IBX-11778: Updated GitHub Actions to latest versions - #3345
Conversation
Bumped uses: refs to their latest release across all workflows, and standardized runs-on to ubuntu-26.04 per the bundle-generator skeleton. Kept existing pin styles (branch aliases and SHA pins) unchanged.
|
Preview of modified files: no change to preview. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Create Pull Request | ||
| uses: peter-evans/create-pull-request@v7 | ||
| uses: peter-evans/create-pull-request@v8 |
| python-version: ${{ matrix.python-version }} | ||
|
|
||
| - uses: "ramsey/composer-install@v3" | ||
| - uses: "ramsey/composer-install@v4" |
|
|
||
| - name: Commit changes | ||
| uses: stefanzweifel/git-auto-commit-action@v4 | ||
| uses: stefanzweifel/git-auto-commit-action@v7 |
|
|
||
| - name: Run markdownlint | ||
| uses: DavidAnson/markdownlint-cli2-action@v20 | ||
| uses: DavidAnson/markdownlint-cli2-action@v24 |
|
|
||
| - name: Run Vale.sh | ||
| uses: vale-cli/vale-action@v2 | ||
| uses: vale-cli/vale-action@v3 |
| - name: Find Comment | ||
| id: find-comment | ||
| uses: peter-evans/find-comment@v3 | ||
| uses: peter-evans/find-comment@v4 |
| - name: Create comment | ||
| if: steps.list.outputs.CODE_SAMPLES_CHANGE != '' && steps.diff.outputs.CODE_SAMPLES_DIFF != '0' | ||
| uses: peter-evans/create-or-update-comment@v4 | ||
| uses: peter-evans/create-or-update-comment@v5 |
| - name: Comment broken links | ||
| if: always() && github.event_name == 'pull_request' | ||
| uses: marocchino/sticky-pull-request-comment@v2 | ||
| uses: marocchino/sticky-pull-request-comment@v3 |
| - name: Find comment | ||
| id: find-comment | ||
| uses: peter-evans/find-comment@v3 | ||
| uses: peter-evans/find-comment@v4 |
|
|
||
| - name: Create or update comment | ||
| uses: peter-evans/create-or-update-comment@v4 | ||
| uses: peter-evans/create-or-update-comment@v5 |
Summary
|
|
I guess you're doing it for other repos as well, and it would make sense to have a consistent approach for all Engineering repos - we're ignoring the |
@mnocon my rules are:
Here 4) got intentionally violated, keeping rather your convention, to avoid confusing y'all and producing maintenance cost. I'm not going to do SHA everywhere for all other packages, because it's a huge maintenance cost. Every time a bug-fix comes out for that action, it requires updating. For instance GHSA-5wxr-w449-57cm on It's not an ideal situation because malicious actor can force-push a tag, especially a floating one. For that reason gh-workflows will use SHA pinning instead of tags or branches for all non-ibexa actions. If it's in one place, it's manageable. If we find good way to bulk update these, with Claude, then we might change the approach and use SHA everywhere. Or explicit tag, as long as action maintainer enabled immutable releases. @mnocon do you want me to switch here to SHAs? It could be one of the exceptional packages, along with gh-workflows and AFAIR archive-maker too, actually. |
The build job relied on the runner's default PHP, which was compatible under ubuntu-latest but ubuntu-26.04 ships PHP 8.5, exceeding PHP CS Fixer's supported max of 8.3.
3 participants
Related PRs:
Description:
Bumped all
uses:action references in.github/workflows/to their latest versions, and standardizedruns-on:toubuntu-26.04(the current standard derived from theibexa/bundle-generatoribexa-ossskeleton).Most bumps are MAJOR version jumps (repos hadn't been touched in a while):
actions/checkoutv3/v4 → v7actions/setup-pythonv3/v5 → v7stefanzweifel/git-auto-commit-actionv4 → v7DavidAnson/markdownlint-cli2-actionv20 → v24vale-cli/vale-actionv2 → v3actions/create-github-app-tokenv2 → v3actions/upload-artifactv4 → v7peter-evans/find-commentv3 → v4actions/github-scriptv6 → v9peter-evans/create-or-update-commentv4 → v5actions/setup-nodev4 → v7peter-evans/create-pull-requestv7 → v8actions/cachev4 → v6Pin styles were preserved, not changed:
ramsey/composer-installandmarocchino/sticky-pull-request-commentare pinned to version branches (v3/v2→v4/v3) in most files — kept as branch pins per that convention.ramsey/composer-installinrelease_composer_package.yamlis SHA-pinned separately — bumped the SHA to the4.0.0tag, kept the SHA-pin style.shivammathur/setup-php(SHA pin) andlycheeverse/lychee-action(SHA pin) were already current, no change.ibexa/gh-workflows/...@main(reviewers.yaml) is a deliberate trunk-tracking pin, left untouched.For QA:
No functional changes expected; this only bumps CI tooling versions and the runner image.
Documentation:
Review
🤖 Generated with Claude Code