ci: pin GitHub Actions refs and move Node to 24#869
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens GitHub Actions usage across the repo by switching workflow action references from moving tags (e.g., @v6) to SHA-pinned refs with version comments, and updates Node usage across workflows/generators from Node 20/22 to Node 24 LTS. It also updates the various workflow generators/templates/tests/docs so newly generated scaffolds default to these pinned refs.
Changes:
- Pin GitHub Actions
uses:references (workflows, templates, generators, fixtures, docs) to specific commit SHAs with version comments. - Move generated/workflow Node setup to Node
24and bumpactions/setup-nodeto the Node 24–compatible major. - Update generator/validation tests and scaffolding to expect SHA-pinned action refs.
Reviewed changes
Copilot reviewed 41 out of 41 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| plugin/sdk/generator.go | Pins action refs in the SDK plugin workflow generator output. |
| mcp/wfctl_tools.go | Updates MCP workflow generation to emit SHA-pinned actions and Node 24 for UI builds. |
| mcp/scaffold_tools.go | Updates MCP scaffolding to use centralized SHA-pinned action ref constants. |
| mcp/scaffold_tools_test.go | Updates scaffold tests to assert SHA-pinned checkout usage. |
| mcp/github_actions_refs.go | Introduces centralized SHA-pinned action ref constants for MCP generators. |
| docs/WFCTL.md | Updates documentation examples to use SHA-pinned actions. |
| docs/tutorials/deploy-pipeline.md | Updates tutorial workflow snippets to use SHA-pinned actions and updated majors. |
| docs/PLUGIN_RELEASE_GATES.md | Pins workflow action refs used in release gate documentation. |
| docs/manual/build-deploy/03-ci-deploy-environments.md | Pins action refs in CI/deploy environment documentation snippets. |
| cmd/wfctl/validate_test.go | Updates wfctl validation test fixture YAML to use pinned checkout ref. |
| cmd/wfctl/templates/ui-plugin/.github/workflows/release.yml.tmpl | Pins actions and bumps Node version in UI plugin release workflow template. |
| cmd/wfctl/templates/plugin/.github/workflows/release.yml.tmpl | Pins actions in plugin release workflow template. |
| cmd/wfctl/templates/full-stack/.github/workflows/ci.yml.tmpl | Pins actions and bumps Node version in full-stack CI template. |
| cmd/wfctl/templates/event-processor/.github/workflows/ci.yml.tmpl | Pins actions in event-processor CI template. |
| cmd/wfctl/templates/api-service/.github/workflows/ci.yml.tmpl | Pins actions in api-service CI template. |
| cmd/wfctl/generate.go | Updates the wfctl GitHub Actions generator to emit SHA-pinned refs + Node 24. |
| cmd/wfctl/generate_test.go | Updates generator tests to assert SHA-pinned action refs. |
| cmd/wfctl/ci_test.go | Updates CI generation tests to assert SHA-pinned action refs. |
| cmd/wfctl/ci_init.go | Updates wfctl ci init scaffolding to use SHA-pinned action refs. |
| cmd/wfctl/ci_init_test.go | Updates ci-init tests to assert SHA-pinned setup-wfctl action refs. |
| cmd/wfctl/build_image.go | Updates error guidance text to reference SHA-pinned buildx action usage. |
| cigen/validate_test.go | Updates cigen validation test YAML to use pinned checkout ref. |
| cigen/testdata/multisite/generated-infra.yml | Updates generated fixture to use SHA-pinned actions. |
| cigen/testdata/multisite/GAP.md | Updates cigen gap doc text to match the new pinning approach. |
| cigen/render_gha.go | Updates cigen GitHub Actions renderer to emit SHA-pinned actions. |
| cigen/render_gha_test.go | Adds/updates tests to ensure cigen output is SHA-pinned (and not tag-based). |
| .github/workflows/test-dispatch.yml | Pins repository-dispatch action in test workflow. |
| .github/workflows/release.yml | Pins actions and bumps Node version in release workflow. |
| .github/workflows/pre-release.yml | Pins actions and bumps Node version in pre-release workflow. |
| .github/workflows/helm-lint.yml | Pins checkout and setup-helm action refs. |
| .github/workflows/dependency-update.yml | Pins checkout/setup-go/create-pull-request action refs. |
| .github/workflows/cross-plugin-build-test.yml | Pins checkout/setup-go refs in cross-plugin build/test workflow. |
| .github/workflows/create-release.yml | Pins checkout/upload-artifact refs in create-release workflow. |
| .github/workflows/copilot-setup-steps.yml | Pins checkout/setup-go/buildx/golangci-lint action refs for Copilot setup steps. |
| .github/workflows/conformance-smoke.yml | Pins checkout/setup-go refs in conformance smoke workflow. |
| .github/workflows/conformance-leak-scrubber.yml | Pins checkout ref in leak scrubber workflow. |
| .github/workflows/conformance-budget-check.yml | Pins checkout/cache refs and aligns cache comment with pinned ref. |
| .github/workflows/codeql.yml | Pins checkout/setup-go/setup-node/codeql-action refs and bumps Node version. |
| .github/workflows/ci.yml | Pins key actions (checkout/setup-go/setup-node/lint/codecov/artifacts, etc.) and bumps Node version. |
| .github/workflows/ci-wfctl.yml.example | Updates example workflow to use pinned action refs. |
| .github/workflows/benchmark.yml | Pins checkout/setup-go/setup-node/cache/github-script/upload-artifact refs and bumps Node version. |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #868
Summary
Version checks
Verification
Notes