ci: update checkout action #9673
Conversation
WalkthroughUpdates CI configuration only: bumps actions/checkout to v5 across workflows, adds fetch-depth: 0 in autofix, updates nrwl/nx-set-shas in PR workflow, renames a workflow and a job, and upgrades packageManager in package.json to pnpm 10.17.0. No source code or exported entity changes. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Comment |
|
View your CI Pipeline Execution ↗ for commit b2902c0
☁️ Nx Cloud last updated this comment at |
|
Sizes for commit b2902c0:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9673 +/- ##
=======================================
Coverage 46.38% 46.38%
=======================================
Files 214 214
Lines 8488 8488
Branches 1927 1924 -3
=======================================
Hits 3937 3937
Misses 4108 4108
Partials 443 443 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
.github/workflows/pr.yml (2)
25-25: Checkout v5 in Test: good; optionally drop persisted credsSince this job doesn’t push, consider hardening by disabling persisted git creds.
- uses: actions/checkout@v5.0.0 + uses: actions/checkout@v5.0.0 with: + persist-credentials: false fetch-depth: 0
54-54: Checkout v5 in Preview: good; optionally disable credsSame optional hardening as Test job.
- uses: actions/checkout@v5.0.0 + uses: actions/checkout@v5.0.0 with: + persist-credentials: false fetch-depth: 0.github/workflows/release.yml (1)
30-30: Pin actions/checkout to commit SHAReplace
uses: actions/checkout@v5.0.0in .github/workflows/release.yml (line 30) withuses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/autofix.yml(1 hunks).github/workflows/pr.yml(3 hunks).github/workflows/release.yml(1 hunks)package.json(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-09-02T17:57:33.184Z
Learnt from: TkDodo
PR: TanStack/query#9612
File: packages/query-async-storage-persister/src/asyncThrottle.ts:0-0
Timestamp: 2025-09-02T17:57:33.184Z
Learning: When importing from tanstack/query-core in other TanStack Query packages like query-async-storage-persister, a workspace dependency "tanstack/query-core": "workspace:*" needs to be added to the package.json.
Applied to files:
package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Test
- GitHub Check: Preview
🔇 Additional comments (7)
package.json (1)
8-8: pnpm bump looks good; ensure CI installs 10.17.0Confirm tanstack/config setup step installs/activates pnpm 10.17.0 (via corepack or explicit install) so local and CI stay in sync.
Run to confirm in CI logs: look for “pnpm -v” after Setup Tools, or add a temporary step echoing the pnpm version.
.github/workflows/autofix.yml (2)
21-23: Upgrade to actions/checkout v5 with full history: LGTMfetch-depth: 0 is appropriate for tooling that might need full history (e.g., formatting/app fixes).
21-23: Pin actions/checkout to the release commit SHAReplace uses: actions/checkout@v5.0.0 with uses: actions/checkout@08c6903 to harden the supply chain.
File: .github/workflows/autofix.yml (lines 21–23). gh API shows v5.0.0 → 08c6903cd8c0fde910a37f88322edcfb5dd907a8; the ripgrep step failed to enumerate other workflow files — verify there are no additional uses of actions/checkout and update them if found..github/workflows/pr.yml (3)
33-33: nx-set-shas bump: LGTMInputs remain compatible; this should improve SHA detection reliability.
1-1: Confirm branch-protection required checks match workflow name "PR"
- Workflow name changed to "PR" in .github/workflows/pr.yml; if branch protection still expects "pr" the required check will be missing and PR checks will fail.
- I couldn't verify — gh api returned 403 (Resource not accessible by integration). Run (with a token that has repo admin):
gh api repos///branches/main/protection/required_status_checks | jq .
or open Settings → Branches → Branch protection rules for "main" and update the required checks to "PR" (or rename the workflow back to the expected name).
1-76: Verified — no actions/checkout@v4 references remain
Workflows use actions/checkout@v5.0.0: .github/workflows/pr.yml, .github/workflows/release.yml, .github/workflows/autofix.yml..github/workflows/release.yml (1)
24-26: Verify/update branch-protection required checks for renamed jobRenaming the job to "release" in .github/workflows/release.yml (lines 24–26) can break branch-protection rules that still expect the old job name. I couldn't verify the repo's required status checks because the GH API call returned HTTP 403 ("Resource not accessible by integration"). Confirm and update required status checks for protected branches to include "release" (or add it alongside the old name). To check (requires repo admin permissions):
gh api repos/OWNER/REPO/branches/BRANCH/protection/required_status_checks | jq .
Or use Settings → Branches → Branch protection rules in the GitHub UI.
Summary by CodeRabbit