From d5242375817cec2648ccf67b0d056e1aeeef36c5 Mon Sep 17 00:00:00 2001 From: Anto Subash Date: Thu, 6 Aug 2026 10:21:29 +0200 Subject: [PATCH] chore(ci): update all GitHub Actions to latest majors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps every action used by pr.yml and release.yml to its current latest release: actions/checkout v6 -> v7 (v7.0.1) actions/setup-node v6 -> v7 (v7.0.0) actions/cache v5 -> v6 (v6.1.0) actions/upload-artifact v6 -> v7 (v7.0.1) actions/download-artifact v7 -> v8 (v8.0.1) astral-sh/setup-uv v8.0.0 -> v9.0.0 pypa/gh-action-pypi-publish stays on @release/v1 — that's the moving ref upstream recommends and it already resolves to the newest v1 (v1.14.2); there is no v2. Breaking changes reviewed against actual usage — none bite: - checkout v7 blocks checking out fork PRs under `pull_request_target` / `workflow_run`. Neither workflow uses those triggers (pr.yml is `pull_request`, release.yml is `workflow_dispatch`). - setup-node v7 stops exporting the dummy NODE_AUTH_TOKEN placeholder. This helps the publish-npm job, which uses OIDC Trusted Publishing — the placeholder could previously pollute .npmrc during OIDC publish. - download-artifact v8 now errors instead of warning on a digest mismatch, and skips decompressing non-zip downloads. Our artifacts are uploaded with the default `archive: true`, so they still unzip normally; the stricter digest check is a straight win. - cache v6, upload-artifact v7 and the rest of setup-node v7 are ESM migrations with no behavioural change for these call sites. One deliberate behaviour change: setup-uv v9 flips `prune-cache` to false by default, so the uv cache keeps prebuilt wheels instead of re-fetching them from PyPI each run. Faster CI at the cost of a larger cache entry — all jobs share one key (hash of UV_CACHE_GLOB), so this is a single entry growing, not one per job. Left at the new default; set `prune-cache: true` if repo cache pressure ever becomes an issue. Verified: actionlint clean on both workflows, YAML parses. Claude-Session: https://claude.ai/code/session_01KzBTj2GWBXhG8gbTorDYjW --- .github/workflows/pr.yml | 60 +++++++++++++++++------------------ .github/workflows/release.yml | 24 +++++++------- 2 files changed, 42 insertions(+), 42 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 6ef045e6..169e9da3 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -30,8 +30,8 @@ jobs: name: Python lint & format runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: astral-sh/setup-uv@v8.0.0 + - uses: actions/checkout@v7 + - uses: astral-sh/setup-uv@v9.0.0 with: enable-cache: true cache-dependency-glob: ${{ env.UV_CACHE_GLOB }} @@ -42,8 +42,8 @@ jobs: name: Python typecheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: astral-sh/setup-uv@v8.0.0 + - uses: actions/checkout@v7 + - uses: astral-sh/setup-uv@v9.0.0 with: enable-cache: true cache-dependency-glob: ${{ env.UV_CACHE_GLOB }} @@ -54,8 +54,8 @@ jobs: name: Python tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: astral-sh/setup-uv@v8.0.0 + - uses: actions/checkout@v7 + - uses: astral-sh/setup-uv@v9.0.0 with: enable-cache: true cache-dependency-glob: ${{ env.UV_CACHE_GLOB }} @@ -66,8 +66,8 @@ jobs: name: JS tests (Vitest) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} cache: "npm" @@ -78,8 +78,8 @@ jobs: name: JS lint & format runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} cache: "npm" @@ -90,14 +90,14 @@ jobs: name: JS typecheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} cache: "npm" # Need uv too — pages.ts imports ./modules.generated, which is # produced by `smpy gen-pages` from the installed Python modules. - - uses: astral-sh/setup-uv@v8.0.0 + - uses: astral-sh/setup-uv@v9.0.0 with: enable-cache: true cache-dependency-glob: ${{ env.UV_CACHE_GLOB }} @@ -110,14 +110,14 @@ jobs: name: JS build (Vite) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} cache: "npm" # gen-pages needs the Python modules installed so Vite's import.meta.glob # sees every module's pages/ dir — which is how dep-scan failures surface. - - uses: astral-sh/setup-uv@v8.0.0 + - uses: astral-sh/setup-uv@v9.0.0 with: enable-cache: true cache-dependency-glob: ${{ env.UV_CACHE_GLOB }} @@ -152,12 +152,12 @@ jobs: SM_MODULES_ENABLED: '["Auth","Users","Dashboard","Permissions","Settings","BackgroundTasks","FileStorage","FeatureFlags","AuditLog"]' E2E_BASE_URL: http://localhost:8000 steps: - - uses: actions/checkout@v6 - - uses: astral-sh/setup-uv@v8.0.0 + - uses: actions/checkout@v7 + - uses: astral-sh/setup-uv@v9.0.0 with: enable-cache: true cache-dependency-glob: ${{ env.UV_CACHE_GLOB }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} cache: "npm" @@ -168,7 +168,7 @@ jobs: # the GH runner image since most libs are preinstalled. - name: Cache Playwright browsers id: playwright-cache - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.cache/ms-playwright key: playwright-${{ runner.os }}-${{ hashFiles('uv.lock') }} @@ -202,7 +202,7 @@ jobs: - run: make test-e2e - name: Upload server logs on failure if: failure() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: e2e-server-logs path: | @@ -232,19 +232,19 @@ jobs: PERF_BASE_URL: http://localhost:8000 PERF_BUILD: ci-prod steps: - - uses: actions/checkout@v6 - - uses: astral-sh/setup-uv@v8.0.0 + - uses: actions/checkout@v7 + - uses: astral-sh/setup-uv@v9.0.0 with: enable-cache: true cache-dependency-glob: ${{ env.UV_CACHE_GLOB }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} cache: "npm" - run: make install - name: Cache Playwright browsers id: playwright-cache - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: ~/.cache/ms-playwright key: playwright-${{ runner.os }}-${{ hashFiles('uv.lock') }} @@ -296,7 +296,7 @@ jobs: - run: uv run pytest -m "perf and e2e" tests/perf/test_page_load.py tests/perf/test_asset_integrity.py -v -s - name: Upload server log on failure if: failure() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: perf-guards-api-log path: api.log @@ -305,8 +305,8 @@ jobs: name: File size (300-line cap) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: astral-sh/setup-uv@v8.0.0 + - uses: actions/checkout@v7 + - uses: astral-sh/setup-uv@v9.0.0 with: enable-cache: true cache-dependency-glob: ${{ env.UV_CACHE_GLOB }} @@ -323,8 +323,8 @@ jobs: name: Package build (release dry-run) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: astral-sh/setup-uv@v8.0.0 + - uses: actions/checkout@v7 + - uses: astral-sh/setup-uv@v9.0.0 with: enable-cache: true cache-dependency-glob: ${{ env.UV_CACHE_GLOB }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c4683b3f..fc730fbf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,7 +30,7 @@ jobs: outputs: version: ${{ steps.compute.outputs.version }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 - id: compute @@ -69,13 +69,13 @@ jobs: needs: resolve runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: astral-sh/setup-uv@v8.0.0 + - uses: astral-sh/setup-uv@v9.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} - name: Bump all package versions (working tree only) @@ -90,12 +90,12 @@ jobs: for pkg in packages/*/; do npm pack "$pkg" --pack-destination dist-npm done - - uses: actions/upload-artifact@v6 + - uses: actions/upload-artifact@v7 with: name: dist-py path: dist-py/ retention-days: 14 - - uses: actions/upload-artifact@v6 + - uses: actions/upload-artifact@v7 with: name: dist-npm path: dist-npm/ @@ -130,7 +130,7 @@ jobs: name: pypi url: https://pypi.org/project/${{ matrix.package }}/ steps: - - uses: actions/download-artifact@v7 + - uses: actions/download-artifact@v8 with: name: dist-py path: dist-py/ @@ -163,11 +163,11 @@ jobs: package: [ui, i18n, tsconfig] environment: npm steps: - - uses: actions/download-artifact@v7 + - uses: actions/download-artifact@v8 with: name: dist-npm path: dist-npm/ - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} registry-url: 'https://registry.npmjs.org' @@ -201,14 +201,14 @@ jobs: needs: [resolve, publish-pypi, publish-npm] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 token: ${{ secrets.RELEASE_PUSH_TOKEN || github.token }} - - uses: astral-sh/setup-uv@v8.0.0 + - uses: astral-sh/setup-uv@v9.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} - name: Re-apply version bump