Skip to content

Chore: Actions updates and cleanup #8377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AustinMroz merged 14 commits into from
Jan 29, 2026
Merged

Chore: Actions updates and cleanup #8377

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
538284f
chore: upgrade GitHub Actions to latest versions
DrJKL Jan 28, 2026
5d41545
ci: optimize workflows and reduce redundant steps
DrJKL Jan 28, 2026
bde2878
Why do we have both?
DrJKL Jan 28, 2026
524ff42
chore: rename .yml files to .yaml
DrJKL Jan 28, 2026
d9830a1
security: pin third-party GitHub Actions to commit SHAs
DrJKL Jan 28, 2026
de91d94
ci: add pinact validation workflow for SHA pinning enforcement
DrJKL Jan 28, 2026
7b5b301
fix: pinact config. rerun
DrJKL Jan 28, 2026
16e93d7
chore: pin the versions for official actions to ensure consistency
DrJKL Jan 28, 2026
08709f3
Try updating the pins again.
DrJKL Jan 28, 2026
b7e08f5
Don't forget the actions.
DrJKL Jan 28, 2026
4527a98
Update .yamllint to not conflict with comments from pinact.
DrJKL Jan 28, 2026
6c89190
Missed actions/cache
DrJKL Jan 28, 2026
fd4a2d4
Remove cache restore entirely.
DrJKL Jan 29, 2026
eaa5d55
Run pinact -u
DrJKL Jan 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitattributes
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
*.ts text eol=lf
*.vue text eol=lf
*.yaml text eol=lf
*.yml text eol=lf

# Generated files
packages/registry-types/src/comfyRegistryTypes.ts linguist-generated=true
Expand Down
4 changes: 2 additions & 2 deletions .github/actions/comment-release-links/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,14 +104,14 @@ runs:

- name: Find existing comment
id: find
uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad
uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
with:
issue-number: ${{ inputs.issue-number || github.event.pull_request.number }}
comment-author: github-actions[bot]
body-includes: ${{ steps.build.outputs.marker_search }}

- name: Post or update comment
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
with:
issue-number: ${{ inputs.issue-number || github.event.pull_request.number }}
comment-id: ${{ steps.find.outputs.comment-id }}
Expand Down
4 changes: 2 additions & 2 deletions ...b/actions/setup-comfyui-server/action.yml → .../actions/setup-comfyui-server/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ runs:

# Checkout ComfyUI repo, install the dev_tools node and start server
- name: Checkout ComfyUI
uses: actions/checkout@v5
uses: actions/checkout@v6
with:
repository: 'comfyanonymous/ComfyUI'
path: 'ComfyUI'
Expand All @@ -33,7 +33,7 @@ runs:
fi

- name: Setup Python
uses: actions/setup-python@v4
uses: actions/setup-python@v6
with:
python-version: '3.10'

Expand Down
16 changes: 2 additions & 14 deletions .github/actions/setup-frontend/action.yml → .github/actions/setup-frontend/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,29 +12,17 @@ runs:

# Install pnpm, Node.js, build frontend
- name: Install pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
version: 10

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: 'lts/*'
cache: 'pnpm'
cache-dependency-path: './pnpm-lock.yaml'

# Restore tool caches before running any build/lint operations
- name: Restore tool output cache
uses: actions/cache/restore@v4
with:
path: |
./.cache
./tsconfig.tsbuildinfo
key: tool-cache-${{ runner.os }}-${{ hashFiles('./pnpm-lock.yaml') }}-${{ hashFiles('./src/**/*.{ts,vue,js,mts}', './*.config.*') }}
restore-keys: |
tool-cache-${{ runner.os }}-${{ hashFiles('./pnpm-lock.yaml') }}-
tool-cache-${{ runner.os }}-

- name: Install dependencies
shell: bash
run: pnpm install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion .github/actions/setup-playwright/action.yml → .github/actions/setup-playwright/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ runs:
echo "playwright-version=$PLAYWRIGHT_VERSION" >> $GITHUB_OUTPUT

- name: Cache Playwright Browsers
uses: actions/cache@v4
uses: actions/cache@v5 # v5.0.2
id: cache-playwright-browsers
with:
path: '~/.cache/ms-playwright'
Expand Down
0 ...b/actions/start-comfyui-server/action.yml → .../actions/start-comfyui-server/action.yaml
View file
Open in desktop
File renamed without changes.
8 changes: 4 additions & 4 deletions .github/workflows/api-update-electron-api-types.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,15 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v5
uses: actions/checkout@v6

- name: Install pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
version: 10

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: lts/*
cache: 'pnpm'
Expand All @@ -36,7 +36,7 @@ jobs:
echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT

- name: Create Pull Request
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
with:
token: ${{ secrets.PR_GH_TOKEN }}
commit-message: '[chore] Update electron-types to ${{ steps.get-version.outputs.NEW_VERSION }}'
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/api-update-manager-api-types.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,15 +18,15 @@ jobs:
pull-requests: write
steps:
- name: Checkout repository
uses: actions/checkout@v5
uses: actions/checkout@v6

- name: Install pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
version: 10

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: lts/*
cache: 'pnpm'
Expand All @@ -35,7 +35,7 @@ jobs:
run: pnpm install --frozen-lockfile

- name: Checkout ComfyUI-Manager repository
uses: actions/checkout@v5
uses: actions/checkout@v6
with:
repository: Comfy-Org/ComfyUI-Manager
path: ComfyUI-Manager
Expand Down Expand Up @@ -86,7 +86,7 @@ jobs:

- name: Create Pull Request
if: steps.check-changes.outputs.changed == 'true'
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
with:
token: ${{ secrets.PR_GH_TOKEN }}
commit-message: '[chore] Update ComfyUI-Manager API types from ComfyUI-Manager@${{ steps.manager-info.outputs.commit }}'
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/api-update-registry-api-types.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,15 +17,15 @@ jobs:
pull-requests: write
steps:
- name: Checkout repository
uses: actions/checkout@v5
uses: actions/checkout@v6

- name: Install pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
version: 10

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v6
with:
node-version: lts/*
cache: 'pnpm'
Expand All @@ -34,7 +34,7 @@ jobs:
run: pnpm install --frozen-lockfile

- name: Checkout comfy-api repository
uses: actions/checkout@v5
uses: actions/checkout@v6
with:
repository: Comfy-Org/comfy-api
path: comfy-api
Expand Down Expand Up @@ -87,7 +87,7 @@ jobs:

- name: Create Pull Request
if: steps.check-changes.outputs.changed == 'true'
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
with:
token: ${{ secrets.PR_GH_TOKEN }}
commit-message: '[chore] Update Comfy Registry API types from comfy-api@${{ steps.api-info.outputs.commit }}'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-json-validation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,6 @@ jobs:
json-lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/checkout@v6
- name: Validate JSON syntax
run: ./scripts/cicd/check-json.sh
21 changes: 5 additions & 16 deletions .github/workflows/ci-lint-format.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,23 +18,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout PR
uses: actions/checkout@v5
uses: actions/checkout@v6
with:
ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || github.ref }}

- name: Install pnpm
uses: pnpm/action-setup@v4
with:
version: 10

- name: Use Node.js
uses: actions/setup-node@v4
with:
node-version: 'lts/*'
cache: 'pnpm'

- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Setup frontend
uses: ./.github/actions/setup-frontend

- name: Run ESLint with auto-fix
run: pnpm lint:fix
Expand Down Expand Up @@ -73,7 +62,7 @@ jobs:
- name: Comment on PR about auto-fix
if: steps.verify-changed-files.outputs.changed == 'true' && github.event.pull_request.head.repo.full_name == github.repository
continue-on-error: true
uses: actions/github-script@v7
uses: actions/github-script@v8
with:
script: |
github.rest.issues.createComment({
Expand All @@ -86,7 +75,7 @@ jobs:
- name: Comment on PR about manual fix needed
if: steps.verify-changed-files.outputs.changed == 'true' && github.event.pull_request.head.repo.full_name != github.repository
continue-on-error: true
uses: actions/github-script@v7
uses: actions/github-script@v8
with:
script: |
github.rest.issues.createComment({
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/ci-python-validation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,10 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v5
uses: actions/checkout@v6

- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@v6
with:
python-version: '3.11'

Expand Down
19 changes: 4 additions & 15 deletions .github/workflows/ci-size-data.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,21 +17,10 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v5
- uses: actions/checkout@v6

- name: Install pnpm
uses: pnpm/action-setup@v4.1.0
with:
version: 10

- name: Install Node.js
uses: actions/setup-node@v5
with:
node-version: '24.x'
cache: pnpm

- name: Install dependencies
run: pnpm install
- name: Setup frontend
uses: ./.github/actions/setup-frontend

- name: Build project
run: pnpm build
Expand All @@ -46,7 +35,7 @@ jobs:
echo ${{ github.base_ref }} > ./temp/size/base.txt

- name: Upload size data
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v6
with:
name: size-data
path: temp/size
6 changes: 3 additions & 3 deletions .github/workflows/ci-tests-e2e-forks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,11 @@ jobs:
echo "Is forked: ${{ github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name }}"

- name: Checkout repository
uses: actions/checkout@v5
uses: actions/checkout@v6
Comment on lines 33 to +34

@coderabbitai coderabbitai Bot Jan 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

actions/checkout v6 release notes breaking changes

💡 Result:

actions/checkout v6 — breaking/behavior-changing notes

  • Credentials are no longer written into .git/config when persist-credentials: true. v6 persists credentials to a separate file under $RUNNER_TEMP instead (security hardening). This can break workflows/scripts that expect to read auth from .git/config (e.g., custom tooling that parses config rather than just running git fetch/push). [1][2]
  • Runner requirement for Docker container actions: If you run authenticated git commands from a Docker container action, you need GitHub Actions Runner v2.329.0+. (Workflows that rely on this on older/self-hosted runners may fail.) [1]
  • General upgrade note: The project’s stated intent is that no workflow changes are required for normal git usage (git fetch, git push, etc. should still work). [1]

Sources:
[1] actions/checkout README (“Checkout v6 / What’s new”)
[2] v6.0.0 release notes (includes “Persist creds to a separate file”)

🌐 Web query:

actions/github-script v8 release breaking changes

💡 Result:

actions/github-script@v8 has one explicit breaking change:

  • Runtime bumped to Node.js 24 (from Node.js 20 in v7). Any breaking changes between Node 20 → 24 can affect your script (language/runtime behavior and bundled dependencies). [1][2]
  • Minimum required GitHub Actions runner version: v2.327.1 (relevant for self-hosted runners; upgrade if you pin runner versions). [1][2]

No other v8-specific breaking API surface changes are called out in the project’s breaking-changes notes beyond the Node 24 runtime/runner requirement. [1]

🌐 Web query:

actions/download-artifact v7 release breaking changes

💡 Result:

For actions/download-artifact@v7, the breaking change called out in the release docs is:

  • Runtime upgrade to Node.js 24 (runs.using: node24). This requires GitHub Actions Runner >= 2.327.1—so older self-hosted runners must be updated before upgrading to @v7, or the action can fail to run. [1]

Source: [1]

Verify GitHub Actions version upgrades for breaking changes.

The version bumps have confirmed breaking changes:

  • actions/checkout@v6: Credentials are no longer stored in .git/config; they're now persisted to a separate file under $RUNNER_TEMP. Workflows or scripts that parse .git/config for authentication will break. Also requires runner v2.329.0+ for authenticated git commands from Docker containers.
  • actions/github-script@v8: Runtime bumped to Node.js 24 (from v20). This can introduce breaking changes in your script block; requires runner v2.327.1+.
  • actions/download-artifact@v7: Runtime upgraded to Node.js 24; requires runner v2.327.1+.

Ensure your GitHub Actions runners meet the minimum version requirements and that workflows do not depend on credential storage in .git/config.

🤖 Prompt for AI Agents 
In @.github/workflows/ci-tests-e2e-forks.yaml around lines 33 - 34, The workflow
upgrade to actions/checkout@v6, actions/github-script@v8, and
actions/download-artifact@v7 introduces breaking changes (credentials now stored
under $RUNNER_TEMP and Node 24 runtime) so update CI to either pin compatible
action versions or ensure runners meet minimum versions and remove any logic
that parses .git/config for auth; specifically, review uses of
actions/checkout@v6, actions/github-script@v8, and actions/download-artifact@v7,
replace or pin them to earlier compatible tags if you cannot guarantee runner
v2.329.0+ (for checkout) and v2.327.1+ (for github-script/download-artifact),
and refactor any scripts that read .git/config to instead read credentials from
the new $RUNNER_TEMP location or use GitHub Actions-provided environment
variables for authentication.

@DrJKL DrJKL Jan 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's good.

@coderabbitai coderabbitai Bot Jan 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@DrJKL, understood! I've noted that you're aware of the breaking changes in the upgraded actions and they're acceptable for this workflow.

🧠 Learnings used 
Learnt from: Myestery
Repo: Comfy-Org/ComfyUI_frontend PR: 7422
File: .github/workflows/pr-update-playwright-expectations.yaml:131-135
Timestamp: 2025-12-12T23:02:37.473Z
Learning: In the `.github/workflows/pr-update-playwright-expectations.yaml` workflow in the Comfy-Org/ComfyUI_frontend repository, the snapshot update process is intentionally scoped to only add and update snapshot images. Deletions of snapshot files are handled explicitly outside this workflow and should not be suggested as part of this automation.


- name: Get PR Number
id: pr
uses: actions/github-script@v7
uses: actions/github-script@v8
with:
script: |
const { data: prs } = await github.rest.pulls.list({
Expand Down Expand Up @@ -68,7 +68,7 @@ jobs:

- name: Download and Deploy Reports
if: steps.pr.outputs.result != 'null' && github.event.action == 'completed'
uses: actions/download-artifact@v4
uses: actions/download-artifact@v7
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
run-id: ${{ github.event.workflow_run.id }}
Expand Down
Loading