chore(deps): refresh all upstream action pins and tool defaults - #71
Merged
Conversation
Audited every pinned upstream action by resolving its SHA against upstream tags (the version comments were verified, not trusted). 15 of 23 were behind. Notable majors: setup-uv v8.2.0 -> v10.0.1, checkout v6.0.3 -> v7.0.1, cache v5.0.5 -> v6.1.0, setup-node/setup-go v6.4.0 -> v7.0.0. The actions/* majors are ESM/dependency migrations with no input changes and were already node24, so they need no newer runner agent than the old pins. Two behaviour changes, both checked against usage here: - checkout v7 refuses to check out a fork PR head under pull_request_target / workflow_run. No workflow here does that; consumers that do will need to stay on v6 or redesign. - setup-uv v9 flips prune-cache to false; v10 disables caching under pull_request_target / workflow_run / release when enable-cache is auto. Every caching call site here sets enable-cache: true explicitly, so v10's default change is inert. Also bumped the pinned tool-version input defaults (trivy, cosign, sops, age, tofu); each download URL was preflighted against upstream release assets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AdnSdFQLSYFwWnS8tXU5KQ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Audited all 23 distinct upstream actions (68 call sites) by resolving every pinned SHA against upstream tags — the trailing version comments were verified, not trusted. 15 were behind; 8 were already current.
astral-sh/setup-uvactions/checkoutactions/cacheactions/setup-nodeactions/setup-gogithub/codeql-action/upload-sarifanthropics/claude-code-actiondocker/login-actiondocker/setup-buildx-actiondocker/setup-qemu-actiondocker/metadata-actiondocker/build-push-actionerlef/setup-beamanchore/sbom-actionopentofu/setup-opentofuAlready latest:
upload-artifactv7.0.1,create-github-app-tokenv3.2.0,trivy-actionv0.36.0,fetch-metadatav3.1.0,setup-bunv2.2.0,cosign-installerv4.1.2,auto-assign-issuev4.0.1,expo-github-action9.0.0.Behaviour changes worth reviewing
Both were checked against actual usage in this repo:
checkoutv7 refuses to check out a fork PR head underpull_request_target/workflow_run. No workflow here does that — the onlyref:uses areinputs.default-branch(auto-revert) andgithub.head_ref(dependabot-uv-lockfile, same-repo branches). Consumers that check out a fork head from those events will needactions/checkout@v6in their own workflows or a redesign.setup-uvcrosses two breaking releases: v9 flipsprune-cachetofalse(larger caches, evicted by GitHub's per-repo LRU — no billing impact), and v10 disables caching underpull_request_target/workflow_run/releasewhenenable-cacheis left atauto. All six caching call sites here setenable-cache: trueexplicitly, so v10's default change is inert for them.The four
actions/*majors are ESM/dependency migrations with no input surface changes, and all were alreadynode24— no newer runner agent required than the old pins.Tool-version input defaults
Bumped to current releases; each download URL was preflighted against the upstream release assets (all 200).
setup-trivytrivy-versionsetup-cosigncosign-versionsetup-sopssops-versionsetup-sopsage-versionopentofu.ymltofu-versionAlready current: taplo 0.10.0, betterleaks 1.8.1, actionlint 1.7.12,
trivy-action-version0.36.0.Docs
Example snippets now show
actions/checkout@v7,astral-sh/setup-uv@v10,actions/labeler@v7(labeler's config format is unchanged since v5).Test plan
actionlintcleanyamllint— only the three pre-existing line-length warnings inclaude-code-review.ymlself-test.ymlgreen on this PR🤖 Generated with Claude Code
https://claude.ai/code/session_01AdnSdFQLSYFwWnS8tXU5KQ