chore(ci): upgrade checkout to v5 #3
Conversation
WalkthroughUpdated the GitHub Actions test workflow to use actions/checkout@v5 instead of v3. All other steps, including submodule checkout (recursive), Foundry installation, build, and test steps, remain unchanged. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/test.yml (1)
16-18: If this workflow will run on pull_request from forks, harden credentials handling.Persisting the default token to the repo can be risky on forked PRs. This should disable persistence and still work for submodules if they’re public. If private submodules are required, revisit token scoping.
Proposed change:
- - uses: actions/checkout@v5 + - uses: actions/checkout@v5 with: submodules: recursive + persist-credentials: false + # Set to 0 only if your build/tests need full history or tags + # fetch-depth: 0Confirm whether:
- Submodules are public (works with persist-credentials: false), or
- You need private submodule access (use a fine-scoped PAT via
token:instead).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/test.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/test.yml (2)
16-18: Upgrade to actions/checkout@v5 is correct and necessary.This aligns the workflow with the Node 20+/runner requirements and keeps submodule behavior intact. No functional risk in this context.
16-18: No outdated actions/checkout references detectedI confirmed that
.github/workflowscontains onlytest.yml, which already usesactions/checkout@v5. There are no@v2or@v3occurrences in any workflow file—no further updates needed.
| - uses: actions/checkout@v5 | ||
| with: | ||
| submodules: recursive |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Optional hardening: pin the action to a fixed version (tag or SHA).
Using a floating major tag means the behavior can change on patch bumps. If your standards require determinism, pin to v5.0.0 or the corresponding commit SHA.
Use this to get the exact commit for v5.0.0:
Then update the step (example using a fixed tag):
- - uses: actions/checkout@v5
+ - uses: actions/checkout@v5.0.0Or pin to the full commit SHA if your policy mandates it:
- - uses: actions/checkout@v5
+ - uses: actions/checkout@<commit-sha>🏁 Script executed:
#!/bin/bash
# Get the commit SHA behind tag v5.0.0
git ls-remote --tags https://github.com/actions/checkout v5.0.0^{} | awk '{print $1}'Length of output: 89
🏁 Script executed:
#!/bin/bash
set -e
# Fetch all tags, filter for v5.x, sort, and pick the latest
latest_tag=$(git ls-remote --tags https://github.com/actions/checkout \
| awk '{print $2}' \
| sed 's#refs/tags/##' \
| grep '^v5\.' \
| sort -V \
| tail -1)
echo "Latest v5 tag: $latest_tag"
# Resolve the commit SHA behind that tag
git ls-remote --tags https://github.com/actions/checkout "${latest_tag}^{}" | awk '{print $1}'Length of output: 311
🏁 Script executed:
#!/bin/bash
set -e
# Retrieve the commit SHA for the lightweight tag v5.0.0
git ls-remote --tags https://github.com/actions/checkout v5.0.0 | awk '{print $1}' | head -1Length of output: 144
Pin checkout action to a fixed version or commit SHA
Floating the major tag allows untracked patch changes. This should be pinned to v5.0.0 or the exact SHA for determinism.
• File: .github/workflows/test.yml (lines 16–18)
• Commit SHA for v5.0.0: 08c6903cd8c0fde910a37f88322edcfb5dd907a8
Use one of the following diffs:
Pin to tag v5.0.0:
- - uses: actions/checkout@v5
+ - uses: actions/checkout@v5.0.0Or pin to exact SHA:
- - uses: actions/checkout@v5
+ - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v5 | |
| with: | |
| submodules: recursive | |
| - uses: actions/checkout@v5.0.0 | |
| with: | |
| submodules: recursive |
| - uses: actions/checkout@v5 | |
| with: | |
| submodules: recursive | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 | |
| with: | |
| submodules: recursive |
🤖 Prompt for AI Agents
In .github/workflows/test.yml around lines 16 to 18, the checkout action is
using the floating major tag "actions/checkout@v5" which can pull unintended
patch changes; update the uses value to a pinned reference by replacing
"actions/checkout@v5" with either the fixed tag "actions/checkout@v5.0.0" or the
exact commit SHA "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" to
ensure deterministic CI behavior.
1 participant
GitHub-hosted runners now use Node 24, so actions/checkout@v5 is required. Minimum runner version v2.327.1. Workflows only updated—no functional changes.
See: https://github.com/actions/checkout/releases/tag/v5.0.0
Summary by CodeRabbit