⬆️(ci) upgrade GitHub Actions workflow steps to latest versions#297
⬆️(ci) upgrade GitHub Actions workflow steps to latest versions#297StephanMeijer wants to merge 1 commit into
Conversation
WalkthroughUpdated GitHub Actions workflow references across multiple files: bumped Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This PR relates to other PR's:
|
|
✅ I manually reviewed this PR and it should work just fine. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/docker-hub.yml (1)
24-26: Consider SHA-pinning action references for supply-chain security.All action references in this PR use mutable major-version tags (e.g.,
@v6). For workflows that handle secrets and push to DockerHub, supply-chain security best practices recommend pinning to the specific commit SHA alongside the readable tag as a comment, so a tag reassignment cannot silently alter behavior.🛡️ Example SHA-pinned reference pattern
- uses: actions/checkout@v6 + uses: actions/checkout@<SHA> # v6.x.x🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/docker-hub.yml around lines 24 - 26, Replace mutable action tags like actions/checkout@v6 with SHA-pinned references to the exact commit to prevent silent changes; update the workflow entry that currently uses actions/checkout@v6 to reference the full commit SHA for that release and add the human-readable tag (e.g., `@v6`) as a comment for clarity, and do the same for any other action usages in the file to ensure supply-chain integrity..github/workflows/conversations.yml (1)
96-96:astral-sh/setup-uv@v6is behind the current recommendation ofv7.This is pre-existing and not changed in this PR, but since the PR is already aligning all actions to their latest major versions, it's worth considering bumping this too.
The official astral-sh documentation now recommends
astral-sh/setup-uv@v7for use with GitHub Actions.♻️ Suggested bump (also applies to line 196)
- uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@v7🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/conversations.yml at line 96, Update the GitHub Action usage string `astral-sh/setup-uv@v6` to the recommended major version `astral-sh/setup-uv@v7` in the workflow so it aligns with the current docs and other action bumps in this PR; search for occurrences of `astral-sh/setup-uv@v6` (including the second occurrence noted) and replace them with `astral-sh/setup-uv@v7`.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/conversations.yml:
- Line 96: Update the GitHub Action usage string `astral-sh/setup-uv@v6` to the
recommended major version `astral-sh/setup-uv@v7` in the workflow so it aligns
with the current docs and other action bumps in this PR; search for occurrences
of `astral-sh/setup-uv@v6` (including the second occurrence noted) and replace
them with `astral-sh/setup-uv@v7`.
In @.github/workflows/docker-hub.yml:
- Around line 24-26: Replace mutable action tags like actions/checkout@v6 with
SHA-pinned references to the exact commit to prevent silent changes; update the
workflow entry that currently uses actions/checkout@v6 to reference the full
commit SHA for that release and add the human-readable tag (e.g., `@v6`) as a
comment for clarity, and do the same for any other action usages in the file to
ensure supply-chain integrity.
The bot @coderabbitai is mistaken. I did not add |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 0 🏁 Script executed: Length of output: 2779
The |
Update all GitHub Actions to their latest major versions for improved performance, security patches, and Node.js runtime compatibility. Signed-off-by: Stephan Meijer <me@stephanmeijer.com>
StephanMeijer
force-pushed
the
feature/github-workflow-steps-update
branch
from
b44cab2 to
a77ab33
Compare
|
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/crowdin_upload.yml (1)
23-23: Optional: Consider pinning action versions to immutable commit SHAs.Major-version tags like
@v5/@v6are mutable — they can be silently updated by the upstream maintainer. Pinning to a full commit SHA (e.g.actions/checkout@<sha>) eliminates the risk of unexpected behaviour from a tag reassignment, at the cost of requiring manual updates.Also applies to: 26-26, 36-36, 52-52, 58-58
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/crowdin_upload.yml at line 23, Replace mutable major-version action refs with immutable commit SHAs: change uses: actions/checkout@v6 and the other mutable refs at the same workflow (the actions referenced at lines with uses entries for actions/checkout, actions/setup-node, actions/upload-artifact, etc.) to their corresponding full commit SHAs; locate the uses: entries for "actions/checkout@v6", the setup-node and other actions mentioned and update each to a pinned commit (actions/<name>@<sha>) so the workflow cannot change unexpectedly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/crowdin_upload.yml:
- Line 23: Replace mutable major-version action refs with immutable commit SHAs:
change uses: actions/checkout@v6 and the other mutable refs at the same workflow
(the actions referenced at lines with uses entries for actions/checkout,
actions/setup-node, actions/upload-artifact, etc.) to their corresponding full
commit SHAs; locate the uses: entries for "actions/checkout@v6", the setup-node
and other actions mentioned and update each to a pinned commit
(actions/<name>@<sha>) so the workflow cannot change unexpectedly.
ℹ️ Review info
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
.github/workflows/conversations-frontend.yml.github/workflows/conversations.yml.github/workflows/crowdin_download.yml.github/workflows/crowdin_upload.yml.github/workflows/dependencies.yml.github/workflows/docker-hub.yml.github/workflows/helmfile-linter.yaml.github/workflows/release-helm-chart.yaml
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/workflows/crowdin_download.yml
- .github/workflows/docker-hub.yml
- .github/workflows/release-helm-chart.yaml
- .github/workflows/conversations-frontend.yml
|
Rebased this branch on the latest target branch and force-pushed. |
2 participants
Purpose / Proposal
I was looking into adding Docker build support for
linux/arm64in several repositories of https://github.com/suitenumerique. During that, I noticed several repositories have outdated GitHub Workflow steps. This pull request has the purpose to update them.External contributions
git commit --signoff(DCO compliance)git commit -S)<gitmoji>(type) title description## [Unreleased]section (if noticeable change)Testing happens when GitHub Workflows are being executed.
The creation of this pull request was done semi-automatically. I did automate a bunch, but I reviewed all changes manually to check if they are backwards compatible.
Summary by CodeRabbit