Chore: Actions updates and cleanup - #8377
Merged
Merged
Conversation
- actions/checkout v5 -> v6 - actions/setup-node v4/v5 -> v6 - actions/setup-python v4/v5 -> v6 - actions/upload-artifact v4 -> v6 - actions/download-artifact v4 -> v7 - actions/cache v4 -> v5 - actions/github-script v7 -> v8 - peter-evans/create-pull-request SHA/v7 -> v8 - peter-evans/find-comment SHA -> v4 - peter-evans/create-or-update-comment SHA -> v5 - chromaui/action latest -> v13 - dawidd6/action-download-artifact v11 -> v12 - shimataro/ssh-key-action SHA -> v2 - softprops/action-gh-release SHA -> v2 - pypa/gh-action-pypi-publish SHA -> v1 - anthropics/claude-code-action v1.0.6 -> v1 - Standardized pnpm/action-setup to v4 Amp-Thread-ID: https://ampcode.com/threads/T-019c03e2-7e02-7209-8931-ec36a0fa6ea7 Co-authored-by: Amp <amp@ampcode.com>
- Fix setup-frontend action to save cache (not just restore) - Standardize 6 workflows to use setup-frontend composite action - Remove unnecessary checkout from draft_release job - Remove checkout from merge-reports job (only needs pnpm dlx) - Reduce fetch-depth in weekly-docs-check (0 -> 50) Amp-Thread-ID: https://ampcode.com/threads/T-019c03f5-8ea2-7192-b2f1-f89a78402bec Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019c05aa-cb7c-72d8-9204-09a3418c1e42 Co-authored-by: Amp <amp@ampcode.com>
Contributor
📝 WalkthroughWalkthroughBumps and pins GitHub Action versions across many workflows, consolidates frontend setup into a local setup action, adds Pinact configuration for validating/pinning action SHAs, adds a YAML lint rule for comment spacing, and ensures LF endings for Changes
Possibly related PRs
Suggested reviewers
Comment |
🎨 Storybook Build Status✅ Build completed successfully! ⏰ Completed at: 01/29/2026, 04:59:33 AM UTC 🔗 Links🎉 Your Storybook is ready for review! |
🎭 Playwright Tests: ✅ PassedResults: 507 passed, 0 failed, 0 flaky, 8 skipped (Total: 515) 📊 Browser Reports
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
Bundle Size ReportSummary
Category Glance Per-category breakdownApp Entry Points — 26 kB (baseline 26 kB) • ⚪ 0 BMain entry bundles and manifests
Status: 1 added / 1 removed Graph Workspace — 973 kB (baseline 973 kB) • ⚪ 0 BGraph editor runtime, canvas, workflow orchestration
Status: 1 added / 1 removed Views & Navigation — 80.7 kB (baseline 80.7 kB) • ⚪ 0 BTop-level views, pages, and routed surfaces
Status: 9 added / 9 removed Panels & Settings — 471 kB (baseline 471 kB) • 🟢 -8 BConfiguration panels, inspectors, and settings screens
Status: 12 added / 12 removed User & Accounts — 3.94 kB (baseline 3.94 kB) • ⚪ 0 BAuthentication, profile, and account management bundles
Status: 3 added / 3 removed Editors & Dialogs — 2.89 kB (baseline 2.89 kB) • ⚪ 0 BModals, dialogs, drawers, and in-app editors
Status: 2 added / 2 removed UI Components — 33.7 kB (baseline 33.7 kB) • ⚪ 0 BReusable component library chunks
Status: 4 added / 4 removed Data & Services — 2.7 MB (baseline 2.7 MB) • 🔴 +1 BStores, services, APIs, and repositories
Status: 8 added / 8 removed Utilities & Hooks — 25.3 kB (baseline 25.3 kB) • ⚪ 0 BHelpers, composables, and utility bundles
Status: 7 added / 7 removed Vendor & Third-Party — 10.7 MB (baseline 10.7 MB) • ⚪ 0 BExternal libraries and shared vendor chunks
Other — 7.05 MB (baseline 7.05 MB) • 🟢 -198 BBundles that do not match a named category
Status: 34 added / 34 removed |
Pin all third-party actions to full-length commit SHAs instead of mutable tags for supply chain security. Tags can be updated by maintainers, potentially injecting malicious code with access to repository secrets. Actions pinned: - pnpm/action-setup (v4.2.0) - peter-evans/create-pull-request (v8.1.0) - peter-evans/find-comment (v4.0.0) - peter-evans/create-or-update-comment (v5.0.0) - pypa/gh-action-pypi-publish (v1.12.4) - dawidd6/action-download-artifact (v12) - juliangruber/read-file-action (v1.1.7) - actions-cool/maintain-one-comment (v3.2.0) - shimataro/ssh-key-action (v2.7.0) - chromaui/action (v13) - anthropics/claude-code-action (v1.0) Each pinned action includes a version comment for human readability. Amp-Thread-ID: https://ampcode.com/threads/T-019c0675-10a1-700b-a684-e39adde310e7 Co-authored-by: Amp <amp@ampcode.com>
Validates that all third-party GitHub Actions are pinned to commit SHAs on PRs that modify workflow files. Amp-Thread-ID: https://ampcode.com/threads/T-019c0675-10a1-700b-a684-e39adde310e7 Co-authored-by: Amp <amp@ampcode.com>
snomiao
suggested changes
Jan 29, 2026
| uses: actions/cache/restore@v4 | ||
| # Cache tool outputs (restore on start, save on completion) | ||
| - name: Cache tool outputs | ||
| uses: actions/cache@v5 |
Contributor
There was a problem hiding this comment.
this line changed the meaning of code
maybe one of:
- explain why still it works after cache/restore=> cache
- move to another PR to keep this PR do only tidy work?
Contributor
There was a problem hiding this comment.
We have migrated from actions/cache save+restore , to artifact upload/download in this Commit
3372f455c#diff-13dfc4899b42a67d2bcdbffdadd0a684eb2002473c705acd75065f0dfe6a32d3L34
so its prob safe to remove the restore step completely here :D , as we are not saving any cache here, its identical
WDYT @DrJKL
Contributor
There was a problem hiding this comment.
where do pinact run?
- do we need to pnpm install -d or add to package.json?
- does CI runs it?
Contributor
Author
There was a problem hiding this comment.
You can install it locally, or it'll run as an action when the actions/workflows or the config are changed (to validate, not to update)
Contributor
There was a problem hiding this comment.
got it!, it runs here
.github/workflows/ci-validate-action-pins.yaml
snomiao
reviewed
Jan 29, 2026
| @@ -0,0 +1,24 @@ | |||
| # pinact configuration | |||
| # https://github.com/suzuki-shunsuke/pinact | |||
Contributor
There was a problem hiding this comment.
got it!
it runs by .github/workflows/ci-validate-action-pins.yaml
snomiao
self-requested a review
January 29, 2026 01:27
DrJKL
marked this pull request as ready for review
January 29, 2026 04:26
dosubot
Bot
added
the
size:L
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/actions/setup-comfyui-server/action.yaml (1)
29-32: Update the stale checkout version in the error message.
The action usesactions/checkout@v6(line 19), but the error message at line 31 still references v5. Remove the version to keep the message version-agnostic and prevent future drift.🔧 Proposed fix
- echo "::error::Please ensure you have run 'actions/checkout@v5' before calling this action." + echo "::error::Please ensure you have run 'actions/checkout' before calling this action."
🤖 Fix all issues with AI agents
In @.github/workflows/ci-tests-e2e-forks.yaml:
- Around line 33-34: The workflow upgrade to actions/checkout@v6,
actions/github-script@v8, and actions/download-artifact@v7 introduces breaking
changes (credentials now stored under $RUNNER_TEMP and Node 24 runtime) so
update CI to either pin compatible action versions or ensure runners meet
minimum versions and remove any logic that parses .git/config for auth;
specifically, review uses of actions/checkout@v6, actions/github-script@v8, and
actions/download-artifact@v7, replace or pin them to earlier compatible tags if
you cannot guarantee runner v2.329.0+ (for checkout) and v2.327.1+ (for
github-script/download-artifact), and refactor any scripts that read .git/config
to instead read credentials from the new $RUNNER_TEMP location or use GitHub
Actions-provided environment variables for authentication.
In @.github/workflows/ci-yaml-validation.yaml:
- Around line 20-25: The workflow uses actions/checkout@v6 and
actions/setup-python@v6 which introduce breaking changes; either pin to the last
known-compatible releases (e.g., replace actions/checkout@v6 with
actions/checkout@v5 and actions/setup-python@v4) or ensure the CI runner is
upgraded to the required versions (GitHub Actions Runner v2.329.0+ for checkout
and v2.327.1+ for setup-python) and adapt checkout usage (e.g., explicitly set
persist-credentials if your tools expect credentials in .git/config). Update the
two uses: the lines referencing actions/checkout@v6 and actions/setup-python@v6
accordingly, and add a note or check in your CI configuration to verify runner
version if you choose to keep v6.
In @.github/workflows/release-biweekly-comfyui.yaml:
- Around line 63-84: The Setup Node.js steps using actions/setup-node@v6 are
missing explicit pnpm caching; update the Setup Node.js `with:` blocks (the
steps named "Setup Node.js" in the resolve-version job and the create-comfyui-pr
job) to include `cache: pnpm` alongside the existing `node-version` key so pnpm
dependencies are cached by the action.
In @.github/workflows/release-draft-create.yaml:
- Around line 73-76: The workflow step named "Create release" (id
create_release) currently uses the floating tag softprops/action-gh-release@v2;
replace that floating tag with the action's fully-pinned commit SHA
(softprops/action-gh-release@<full-commit-sha>) and add the matching version
comment style used across the repo (e.g., a trailing comment indicating the
release tag/semver) so the step is pinned to an exact commit and conforms to the
repository's pinning policy.
Comment on lines
33
to
+34
| - name: Checkout repository | ||
| uses: actions/checkout@v5 | ||
| uses: actions/checkout@v6 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
actions/checkout v6 release notes breaking changes
💡 Result:
actions/checkout v6 — breaking/behavior-changing notes
- Credentials are no longer written into
.git/configwhenpersist-credentials: true. v6 persists credentials to a separate file under$RUNNER_TEMPinstead (security hardening). This can break workflows/scripts that expect to read auth from.git/config(e.g., custom tooling that parses config rather than just runninggit fetch/push). [1][2] - Runner requirement for Docker container actions: If you run authenticated git commands from a Docker container action, you need GitHub Actions Runner v2.329.0+. (Workflows that rely on this on older/self-hosted runners may fail.) [1]
- General upgrade note: The project’s stated intent is that no workflow changes are required for normal git usage (
git fetch,git push, etc. should still work). [1]
Sources:
[1] actions/checkout README (“Checkout v6 / What’s new”)
[2] v6.0.0 release notes (includes “Persist creds to a separate file”)
🌐 Web query:
actions/github-script v8 release breaking changes
💡 Result:
actions/github-script@v8 has one explicit breaking change:
- Runtime bumped to Node.js 24 (from Node.js 20 in v7). Any breaking changes between Node 20 → 24 can affect your
script(language/runtime behavior and bundled dependencies). [1][2] - Minimum required GitHub Actions runner version: v2.327.1 (relevant for self-hosted runners; upgrade if you pin runner versions). [1][2]
No other v8-specific breaking API surface changes are called out in the project’s breaking-changes notes beyond the Node 24 runtime/runner requirement. [1]
🌐 Web query:
actions/download-artifact v7 release breaking changes
💡 Result:
For actions/download-artifact@v7, the breaking change called out in the release docs is:
- Runtime upgrade to Node.js 24 (
runs.using: node24). This requires GitHub Actions Runner >=2.327.1—so older self-hosted runners must be updated before upgrading to@v7, or the action can fail to run. [1]
Source: [1]
Verify GitHub Actions version upgrades for breaking changes.
The version bumps have confirmed breaking changes:
- actions/checkout@v6: Credentials are no longer stored in
.git/config; they're now persisted to a separate file under$RUNNER_TEMP. Workflows or scripts that parse.git/configfor authentication will break. Also requires runner v2.329.0+ for authenticated git commands from Docker containers. - actions/github-script@v8: Runtime bumped to Node.js 24 (from v20). This can introduce breaking changes in your
scriptblock; requires runner v2.327.1+. - actions/download-artifact@v7: Runtime upgraded to Node.js 24; requires runner v2.327.1+.
Ensure your GitHub Actions runners meet the minimum version requirements and that workflows do not depend on credential storage in .git/config.
🤖 Prompt for AI Agents
In @.github/workflows/ci-tests-e2e-forks.yaml around lines 33 - 34, The workflow
upgrade to actions/checkout@v6, actions/github-script@v8, and
actions/download-artifact@v7 introduces breaking changes (credentials now stored
under $RUNNER_TEMP and Node 24 runtime) so update CI to either pin compatible
action versions or ensure runners meet minimum versions and remove any logic
that parses .git/config for auth; specifically, review uses of
actions/checkout@v6, actions/github-script@v8, and actions/download-artifact@v7,
replace or pin them to earlier compatible tags if you cannot guarantee runner
v2.329.0+ (for checkout) and v2.327.1+ (for github-script/download-artifact),
and refactor any scripts that read .git/config to instead read credentials from
the new $RUNNER_TEMP location or use GitHub Actions-provided environment
variables for authentication.
Contributor
There was a problem hiding this comment.
@DrJKL, understood! I've noted that you're aware of the breaking changes in the upgraded actions and they're acceptable for this workflow.
🧠 Learnings used
Learnt from: Myestery
Repo: Comfy-Org/ComfyUI_frontend PR: 7422
File: .github/workflows/pr-update-playwright-expectations.yaml:131-135
Timestamp: 2025-12-12T23:02:37.473Z
Learning: In the `.github/workflows/pr-update-playwright-expectations.yaml` workflow in the Comfy-Org/ComfyUI_frontend repository, the snapshot update process is intentionally scoped to only add and update snapshot images. Deletions of snapshot files are handled explicitly outside this workflow and should not be suggested as part of this automation.
Comment on lines
+20
to
25
| - uses: actions/checkout@v6 | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.x' |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
actions/checkout v6 release notes breaking changes
💡 Result:
actions/checkout@v6 (released Nov 20, 2025 as v6.0.0) is primarily a credentials-handling change. (github.com)
Breaking / behavior changes to be aware of
persist-credentialsno longer writes auth directly into.git/config. Credentials are now stored in a separate file under$RUNNER_TEMP(improved security). This can break workflows/tools that expect to read credentials from.git/configor copy/inspect the repo’s.git/configto propagate auth. (github.com)- Docker container actions + authenticated git commands: if you run authenticated git commands from inside a Docker container action, you now need GitHub Actions Runner v2.329.0+ for auth to work as expected. (github.com)
What is not breaking for most users
- Normal host-runner git commands (e.g.,
git fetch,git push) generally continue to work without workflow changes, because the action configures git so credentials are still picked up automatically. (github.com)
Citations:
- 1: https://github.com/actions/checkout/releases
- 2: https://github.com/actions/checkout?utm_source=openai
- 3: https://github.com/actions/checkout?utm_source=openai
- 4: https://github.com/actions/checkout?utm_source=openai
🌐 Web query:
actions/setup-python v6 release notes breaking changes
💡 Result:
actions/setup-python v6 (v6.0.0) breaking change
- Action runtime upgraded from Node.js 20 to Node.js 24 (breaking change). [1][2]
- Runner requirement: your GitHub Actions runner must be v2.327.1 or later for compatibility with the Node 24-based action. [1][2]
Release notes: [1]
Docs “Breaking changes in V6”: [2][3]
Sources:
[1] actions/setup-python GitHub Releases (v6.0.0) (github.com)
[2] actions/setup-python README (“Breaking changes in V6”) (github.com)
[3] GitHub Marketplace listing (“Breaking changes in V6”) (github.com)
Citations:
- 1: https://github.com/actions/setup-python/releases
- 2: https://github.com/actions/setup-python?utm_source=openai
- 3: https://github.com/marketplace/actions/setup-python?utm_source=openai
Address breaking changes in actions/checkout@v6 and actions/setup-python@v6.
Both v6 releases introduce breaking changes requiring attention:
-
actions/checkout@v6: Credentials handling changed—
persist-credentialsno longer writes to.git/configbut uses a separate file in$RUNNER_TEMP. This breaks workflows or tools that inspect.git/configfor credentials. Additionally, Docker container actions using authenticated git commands require GitHub Actions Runner v2.329.0+. -
actions/setup-python@v6: Runtime upgraded from Node.js 20 to Node.js 24. Requires GitHub Actions runner v2.327.1 or later for compatibility.
Ensure your GitHub Actions runner version meets these requirements (v2.329.0+ for safety). For non-Docker host-runner workflows, normal git commands generally continue to work, but verify credentials flow is not disrupted.
🤖 Prompt for AI Agents
In @.github/workflows/ci-yaml-validation.yaml around lines 20 - 25, The workflow
uses actions/checkout@v6 and actions/setup-python@v6 which introduce breaking
changes; either pin to the last known-compatible releases (e.g., replace
actions/checkout@v6 with actions/checkout@v5 and actions/setup-python@v4) or
ensure the CI runner is upgraded to the required versions (GitHub Actions Runner
v2.329.0+ for checkout and v2.327.1+ for setup-python) and adapt checkout usage
(e.g., explicitly set persist-credentials if your tools expect credentials in
.git/config). Update the two uses: the lines referencing actions/checkout@v6 and
actions/setup-python@v6 accordingly, and add a note or check in your CI
configuration to verify runner version if you choose to keep v6.
Contributor
There was a problem hiding this comment.
@DrJKL, understood! If you've verified the runner versions are compatible or the credential handling changes don't impact your workflows, then you're all set. 👍
(\_/)
(•_•)
/>📋
🧠 Learnings used
Learnt from: Myestery
Repo: Comfy-Org/ComfyUI_frontend PR: 7422
File: .github/workflows/pr-update-playwright-expectations.yaml:131-135
Timestamp: 2025-12-12T23:02:37.473Z
Learning: In the `.github/workflows/pr-update-playwright-expectations.yaml` workflow in the Comfy-Org/ComfyUI_frontend repository, the snapshot update process is intentionally scoped to only add and update snapshot images. Deletions of snapshot files are handled explicitly outside this workflow and should not be suggested as part of this automation.
Comment on lines
63
to
84
| - name: Checkout ComfyUI_frontend | ||
| uses: actions/checkout@v5 | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
| path: frontend | ||
|
|
||
| - name: Checkout ComfyUI (sparse) | ||
| uses: actions/checkout@v5 | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| repository: Comfy-Org/ComfyUI | ||
| sparse-checkout: | | ||
| requirements.txt | ||
| path: comfyui | ||
|
|
||
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v4 | ||
| uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0 | ||
| with: | ||
| version: 10 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| uses: actions/setup-node@v6 | ||
| with: |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/release-biweekly-comfyui.yaml | sed -n '55,90p'Repository: Comfy-Org/ComfyUI_frontend
Length of output: 1434
🏁 Script executed:
cat -n .github/workflows/release-biweekly-comfyui.yaml | sed -n '165,180p'Repository: Comfy-Org/ComfyUI_frontend
Length of output: 795
🌐 Web query:
actions/checkout v6 release github
💡 Result:
actions/checkout@v6was released asv6.0.0(dated “20 Nov”). Key v6 change: improved credential security—whenpersist-credentials: true, credentials are stored in a separate file under$RUNNER_TEMPinstead of.git/config; most workflows don’t need changes. Also, running authenticated git commands from a Docker container action requires Actions Runnerv2.329.0+. [1]- Most recent v6 patch release shown on GitHub Releases is
v6.0.2(dated “09 Jan”), with changes including: addingorchestration_idto the git user-agent whenACTIONS_ORCHESTRATION_IDis set, and fixing tag handling to preserve annotations / explicitfetch-tags. [2]
Sources: [1] actions/checkout repository (“Checkout v6 / What’s new”), [2] actions/checkout Releases page (v6.0.2 notes).
🌐 Web query:
actions/setup-node v6 release
💡 Result:
actions/setup-node v6.0.0 was released October 14, 2025. Its key breaking change is that automatic caching is now limited to npm (workflows/docs updated accordingly); Yarn/pnpm caching must be explicitly configured (e.g., via the cache input). [1][2][4]
As of January 15, 2026, the latest v6 release is v6.2.0, which is primarily documentation updates plus a dependency update (upgrade @actions/cache to v5.0.1). [3]
🌐 Web query:
pnpm/action-setup commit 41ff72655975bd51cab0327fa583b6e92b6d3061 v4.2.0
💡 Result:
41ff72655975bd51cab0327fa583b6e92b6d3061 is the commit that pnpm/action-setup tags as v4.2.0. In that release, the main change is “feat: support installation from custom NPM registry (#179)”—it copies an existing workspace .npmrc so pnpm respects custom registry settings when the action self-installs pnpm. (Commit timestamp shown: 2025-10-08.) [1]
You’ll often see this version pinned in workflows as pnpm/action-setup v4.2.0@41ff726... (tag + SHA) for supply-chain safety. [2]
Add explicit cache configuration for pnpm with actions/setup-node@v6.
actions/setup-node@v6 removed automatic pnpm caching—it now only caches npm by default. Add cache: pnpm to the Setup Node.js step to preserve dependency caching performance:
Example fix for resolve-version job (line 82-84)
- name: Setup Node.js
uses: actions/setup-node@v6
with:
node-version: lts/*
cache: pnpmApply the same change to the create-comfyui-pr job (line 171-176 region). The v6 tags and pnpm commit hash are correct and supported.
🤖 Prompt for AI Agents
In @.github/workflows/release-biweekly-comfyui.yaml around lines 63 - 84, The
Setup Node.js steps using actions/setup-node@v6 are missing explicit pnpm
caching; update the Setup Node.js `with:` blocks (the steps named "Setup
Node.js" in the resolve-version job and the create-comfyui-pr job) to include
`cache: pnpm` alongside the existing `node-version` key so pnpm dependencies are
cached by the action.
snomiao
previously approved these changes
Jan 29, 2026
DrJKL
changed the title
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/weekly-docs-check.yaml (1)
41-49: Avoid redundant global installs by checking global scope.
pnpm listwithout-gwon’t detect globally installed tools, so this will always reinstall on a fresh runner. Consider checking the global scope to skip unnecessary installs.Proposed tweak
- if ! pnpm list typescript `@vue/compiler-sfc` >/dev/null 2>&1; then + if ! pnpm list -g typescript `@vue/compiler-sfc` >/dev/null 2>&1; then echo "Installing TypeScript and Vue compiler globally..." pnpm install -g typescript `@vue/compiler-sfc` else echo "TypeScript and Vue compiler already available locally" fi
🤖 Fix all issues with AI agents
In @.github/workflows/pr-claude-review.yaml:
- Line 26: The workflow uses mixed pinning strategies (actions/checkout@v6 and
actions/setup-node@v6 versus SHA-pinned pnpm/action-setup and
anthropics/claude-code-action); pick a consistent approach and apply it across
the referenced actions: either replace the floating tags actions/checkout@v6 and
actions/setup-node@v6 with their corresponding commit SHAs to SHA-pin them
(matching the style used for pnpm/action-setup and
anthropics/claude-code-action) or document the intentional policy for using
floating first-party tags in the repo README; update the workflow entries for
actions/checkout and actions/setup-node (and any other occurrences called out)
to follow the chosen strategy.
In @.github/workflows/release-draft-create.yaml:
- Around line 23-26: The pinned SHAs for two GitHub Actions are incorrect;
update the "uses" entries to reference the correct commits for the intended
versions: replace the pnpm/action-setup SHA with
9fd676a19091d4595eefd76e4bd31c97133911f1 (to match v4.2.0) in the
pnpm/action-setup usage, and replace the pypa/gh-action-pypi-publish SHA with
106e0b0b7c337fa67ed433972f777c6357f78598 (to match v1.13.0) in the
pypa/gh-action-pypi-publish usage so the workflow runs the expected releases.
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v5 | ||
| uses: actions/checkout@v6 |
Contributor
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
Consider consistent pinning strategy across all actions.
Currently, actions/checkout and actions/setup-node use floating version tags (v6), while pnpm/action-setup and anthropics/claude-code-action are pinned to specific commit SHAs. For maximum security, consider SHA-pinning all actions consistently—floating tags can be moved by maintainers.
If the team intentionally uses floating tags for first-party GitHub actions (for automatic security patches) while pinning third-party actions, that's a valid strategy—just ensure it's documented.
Also applies to: 32-32, 37-37, 47-47
🤖 Prompt for AI Agents
In @.github/workflows/pr-claude-review.yaml at line 26, The workflow uses mixed
pinning strategies (actions/checkout@v6 and actions/setup-node@v6 versus
SHA-pinned pnpm/action-setup and anthropics/claude-code-action); pick a
consistent approach and apply it across the referenced actions: either replace
the floating tags actions/checkout@v6 and actions/setup-node@v6 with their
corresponding commit SHAs to SHA-pin them (matching the style used for
pnpm/action-setup and anthropics/claude-code-action) or document the intentional
policy for using floating first-party tags in the repo README; update the
workflow entries for actions/checkout and actions/setup-node (and any other
occurrences called out) to follow the chosen strategy.
Comment on lines
23
to
26
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v4 | ||
| uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0 | ||
| with: | ||
| version: 10 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, locate and read the workflow file
cat -n .github/workflows/release-draft-create.yamlRepository: Comfy-Org/ComfyUI_frontend
Length of output: 6021
🏁 Script executed:
#!/bin/bash
# Verify tag->commit mapping for pinned actions via GitHub API
set -euo pipefail
echo "=== Verifying pnpm/action-setup ==="
# Try to get the commit for v4.2.0 tag
curl -s "https://api.github.com/repos/pnpm/action-setup/git/refs/tags/v4.2.0" | python3 -c "import sys, json; data = json.load(sys.stdin); print('v4.2.0 ref:', data.get('object', {}).get('sha', 'N/A'))" 2>/dev/null || echo "Could not fetch pnpm/action-setup tag"
echo ""
echo "=== Verifying softprops/action-gh-release ==="
curl -s "https://api.github.com/repos/softprops/action-gh-release/git/refs/tags/v2.5.0" | python3 -c "import sys, json; data = json.load(sys.stdin); print('v2.5.0 ref:', data.get('object', {}).get('sha', 'N/A'))" 2>/dev/null || echo "Could not fetch softprops/action-gh-release tag"
echo ""
echo "=== Verifying pypa/gh-action-pypi-publish ==="
curl -s "https://api.github.com/repos/pypa/gh-action-pypi-publish/git/refs/tags/v1.13.0" | python3 -c "import sys, json; data = json.load(sys.stdin); print('v1.13.0 ref:', data.get('object', {}).get('sha', 'N/A'))" 2>/dev/null || echo "Could not fetch pypa/gh-action-pypi-publish tag"Repository: Comfy-Org/ComfyUI_frontend
Length of output: 359
Fix pinned SHAs: two actions reference incorrect commits.
The SHA verification reveals mismatches:
- pnpm/action-setup: Pinned SHA
41ff72655975bd51cab0327fa583b6e92b6d3061does not match v4.2.0's actual commit9fd676a19091d4595eefd76e4bd31c97133911f1 - softprops/action-gh-release: Pinned SHA
a06a81a03ee405af7f2048a818ed3f03bbf83c7bcorrectly matches v2.5.0 ✓ - pypa/gh-action-pypi-publish: Pinned SHA
ed0c53931b1dc9bd32cbe73a98c7f6766f8a527edoes not match v1.13.0's actual commit106e0b0b7c337fa67ed433972f777c6357f78598
Update lines 24 and 119 to use the correct SHAs to ensure the intended versions are executed.
🤖 Prompt for AI Agents
In @.github/workflows/release-draft-create.yaml around lines 23 - 26, The pinned
SHAs for two GitHub Actions are incorrect; update the "uses" entries to
reference the correct commits for the intended versions: replace the
pnpm/action-setup SHA with 9fd676a19091d4595eefd76e4bd31c97133911f1 (to match
v4.2.0) in the pnpm/action-setup usage, and replace the
pypa/gh-action-pypi-publish SHA with 106e0b0b7c337fa67ed433972f777c6357f78598
(to match v1.13.0) in the pypa/gh-action-pypi-publish usage so the workflow runs
the expected releases.
AustinMroz
approved these changes
Jan 29, 2026
AustinMroz
left a comment
AustinMroz
left a comment
Collaborator
There was a problem hiding this comment.
There are lines here that change things.
Changes seem healthy and I can always hit the revert button if stuff breaks.
AustinMroz
pushed a commit
that referenced
this pull request
Jan 29, 2026
## Summary Fixes the snapshot merge failure introduced by PR #8377 (actions/download-artifact v4→v7 upgrade). ## Root Cause The v5+ release of `download-artifact` changed behavior: when a `pattern` matches only a **single artifact**, files are extracted directly to `path/` without the artifact name subdirectory. When only one shard had changes, the merge loop couldn't find the expected `snapshots-shard-*/` directories. ## Fix Use `merge-multiple: true` — the documented pattern for combining sharded artifacts. This merges all matched artifacts directly into the target path, eliminating directory structure assumptions. ## Testing This fix can be validated by re-running the workflow on [PR #8276](#8276) after merge. --- - Fixes snapshot update workflow regression from #8377 ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8432-fix-use-merge-multiple-for-snapshot-artifact-download-2f76d73d3650810b97fdfe28cd3c7694) by [Unito](https://www.unito.io) Co-authored-by: Subagent 5 <subagent@example.com> Co-authored-by: Amp <amp@ampcode.com>
christian-byrne
pushed a commit
that referenced
this pull request
Jan 30, 2026
## Summary ... ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8377-WIP-Chore-Actions-updates-and-cleanup-2f66d73d3650818483a8dffa32a6f245) by [Unito](https://www.unito.io) --------- Co-authored-by: Amp <amp@ampcode.com>
christian-byrne
added a commit
that referenced
this pull request
Jan 30, 2026
## Summary Fixes the snapshot merge failure introduced by PR #8377 (actions/download-artifact v4→v7 upgrade). ## Root Cause The v5+ release of `download-artifact` changed behavior: when a `pattern` matches only a **single artifact**, files are extracted directly to `path/` without the artifact name subdirectory. When only one shard had changes, the merge loop couldn't find the expected `snapshots-shard-*/` directories. ## Fix Use `merge-multiple: true` — the documented pattern for combining sharded artifacts. This merges all matched artifacts directly into the target path, eliminating directory structure assumptions. ## Testing This fix can be validated by re-running the workflow on [PR #8276](#8276) after merge. --- - Fixes snapshot update workflow regression from #8377 ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8432-fix-use-merge-multiple-for-snapshot-artifact-download-2f76d73d3650810b97fdfe28cd3c7694) by [Unito](https://www.unito.io) Co-authored-by: Subagent 5 <subagent@example.com> Co-authored-by: Amp <amp@ampcode.com>
DrJKL
pushed a commit
that referenced
this pull request
Jan 31, 2026
## Summary Fixes the snapshot merge failure introduced by PR #8377 (actions/download-artifact v4→v7 upgrade). ## Root Cause The v5+ release of `download-artifact` changed behavior: when a `pattern` matches only a **single artifact**, files are extracted directly to `path/` without the artifact name subdirectory. When only one shard had changes, the merge loop couldn't find the expected `snapshots-shard-*/` directories. ## Fix Use `merge-multiple: true` — the documented pattern for combining sharded artifacts. This merges all matched artifacts directly into the target path, eliminating directory structure assumptions. ## Testing This fix can be validated by re-running the workflow on [PR #8276](#8276) after merge. --- - Fixes snapshot update workflow regression from #8377 ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8432-fix-use-merge-multiple-for-snapshot-artifact-download-2f76d73d3650810b97fdfe28cd3c7694) by [Unito](https://www.unito.io) Co-authored-by: Subagent 5 <subagent@example.com> Co-authored-by: Amp <amp@ampcode.com>
christian-byrne
added a commit
that referenced
this pull request
Mar 13, 2026
Two issues caused the lint/format CI to be broken for fork PRs: 1. The setup-frontend shared action (created in #8377) was missed when Node version was standardized to .nvmrc in #9521. It still used node-version: 'lts/*' instead of node-version-file: '.nvmrc', causing a version mismatch with the rest of the repo. 2. Fork PRs with auto-fixable lint/format issues silently passed CI. The auto-fix steps would fix issues in the workspace, then Final validation would pass on the fixed workspace, but the commit step was correctly skipped for forks. The 'Comment on PR' step that was supposed to tell fork contributors to fix manually used continue-on-error: true with actions/github-script — but fork PRs have a read-only GITHUB_TOKEN that can't post comments, so it silently failed. The net result: fork PRs with lint issues got a green checkmark. Fix: Replace the silent comment step with an explicit failure step that exits with code 1 and prints clear instructions in the CI log. Remove the broken fork comment step entirely.
2 tasks
christian-byrne
added a commit
that referenced
this pull request
Mar 13, 2026
## Problem The lint/format CI workflow was broken for fork PRs in two ways: ### 1. Node version mismatch in setup-frontend action The `setup-frontend` shared action (created in #8377) was missed when Node version was standardized to `.nvmrc` in #9521. It still used `node-version: 'lts/*'` instead of `node-version-file: '.nvmrc'`. ### 2. Fork PRs with lint issues silently passed CI Fork PRs with auto-fixable lint/format issues got a **green checkmark** despite having unfixed issues: 1. Auto-fix steps (`lint:fix`, `format`) fix issues in the workspace 2. `Commit changes` is correctly skipped for forks (can't push to fork branches) 3. `Final validation` passes because it runs on the already-fixed workspace 4. The `Comment on PR about manual fix needed` step tries to post a comment via `actions/github-script`, but fork PRs have a read-only `GITHUB_TOKEN` — the comment silently fails (`continue-on-error: true`) 5. **Result**: workflow reports success, contributor thinks their code is clean ## Fix - **setup-frontend**: Use `node-version-file: '.nvmrc'` instead of `node-version: 'lts/*'` - **ci-lint-format**: Replace the broken fork comment step with an explicit `exit 1` that fails CI and prints clear fix instructions in the log. This follows the principle from `.github/AGENTS.md`: fork PRs can't post comments, so don't try. ## Testing - [ ] Verify fork PRs with clean code still pass - [ ] Verify fork PRs with lint issues now properly fail (instead of silently passing) ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-9846-fix-restore-fork-PR-lint-format-CI-workflow-3226d73d3650811cb5bfe9f1f989cc0c) by [Unito](https://www.unito.io)
zeekay
pushed a commit
to hanzoui/frontend
that referenced
this pull request
Jul 26, 2026
## Summary ... ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8377-WIP-Chore-Actions-updates-and-cleanup-2f66d73d3650818483a8dffa32a6f245) by [Unito](https://www.unito.io) --------- Co-authored-by: Amp <amp@ampcode.com>
zeekay
pushed a commit
to hanzoui/frontend
that referenced
this pull request
Jul 26, 2026
## Summary Fixes the snapshot merge failure introduced by PR Comfy-Org#8377 (actions/download-artifact v4→v7 upgrade). ## Root Cause The v5+ release of `download-artifact` changed behavior: when a `pattern` matches only a **single artifact**, files are extracted directly to `path/` without the artifact name subdirectory. When only one shard had changes, the merge loop couldn't find the expected `snapshots-shard-*/` directories. ## Fix Use `merge-multiple: true` — the documented pattern for combining sharded artifacts. This merges all matched artifacts directly into the target path, eliminating directory structure assumptions. ## Testing This fix can be validated by re-running the workflow on [PR Comfy-Org#8276](Comfy-Org#8276) after merge. --- - Fixes snapshot update workflow regression from Comfy-Org#8377 ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8432-fix-use-merge-multiple-for-snapshot-artifact-download-2f76d73d3650810b97fdfe28cd3c7694) by [Unito](https://www.unito.io) Co-authored-by: Subagent 5 <subagent@example.com> Co-authored-by: Amp <amp@ampcode.com>
zeekay
pushed a commit
to hanzoui/frontend
that referenced
this pull request
Jul 26, 2026
## Summary ... ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8377-WIP-Chore-Actions-updates-and-cleanup-2f66d73d3650818483a8dffa32a6f245) by [Unito](https://www.unito.io) --------- Co-authored-by: Amp <amp@ampcode.com>
zeekay
pushed a commit
to hanzoui/frontend
that referenced
this pull request
Jul 26, 2026
## Summary Fixes the snapshot merge failure introduced by PR Comfy-Org#8377 (actions/download-artifact v4→v7 upgrade). ## Root Cause The v5+ release of `download-artifact` changed behavior: when a `pattern` matches only a **single artifact**, files are extracted directly to `path/` without the artifact name subdirectory. When only one shard had changes, the merge loop couldn't find the expected `snapshots-shard-*/` directories. ## Fix Use `merge-multiple: true` — the documented pattern for combining sharded artifacts. This merges all matched artifacts directly into the target path, eliminating directory structure assumptions. ## Testing This fix can be validated by re-running the workflow on [PR Comfy-Org#8276](Comfy-Org#8276) after merge. --- - Fixes snapshot update workflow regression from Comfy-Org#8377 ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8432-fix-use-merge-multiple-for-snapshot-artifact-download-2f76d73d3650810b97fdfe28cd3c7694) by [Unito](https://www.unito.io) Co-authored-by: Subagent 5 <subagent@example.com> Co-authored-by: Amp <amp@ampcode.com>
dante01yoon
pushed a commit
that referenced
this pull request
Jul 27, 2026
## Summary ... ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8377-WIP-Chore-Actions-updates-and-cleanup-2f66d73d3650818483a8dffa32a6f245) by [Unito](https://www.unito.io) --------- Co-authored-by: Amp <amp@ampcode.com>
dante01yoon
pushed a commit
that referenced
this pull request
Jul 27, 2026
## Summary Fixes the snapshot merge failure introduced by PR #8377 (actions/download-artifact v4→v7 upgrade). ## Root Cause The v5+ release of `download-artifact` changed behavior: when a `pattern` matches only a **single artifact**, files are extracted directly to `path/` without the artifact name subdirectory. When only one shard had changes, the merge loop couldn't find the expected `snapshots-shard-*/` directories. ## Fix Use `merge-multiple: true` — the documented pattern for combining sharded artifacts. This merges all matched artifacts directly into the target path, eliminating directory structure assumptions. ## Testing This fix can be validated by re-running the workflow on [PR #8276](#8276) after merge. --- - Fixes snapshot update workflow regression from #8377 ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8432-fix-use-merge-multiple-for-snapshot-artifact-download-2f76d73d3650810b97fdfe28cd3c7694) by [Unito](https://www.unito.io) Co-authored-by: Subagent 5 <subagent@example.com> Co-authored-by: Amp <amp@ampcode.com>
dante01yoon
pushed a commit
that referenced
this pull request
Jul 27, 2026
## Problem The lint/format CI workflow was broken for fork PRs in two ways: ### 1. Node version mismatch in setup-frontend action The `setup-frontend` shared action (created in #8377) was missed when Node version was standardized to `.nvmrc` in #9521. It still used `node-version: 'lts/*'` instead of `node-version-file: '.nvmrc'`. ### 2. Fork PRs with lint issues silently passed CI Fork PRs with auto-fixable lint/format issues got a **green checkmark** despite having unfixed issues: 1. Auto-fix steps (`lint:fix`, `format`) fix issues in the workspace 2. `Commit changes` is correctly skipped for forks (can't push to fork branches) 3. `Final validation` passes because it runs on the already-fixed workspace 4. The `Comment on PR about manual fix needed` step tries to post a comment via `actions/github-script`, but fork PRs have a read-only `GITHUB_TOKEN` — the comment silently fails (`continue-on-error: true`) 5. **Result**: workflow reports success, contributor thinks their code is clean ## Fix - **setup-frontend**: Use `node-version-file: '.nvmrc'` instead of `node-version: 'lts/*'` - **ci-lint-format**: Replace the broken fork comment step with an explicit `exit 1` that fails CI and prints clear fix instructions in the log. This follows the principle from `.github/AGENTS.md`: fork PRs can't post comments, so don't try. ## Testing - [ ] Verify fork PRs with clean code still pass - [ ] Verify fork PRs with lint issues now properly fail (instead of silently passing) ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-9846-fix-restore-fork-PR-lint-format-CI-workflow-3226d73d3650811cb5bfe9f1f989cc0c) by [Unito](https://www.unito.io)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
...
┆Issue is synchronized with this Notion page by Unito