Bump deprecated GitHub Action versions in CI

.github/actions/snippet_setup/action.yml

@@ -4,19 +4,19 @@ description: 'Set up LMFDB environment for generating snippets'
 runs:
   using: 'composite'
   steps:
-  - uses: actions/checkout@v3
+  - uses: actions/checkout@v7
 
-  - uses: conda-incubator/setup-miniconda@v2
+  - uses: conda-incubator/setup-miniconda@v4
     with:
       activate-environment: lmfdb
-      auto-activate-base: false
+      auto-activate: false
       # environment-file: .environment.yml # now we install after cache
       channel-priority: strict
       # IMPORTANT: use-only-tar-bz2: true needs to be set for caching to work properly!
       use-only-tar-bz2: false
 
   - name: Cache conda
-    uses: actions/cache@v3
+    uses: actions/cache@v6
     id: condacache
     env:
       # Increase this value to reset cache if .environment.yml has not changed
@@ -29,13 +29,19 @@ runs:
         hashFiles('.environment.yml') }}
 
   - name: Install Julia
-    uses: julia-actions/setup-julia@v2
+    uses: julia-actions/setup-julia@v3
     with:
       version: '1'          # latest version
 
   - name: Load Julia packages from cache
     id: julia-cache
-    uses: julia-actions/cache@v2      
+    uses: julia-actions/cache@v3
+    with:
+      # v3 defaults both of these to true; keep the v2 behaviour instead, so a
+      # failed job cannot publish a half-populated depot and cache deletion
+      # does not require an `actions: write` token.
+      save-always: false
+      delete-old-caches: false
 
   - name: Install Oscar
     shell: bash -l {0}
@@ -55,7 +61,7 @@ runs:
       conda list
 
   - name: Cache pip
-    uses: actions/cache@v3
+    uses: actions/cache@v6
     with:
       # This path is specific to Ubuntu
       path: ~/.cache/pip

.github/workflows/autopep8.yml

@@ -74,7 +74,7 @@ jobs:
         W504,
         W601,W602,W603,W604,W605,W690
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
         id: checkout
       - name: Process autopep8 codes
         id: process_codes
@@ -84,14 +84,14 @@ jobs:
           echo "AUTOPEP8_SELECT=$PROCESSED_CODES" >> $GITHUB_ENV
           echo "Processed codes: $PROCESSED_CODES"
       - name: autopep8
-        uses: peter-evans/autopep8@v1
+        uses: peter-evans/autopep8@v2
         if: ${{ github.repository }} == 'LMFDB/lmfdb'
         with:
           # Args using processed environment variable
           args: --recursive --in-place --aggressive --select=${{ env.AUTOPEP8_SELECT }} lmfdb/
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v8
         with:
           commit-message: autopep8 action fixes
           title: Fixes by autopep8 action

.github/workflows/python-package.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main, dev, web ]
 
+permissions:
+  contents: read
+
 jobs:
   matrix_prep:
     name: Initial setup
@@ -14,15 +17,49 @@ jobs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       # Required as the JSON input file needs to be read
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
-      - name: Conditional Build Matrix
+      # Only devmirror entries can run without the proddb password, so forks
+      # (which have no LMFDB_CI_ACCESS secret) get the devmirror half of
+      # .github/workflows/matrix_includes.json.  The secret itself is never
+      # passed here, only whether it is set.
+      - name: Build test matrix
         id: set-matrix
-        uses: JoshuaTheMiller/conditional-build-matrix@main
-        with:
-          # Filtering the default input file: '.github/workflows/matrix_includes.json'
-          # using JMESPath https://jmespath.org/examples.html
-          filter: "[? '${{ secrets.LMFDB_CI_ACCESS }}' || server == 'devmirror']"
+        env:
+          HAS_LMFDB_CI_ACCESS: ${{ secrets.LMFDB_CI_ACCESS != '' }}
+        shell: bash
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+
+          with open(
+              ".github/workflows/matrix_includes.json",
+              encoding="utf-8",
+          ) as matrix_file:
+              entries = json.load(matrix_file)
+
+          has_access = (
+              os.environ.get("HAS_LMFDB_CI_ACCESS", "").lower() == "true"
+          )
+          if not has_access:
+              entries = [
+                  entry
+                  for entry in entries
+                  if entry.get("server") == "devmirror"
+              ]
+
+          matrix = json.dumps(
+              {"include": entries},
+              separators=(",", ":"),
+          )
+          with open(
+              os.environ["GITHUB_OUTPUT"],
+              "a",
+              encoding="utf-8",
+          ) as output_file:
+              print(f"matrix={matrix}", file=output_file)
+          PY
 
 
   test:
@@ -33,19 +70,19 @@ jobs:
       matrix: ${{fromJson(needs.matrix_prep.outputs.matrix)}}
     name: ${{matrix.server}} ${{matrix.folders}}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
 
-    - uses: conda-incubator/setup-miniconda@v2
+    - uses: conda-incubator/setup-miniconda@v4
       with:
         activate-environment: lmfdb
-        auto-activate-base: false
+        auto-activate: false
         # environment-file: .environment.yml # now we install after cache
         channel-priority: strict
         # IMPORTANT: use-only-tar-bz2: true needs to be set for caching to work properly!
         use-only-tar-bz2: false
 
     - name: Cache conda
-      uses: actions/cache@v3
+      uses: actions/cache@v6
       id: condacache
       env:
         # Increase this value to reset cache if .environment.yml has not changed
@@ -71,7 +108,7 @@ jobs:
         conda list
 
     - name: Cache pip
-      uses: actions/cache@v3
+      uses: actions/cache@v6
       with:
         # This path is specific to Ubuntu
         path: ~/.cache/pip

.github/workflows/snippet_generate.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4 # Or a specific version
+        uses: actions/checkout@v7 # Or a specific version
 
       - name: Set up environment
         uses: ./.github/actions/snippet_setup
@@ -24,7 +24,7 @@ jobs:
           sage -python lmfdb/tests/generate_snippet_tests.py generate -i magma
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           commit-message: snippet code test files generated by action
           title: Code snippets from snippet-generate action

.github/workflows/snippet_test.yml

@@ -5,12 +5,17 @@ on:
     - cron: '0 0 1,15 * *'
   workflow_dispatch: {}
 
+permissions:
+  contents: read
+
 jobs:
   snippet-test:
     runs-on: ubuntu-latest
+    outputs:
+      has-snippet-errors: ${{ steps.snippet_errors.outputs.exists }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4 # Or a specific version
+        uses: actions/checkout@v7 # Or a specific version
 
       - name: Set up environment
         uses: ./.github/actions/snippet_setup
@@ -22,30 +27,42 @@ jobs:
         run: |
           sage -python lmfdb/tests/generate_snippet_tests.py generate -i magma -e snippet_error_file.md
 
-      - name: Read error file
-        if: ${{ hashFiles('**/snippet_error_file.md') }}
-        id: read_error_file
+      - name: Detect snippet errors
+        id: snippet_errors
+        if: ${{ !cancelled() }}
+        shell: bash
         run: |
-          {
-          echo 'ERROR_CONTENTS<<EOF'
-          cat snippet_error_file.md
-          echo EOF
-          } >> "$GITHUB_OUTPUT"
+          if [[ -f snippet_error_file.md ]]; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
 
-      - name: Create or update snippet error issue
-        if: ${{ hashFiles('**/snippet_error_file.md') }}
-        uses: ovsds/create-or-update-unique-issue-action@v1
+      # The report is handed to the report-snippet-errors job as an artifact so
+      # that this job, which runs the whole Conda/Julia/Oscar setup, never holds
+      # a token that can write issues.
+      - name: Upload snippet error report
+        if: >-
+          ${{
+            !cancelled() &&
+            steps.snippet_errors.outputs.exists == 'true'
+          }}
+        uses: actions/upload-artifact@v7
         with:
-          title: "(Auto-generated) Errors in code snippets"
-          body: ${{ steps.read_error_file.outputs.ERROR_CONTENTS }}
-          unique-title-includes: "(Auto-generated) Errors in code snippets"
+          name: snippet-error-report
+          path: snippet_error_file.md
+          if-no-files-found: error
+          retention-days: 7
 
       - name: Delete error log file
-        if: ${{ hashFiles('**/snippet_error_file.md') }}
-        shell: bash -l {0}
-        run: |
-          rm snippet_error_file.md
-
+        if: >-
+          ${{
+            !cancelled() &&
+            steps.snippet_errors.outputs.exists == 'true'
+          }}
+        shell: bash
+        run: rm snippet_error_file.md
+
       - name: Check for diff
         id: diff_check
         run: |
@@ -58,7 +75,64 @@ jobs:
 
       - name: Upload diff as artifact
         if: ${{ failure() && steps.diff_check.conclusion == 'failure' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: repo-diff
           path: changes.diff
+
+  report-snippet-errors:
+    name: Report snippet errors
+    needs: snippet-test
+    if: >-
+      ${{
+        always() &&
+        needs.snippet-test.outputs.has-snippet-errors == 'true'
+      }}
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+    steps:
+      - name: Download snippet error report
+        uses: actions/download-artifact@v8
+        with:
+          name: snippet-error-report
+          path: snippet-error-report
+
+      - name: Create or update snippet error issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ISSUE_TITLE: "(Auto-generated) Errors in code snippets"
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          report_path="snippet-error-report/snippet_error_file.md"
+          issue_number="$(
+            gh issue list \
+              --repo "$GITHUB_REPOSITORY" \
+              --state open \
+              --search "\"$ISSUE_TITLE\" in:title" \
+              --limit 100 \
+              --json number,title \
+              --jq \
+                'map(
+                   select(
+                     .title ==
+                     "(Auto-generated) Errors in code snippets"
+                   )
+                 )[0].number // empty'
+          )"
+
+          if [[ -n "$issue_number" ]]; then
+            gh issue edit "$issue_number" \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "$ISSUE_TITLE" \
+              --body-file "$report_path"
+          else
+            gh issue create \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "$ISSUE_TITLE" \
+              --body-file "$report_path"
+          fi