chore: Update outdated GitHub Actions versions #11316
Conversation
WalkthroughThis pull request updates GitHub Actions versions across 21 workflow files in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 7✅ Passed checks (7 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
bot
added
the
documentation
github-actions
bot
added
documentation
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/lint-js.yml (1)
48-48: Pre-existing bug: Incorrect cache-hit check.The conditional checks
steps.setup-node.outputs.cache-hit, but thesetup-nodeaction doesn't outputcache-hit. The cache action (with idnpm-cacheon line 37) produces this output.🐛 Proposed fix
- if: ${{ steps.setup-node.outputs.cache-hit != 'true' }} + if: ${{ steps.npm-cache.outputs.cache-hit != 'true' }}.github/workflows/release.yml (1)
626-629: Inconsistent version:download-artifact@v4should be@v7.This action was missed in the version update. All other
download-artifactusages in this file (lines 455, 478, 501, 528) use@v7, but this one still uses@v4. This inconsistency could cause issues due to breaking changes between major versions (e.g., different artifact format handling).Proposed fix
- - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v7
🤖 Fix all issues with AI agents
In @.github/workflows/lint-js.yml:
- Line 30: The cache-hit condition is referencing the wrong step output; replace
any use of steps.setup-node.outputs.cache-hit with the cache action's output
steps.npm-cache.outputs.cache-hit (e.g., update the npm install step's if:
condition to if: ${{ steps.npm-cache.outputs.cache-hit != 'true' }}), ensuring
the workflow checks the cache action's output rather than setup-node.
🧹 Nitpick comments (1)
.github/workflows/js_autofix.yml (1)
36-40: Pre-existing issue:cache-hitoutput check may never be true.The condition
steps.setup-node.outputs.cache-hit != 'true'references thesetup-nodestep's output, but since thecacheinput is not set onsetup-node, it won't produce acache-hitoutput. The separateactions/cachestep (id:npm-cache) produces this output instead.Consider updating the condition to reference the correct step:
🔧 Suggested fix
- name: Install Node.js dependencies run: | cd src/frontend npm ci - if: ${{ steps.setup-node.outputs.cache-hit != 'true' }} + if: ${{ steps.npm-cache.outputs.cache-hit != 'true' }}
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (23)
.github/workflows/add-labels.yml.github/workflows/ci.yml.github/workflows/community-label.yml.github/workflows/create-release.yml.github/workflows/cross-platform-test.yml.github/workflows/deploy-docs-draft.yml.github/workflows/deploy-storybook.yml.github/workflows/deploy_gh-pages.yml.github/workflows/docs-update-openapi.yml.github/workflows/docs_test.yml.github/workflows/jest_test.yml.github/workflows/js_autofix.yml.github/workflows/lint-js.yml.github/workflows/migration-validation.yml.github/workflows/python_test.yml.github/workflows/release-lfx.yml.github/workflows/release.yml.github/workflows/release_nightly.yml.github/workflows/request-docs-review.yml.github/workflows/smoke-tests.yml.github/workflows/store_pytest_durations.yml.github/workflows/template-tests.yml.github/workflows/typescript_test.yml
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2025-11-24T19:46:26.770Z
Learnt from: CR
Repo: langflow-ai/langflow PR: 0
File: .cursor/rules/docs_development.mdc:0-0
Timestamp: 2025-11-24T19:46:26.770Z
Learning: Node.js v22.12 LTS and Yarn package manager must be used for documentation environment setup
Applied to files:
.github/workflows/deploy-docs-draft.yml.github/workflows/deploy_gh-pages.yml.github/workflows/smoke-tests.yml.github/workflows/deploy-storybook.yml
📚 Learning: 2025-11-24T19:46:45.790Z
Learnt from: CR
Repo: langflow-ai/langflow PR: 0
File: .cursor/rules/frontend_development.mdc:0-0
Timestamp: 2025-11-24T19:46:45.790Z
Learning: Use Node.js v22.12 LTS for JavaScript runtime
Applied to files:
.github/workflows/deploy-docs-draft.yml.github/workflows/deploy_gh-pages.yml.github/workflows/smoke-tests.yml.github/workflows/deploy-storybook.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: test-starter-projects
🔇 Additional comments (49)
.github/workflows/deploy_gh-pages.yml (1)
18-22:actions/setup-node@v6is a valid release and compatible with this workflow.v6 is released and production-ready. The primary breaking change (automatic caching limited to npm) does not affect this workflow since it explicitly uses npm. The configuration (
node-version: 22,cache: npm,cache-dependency-path: ./docs/package-lock.json) is fully compatible with v6..github/workflows/ci.yml (2)
215-217: LGTM!
actions/setup-python@v6is the latest version (v6.1.0), and the usage withpython-version: '3.12'is correct. The action upgraded from node20 to node24 and "Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release."Since this workflow uses GitHub-hosted runners (
ubuntu-latest), this should work without issues.
318-321: LGTM!The update to
actions/setup-python@v6in the test-templates job is valid. The Python version3.12is well supported..github/workflows/template-tests.yml (1)
24-27: LGTM!The update to
actions/setup-python@v6is valid. The workflow uses GitHub-hosted runners (ubuntu-latest), so compatibility is assured..github/workflows/add-labels.yml (1)
14-17: LGTM!The update to
actions/github-script@v8includes "Update Node.js version support to 24.x". The existing script usinggithub.rest.issues.*API remains compatible with v8, as it uses the same Octokit patterns..github/workflows/deploy-docs-draft.yml (2)
23-28: LGTM!The update to
actions/setup-node@v6(v6.1.0) is valid. Node.js version 22 is well supported. Based on learnings, Node.js v22.12 LTS is the recommended version for documentation environment setup, so this aligns well.
261-266: LGTM!The update to
actions/upload-artifact@v6is valid. Note that "actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading."Since this workflow uses GitHub-hosted runners (
ubuntu-latest), the runner version requirement is automatically satisfied..github/workflows/request-docs-review.yml (1)
12-14: LGTM!The update to
actions/github-script@v8is valid.v8.0.0updates Node.js version support to 24.x and requires runner v2.327.1+. Thegithub.rest.pulls.requestReviewersAPI usage remains compatible..github/workflows/python_test.yml (3)
71-71: LGTM! Valid upgrade toactions/setup-node@v6.The
v6.1.0release is available and requires runner version v2.327.1 or later to ensure compatibility.Since this workflow supports self-hosted runners (lines 27-31, 44-46), verify that all self-hosted runners in your infrastructure are updated to version 2.327.1 or later before merging.
112-120: LGTM! Valid upgrade toactions/upload-artifact@v6.
actions/upload-artifact@v6now runs on Node.js 24 and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.The artifact configuration with
name,path, andretention-daysremains compatible with v6.
182-190: LGTM! Consistent upgrade for LFX coverage artifacts.Same valid upgrade to
actions/upload-artifact@v6as the other occurrences in this file..github/workflows/js_autofix.yml (2)
21-25: LGTM! Valid upgrade toactions/setup-node@v6.The
v6.0.0release was published in October 2025, and the upgrade is compatible with the existing configuration.
27-34: LGTM! Valid upgrade toactions/cache@v5.
actions/cache@v5runs on Node.js 24 and requires a minimum Actions Runner version of 2.327.1.Changes in these releases are fully backward compatible..github/workflows/community-label.yml (1)
13-27: LGTM! Valid upgrade toactions/github-script@v8.The script logic using
github.rest.issues.addLabelsremains unchanged and compatible with v8..github/workflows/docs_test.yml (1)
26-32: LGTM! Valid upgrade with improved caching configuration.The action has built-in functionality for caching and restoring dependencies using
actions/cacheunder the hood. Supported package managers are npm, yarn, pnpm (v6.10+). The cache input is optional. The action defaults to search for the dependency file in the repository root, and uses its hash as a part of the cache key.The explicit
cache-dependency-path: ./docs/package-lock.jsonis correctly configured since the package.json is in thedocs/subdirectory..github/workflows/deploy-storybook.yml (1)
26-30: LGTM! Valid upgrade with proper caching for frontend assets.The upgrade to
actions/setup-node@v6with built-in npm caching is well-configured:
node-version: 22aligns with the project's Node.js v22.12 LTS standard (based on learnings).cache-dependency-path: src/frontend/package-lock.jsoncorrectly targets the frontend package lock file.Caching for npm dependencies is automatically enabled when your package.json contains either
devEngines.packageManagerfield or top-levelpackageManagerfield set to npm, and no explicit cache input is provided. Explicitly settingcache: npmensures consistent behavior..github/workflows/jest_test.yml (2)
38-43: LGTM!The setup-node version upgrade to v6 is consistent with the PR-wide update pattern. Node.js version 22 aligns with the project's Node.js v22.12 LTS requirement. Based on learnings.
82-87: LGTM!The upload-artifact upgrade to v6 is consistent with other workflow files in this PR.
.github/workflows/release.yml (4)
300-303: LGTM!Upload-artifact upgrade to v6 is consistent with the PR pattern.
381-384: LGTM!Upload-artifact upgrade to v6 is consistent.
430-433: LGTM!Upload-artifact upgrade to v6 is consistent.
455-458: LGTM!Download-artifact upgrades to v7 are consistent across these jobs.
Also applies to: 478-481, 501-504
.github/workflows/create-release.yml (1)
23-26: LGTM!The download-artifact upgrade to v7 is consistent with other workflow files in this PR.
.github/workflows/smoke-tests.yml (3)
31-33: LGTM!The setup-python upgrades to v6 are consistent across both backend and LFX smoke test jobs.
Also applies to: 80-82
123-127: LGTM!The setup-node upgrade to v6 is consistent with the PR pattern. Node.js version 22 aligns with the project's Node.js v22.12 LTS requirement. Based on learnings.
149-150: LGTM!The github-script upgrade to v8 is consistent with other workflow files in this PR.
.github/workflows/migration-validation.yml (1)
15-15: All three GitHub Actions versions are published and stable as of January 2026.
- actions/checkout@v6: Stable release with credential handling changes; requires GitHub Actions Runner >= v2.329.0.
- actions/setup-python@v6: Stable release (v6.0.0); Node 24 runtime upgrade; requires Runner >= v2.327.1.
- actions/github-script@v8: Stable release (v8.0.0); Node 24 runtime; requires Runner >= v2.327.1.
Version upgrades are valid and well-documented on the Marketplace.
.github/workflows/store_pytest_durations.yml (2)
40-60: LGTM!The
actions/github-script@v8upgrade is consistent with updates across other workflows in this PR. The script logic usinggithub.rest.pulls.listandgithub.rest.pulls.updateis standard and should work with v8.
62-76: LGTM!The
peter-evans/create-pull-request@v8update is consistent with the same update indocs-update-openapi.yml. The configuration options used (token,branch-token,commit-message,title,body,branch,branch-suffix,delete-branch,maintainer-can-modify) are standard and supported in v8..github/workflows/cross-platform-test.yml (4)
59-67: LGTM!The
actions/upload-artifact@v6updates are applied consistently to both artifact upload steps. The configuration (name,path) is standard and compatible.
136-140: LGTM!The
actions/setup-python@v6update is applied. The configuration usingpython-versionandarchitectureis standard.
434-476: LGTM!The experimental test job mirrors the stable test job with consistent action version updates for
setup-python@v6anddownload-artifact@v7.
159-178: No compatibility issue exists.The
actions/upload-artifact@v6andactions/download-artifact@v7versions used in this workflow are fully compatible. Both versions use the same v4+ artifact architecture, which ensures interoperability. Incompatibilities only occurred between v3 (and earlier) and v4+; all v4+ releases (v4 through v7) work together seamlessly.Likely an incorrect or invalid review comment.
.github/workflows/release_nightly.yml (6)
108-112: LGTM!The
actions/upload-artifact@v6update for LFX artifact upload is consistent with the broader upgrade pattern.
191-195: LGTM!The
actions/upload-artifact@v6update for base artifact upload maintains consistency.
264-268: LGTM!The
actions/upload-artifact@v6update for main artifact upload completes the upload action upgrades in this workflow.
290-294: LGTM!The
actions/download-artifact@v7update for LFX artifact download is consistent.
318-322: LGTM!The
actions/download-artifact@v7update for base artifact download is consistent.
346-350: LGTM!The
actions/download-artifact@v7update for main artifact download completes the download action upgrades. The artifact names (dist-nightly-lfx,dist-nightly-base,dist-nightly-main) correctly match between upload and download steps..github/workflows/typescript_test.yml (6)
286-295: LGTM!The
actions/setup-node@v6update in the test job is consistent with the update in the determine-test-suite job.
298-305: LGTM!The
actions/cache@v5update is a sequential version bump. The cache configuration for Playwright browsers is standard.
349-355: LGTM!The
actions/upload-artifact@v6update for blob reports is consistent with other workflows.
385-399: LGTM!The
actions/setup-node@v6andactions/download-artifact@v7updates in the merge-reports job are consistent. Themerge-multiple: trueoption for downloading multiple blob reports is correctly configured.
407-413: LGTM!The
actions/upload-artifact@v6update for the merged HTML report completes the version upgrades in this workflow.
216-222: No action needed —actions/setup-node@v6is released and supports Node.js 22.The update from v4 to v6 is valid. Version 6 is current in the GitHub Actions marketplace and explicitly supports Node.js 22, which is correctly configured in the workflow via
NODE_VERSION: "22". The action version update aligns with the Node.js version requirement..github/workflows/docs-update-openapi.yml (1)
109-124: Version update is compatible with current workflow configuration.The action is correctly updated to v8, and the workflow already uses
actions/checkout@v6as recommended by v8's release notes. All configuration parameters are supported. No compatibility issues..github/workflows/release-lfx.yml (3)
263-275: docker/build-push-action@v6 is available and compatible with the current inputs.v6 introduces new features including multi-platform build support (new inputs:
multiPlatform,platform), SSH agent forwarding, and build summary exports (can be disabled viaDOCKER_BUILD_NO_SUMMARYenvironment variable). The existing inputs used in this workflow (context,file,platforms,push,tags,labels,cache-from,cache-to,build-args) remain compatible with no breaking changes.
187-192: Version bumps are compatible; no issues found.The update from
actions/upload-artifact@v4tov6andactions/download-artifact@v5tov7are confirmed as valid. Both v6 and v7 use the same v4+ artifact backend and are compatible with each other—the shared artifact namelfx-distwill work correctly between these versions. No breaking changes prevent the workflow from executing successfully.
286-290:actions/download-artifact@v7is compatible withactions/upload-artifact@v6.Both versions use the v4+ artifact backend, which standardized the format and protocol. All versions v4 and later are mutually compatible, so there are no cross-version compatibility concerns.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| uses: actions/setup-node@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/lint-js.ymlRepository: langflow-ai/langflow
Length of output: 1608
🌐 Web query:
actions/setup-node v6 breaking changes requirements
💡 Result:
Key breaking changes / requirements in actions/setup-node v6
-
Automatic caching is now limited to npm: caching is automatically enabled only when package.json declares npm (either devEngines.packageManager or top-level packageManager = "npm"). Yarn and pnpm caching are disabled by default and must be enabled explicitly via the cache input. [1][2]
-
The deprecated always-auth input was removed — remove any uses of always-auth from your workflows. [1][2]
Sources:
- actions/setup-node README (Breaking changes in V6). [1]
- actions/setup-node v6 release notes. [2]
🌐 Web query:
actions/cache v5 runner version requirements
💡 Result:
Short answer: actions/cache@v5 requires Node.js 24 and a minimum GitHub Actions Runner version 2.327.1 (update any self-hosted runners before upgrading). [1][2]
Sources:
- actions/cache README / release notes. [1]
- v5 release notes. [2]
Fix cache-hit condition to reference the correct step output.
The version updates to actions/setup-node@v6 and actions/cache@v5 are valid and compatible with ubuntu-latest, which meets the minimum runner version requirement (v2.327.1).
However, line 48 has a critical logic error: steps.setup-node.outputs.cache-hit should be steps.npm-cache.outputs.cache-hit. The setup-node action does not output cache-hit; only the cache action does. This bug causes the npm install step to always run regardless of cache hit status.
Fix for line 48
if: ${{ steps.npm-cache.outputs.cache-hit != 'true' }}
🤖 Prompt for AI Agents
In @.github/workflows/lint-js.yml at line 30, The cache-hit condition is
referencing the wrong step output; replace any use of
steps.setup-node.outputs.cache-hit with the cache action's output
steps.npm-cache.outputs.cache-hit (e.g., update the npm install step's if:
condition to if: ${{ steps.npm-cache.outputs.cache-hit != 'true' }}), ensuring
the workflow checks the cache action's output rather than setup-node.
|
Thanks @pgoslatara - can you change the PR title from |
pgoslatara
changed the title
github-actions
bot
added
ignore-for-release
and removed
documentation
2 participants
This PR updates outdated GitHub Action versions.
actions/setup-nodefromv4tov6in.github/workflows/js_autofix.ymlactions/checkoutfromv3tov6in.github/workflows/migration-validation.ymlactions/setup-nodefromv4tov6in.github/workflows/jest_test.ymlactions/setup-nodefromv4tov6in.github/workflows/deploy_gh-pages.ymlactions/setup-nodefromv4tov6in.github/workflows/typescript_test.ymlactions/download-artifactfromv5tov7in.github/workflows/release_nightly.ymlactions/setup-pythonfromv4tov6in.github/workflows/migration-validation.ymlactions/download-artifactfromv5tov7in.github/workflows/release-lfx.ymlactions/setup-nodefromv4tov6in.github/workflows/python_test.ymlactions/setup-nodefromv4tov6in.github/workflows/deploy-docs-draft.ymlactions/setup-pythonfromv5tov6in.github/workflows/cross-platform-test.ymlactions/setup-nodefromv4tov6in.github/workflows/smoke-tests.ymlactions/setup-pythonfromv5tov6in.github/workflows/smoke-tests.ymlactions/download-artifactfromv5tov7in.github/workflows/release.ymlpeter-evans/create-pull-requestfromv7tov8in.github/workflows/store_pytest_durations.ymlactions/upload-artifactfromv4tov6in.github/workflows/cross-platform-test.ymlactions/cachefromv4tov5in.github/workflows/js_autofix.ymlactions/github-scriptfromv6tov8in.github/workflows/migration-validation.ymlactions/github-scriptfromv7tov8in.github/workflows/smoke-tests.ymlactions/setup-nodefromv4tov6in.github/workflows/docs_test.ymldocker/build-push-actionfromv5tov6in.github/workflows/release-lfx.ymlactions/cachefromv4tov5in.github/workflows/lint-js.ymlactions/upload-artifactfromv4tov6in.github/workflows/deploy-docs-draft.ymlactions/upload-artifactfromv4tov6in.github/workflows/python_test.ymlactions/setup-pythonfromv5tov6in.github/workflows/ci.ymlactions/setup-pythonfromv5tov6in.github/workflows/template-tests.ymlactions/cachefromv4tov5in.github/workflows/typescript_test.ymlactions/upload-artifactfromv4tov6in.github/workflows/release_nightly.ymlactions/setup-nodefromv4tov6in.github/workflows/lint-js.ymlactions/download-artifactfromv5tov7in.github/workflows/typescript_test.ymlactions/github-scriptfromv7tov8in.github/workflows/community-label.ymlactions/github-scriptfromv7tov8in.github/workflows/add-labels.ymlactions/upload-artifactfromv4tov6in.github/workflows/release.ymlpeter-evans/create-pull-requestfromv7tov8in.github/workflows/docs-update-openapi.ymlactions/github-scriptfromv7tov8in.github/workflows/request-docs-review.ymlactions/upload-artifactfromv4tov6in.github/workflows/jest_test.ymlactions/download-artifactfromv5tov7in.github/workflows/cross-platform-test.ymlactions/download-artifactfromv5tov7in.github/workflows/create-release.ymlactions/setup-nodefromv4tov6in.github/workflows/deploy-storybook.ymlactions/upload-artifactfromv4tov6in.github/workflows/release-lfx.ymlactions/github-scriptfromv7tov8in.github/workflows/store_pytest_durations.ymlactions/upload-artifactfromv4tov6in.github/workflows/typescript_test.ymlSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.