Update GitHub actions#635
Merged
Merged
Conversation
Upgrade GitHub Actions steps across CI workflows to newer supported versions. Updates checkout, setup-miniconda, paths-filter, cache restore/save, codecov, and upload-artifact actions in ci-reusable.yml, ci.yml, and nightly.yml. This also changes from using bare tags (e.g. @4) to exact versions (e.g @v4.0.1). This is following the best-practices recommendation in the Github actions documentation at: https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions.
Enable monthly grouped Dependabot updates for workflow references and document the needed repository setting for Dependabot version updates. This requires manual activation on the repository web site before it will take effect.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #635 +/- ##
=======================================
Coverage 100.0% 100.0%
=======================================
Files 151 151
Lines 9057 9057
Branches 1035 1035
=======================================
Hits 9057 9057 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s GitHub Actions references to newer releases to avoid upcoming CI breakages due to deprecated Node runtimes in older action versions, and adds a Dependabot configuration to automate future GitHub Actions version bumps.
Changes:
- Bumped versions for core CI actions (checkout, upload-artifact, cache restore/save, paths-filter, setup-miniconda, codecov) across CI workflows.
- Added a Dependabot configuration to group GitHub Actions updates into a single monthly PR (requires enabling Dependabot version updates in repo settings).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/nightly.yml | Updates action versions used by the scheduled nightly and drift-rebuild jobs. |
| .github/workflows/ci.yml | Updates action versions used by the PR-entry workflow and drift canary job. |
| .github/workflows/ci-reusable.yml | Updates action versions used by the reusable CI pipeline (validation, caching, coverage upload). |
| .github/dependabot.yml | Adds monthly grouped Dependabot updates for GitHub Actions. |
vitenti
approved these changes
May 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The CI is currently complaining about an elderly
nodeversion used by some actions, which will begin breaking in June.This PR updates all the Github actions to the most recent versions.
It also adds (but does not yet enable) a monthly dependabot check for new versions of actions.
Type of change
Checklist:
The following checklist will make sure that you are following the code style and
guidelines of the project as described in the
contributing page.
bash pre-commit-checkand fixed any issues