keybase_site_verification,
  on dns_records.tf line 41, in resource "cloudflare_record" "txt_keybase_site_verification":
  41: resource "cloudflare_record" "txt_keybase_site_verification" {

[github-actions]

Plan Result (cdn.koyashiro.net)

CI link

No changes. Your infrastructure matches the configuration.

[github-actions]

Plan Result (koyashi.ro)

CI link

No changes. Your infrastructure matches the configuration.

[github-actions]

❌ Plan Failed (koyashiro.com)

CI link

Error: Error acquiring the state lock

Error message: workspace already locked (lock ID: "koyashiro/koyashiro-com")
Lock Info:
  ID:        d68ba241-c448-0d47-7077-002c3548d8e3
  Path:      
  Operation: OperationTypePlan
  Who:       runner@runnervm7b5n9
  Version:   1.12.2
  Created:   2026-06-23 04:48:29.838426517 +0000 UTC
  Info:      


Terraform acquires a state lock to protect the state from being written
by multiple users at the same time. Please resolve the issue above and try
again. For most commands, you can disable locking with the "-lock=false"
flag, but this is not recommended.

[github-actions]

❌ Plan Failed (vpm.koyashiro.net)

CI link

Error: Error acquiring the state lock

Error message: workspace already locked (lock ID:
"koyashiro/vpm-koyashiro-net")
Lock Info:
  ID:        3fe68f1a-e1bc-bf20-8ead-adda15ac156e
  Path:      
  Operation: OperationTypePlan
  Who:       runner@runnervmf2e7y
  Version:   1.12.2
  Created:   2025-11-03 17:48:49.45175426 +0000 UTC
  Info:      


Terraform acquires a state lock to protect the state from being written
by multiple users at the same time. Please resolve the issue above and try
again. For most commands, you can disable locking with the "-lock=false"
flag, but this is not recommended.

[github-actions]

❌ Plan Failed (koyashiro.net)

CI link

Error: Error acquiring the state lock

Error message: workspace already locked (lock ID: "koyashiro/koyashiro-net")
Lock Info:
  ID:        e46f7910-68fc-8568-cc8d-5aca6c242f4f
  Path:      
  Operation: OperationTypePlan
  Who:       runner@runnervm7b5n9
  Version:   1.12.2
  Created:   2026-06-23 04:48:27.68494964 +0000 UTC
  Info:      


Terraform acquires a state lock to protect the state from being written
by multiple users at the same time. Please resolve the issue above and try
again. For most commands, you can disable locking with the "-lock=false"
flag, but this is not recommended.

[github-actions]

Plan Result (koyashiro.dev)

CI link

No changes. Your infrastructure matches the configuration.

[github-actions]

❌ Plan Failed (koyashiro.live)

CI link

Error: Error acquiring the state lock

Error message: workspace already locked (lock ID: "koyashiro/koyashiro-live")
Lock Info:
  ID:        c6c1ae15-4f51-6fc3-1f12-b48412827110
  Path:      
  Operation: OperationTypePlan
  Who:       runner@runnervmf2e7y
  Version:   1.12.2
  Created:   2025-11-03 17:48:49.102767648 +0000 UTC
  Info:      


Terraform acquires a state lock to protect the state from being written
by multiple users at the same time. Please resolve the issue above and try
again. For most commands, you can disable locking with the "-lock=false"
flag, but this is not recommended.