Upgrade GitHub Actions to latest versions #1529
Conversation
Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Generate artifact attestation | ||
| uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0 | ||
| uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.2.0 |
Check warning
Code scanning / zizmor
detects commit SHAs that don't match their version comment tags Warning
| rm -f artifacts/*-dist-manifest.json | ||
| - name: Attest | ||
| uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 | ||
| uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.2.0 |
Check warning
Code scanning / zizmor
detects commit SHAs that don't match their version comment tags Warning
There was a problem hiding this comment.
Pull request overview
This pull request upgrades GitHub Actions to their latest versions to benefit from security patches, new features, and performance improvements. The updates maintain the security practice of pinning actions to commit SHAs while updating to newer releases.
Changes:
- Updated 5 GitHub Actions across 6 workflow files, all pinned to new commit SHAs with updated version tags
- All actions remain pinned to commit SHAs (not semantic versions) to maintain immutable references for security
- Updated versions include:
actions/attest-build-provenance(v3.2.0),astral-sh/setup-uv(v7.2.1),docker/login-action(v3.7.0),j178/prek-action(v1.1.0), andtaiki-e/install-action(v2.67.18)
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/release.yml |
Updated actions/attest-build-provenance to v3.2.0 for artifact attestation |
.github/workflows/publish.yml |
Updated astral-sh/setup-uv to v7.2.1 for PyPI publishing workflow |
.github/workflows/publish-docs.yml |
Updated astral-sh/setup-uv to v7.2.1 for documentation publishing workflow |
.github/workflows/performance.yml |
Updated taiki-e/install-action to v2.67.18 for cargo-bloat installation |
.github/workflows/ci.yml |
Updated multiple actions: j178/prek-action to v1.1.0, taiki-e/install-action to v2.67.18 (9 occurrences), and astral-sh/setup-uv to v7.2.1 (3 occurrences) |
.github/workflows/build-docker.yml |
Updated docker/login-action to v3.7.0 (2 occurrences) and actions/attest-build-provenance to v3.2.0 for Docker image builds |
| rm -f artifacts/*-dist-manifest.json | ||
| - name: Attest | ||
| uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 | ||
| uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.2.0 |
There was a problem hiding this comment.
The spacing before the version comment should be consistent with the rest of the codebase. The existing convention in this repository uses a single space between the SHA and the comment (e.g., @sha # v1.0.0), but this change introduces two spaces. For consistency, this should use a single space like other action references in the workflow files.
| steps: | ||
| - name: "Install uv" | ||
| uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0 | ||
| uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1 |
There was a problem hiding this comment.
The spacing before the version comment should be consistent with the rest of the codebase. The existing convention in this repository uses a single space between the SHA and the comment (e.g., @sha # v1.0.0), but this change introduces two spaces. For consistency, this should use a single space like other action references in the workflow files.
| persist-credentials: false | ||
|
|
||
| - uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0 | ||
| - uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1 |
There was a problem hiding this comment.
The spacing before the version comment should be consistent with the rest of the codebase. The existing convention in this repository uses a single space between the SHA and the comment (e.g., @sha # v1.0.0), but this change introduces two spaces. For consistency, this should use a single space like other action references in the workflow files.
| with: | ||
| save-if: ${{ inputs.save-rust-cache == 'true' }} | ||
| - uses: taiki-e/install-action@81a2f66614862089b24532663f669a485d79c889 # v2.67.10 | ||
| - uses: taiki-e/install-action@650c5ca14212efbbf3e580844b04bdccf68dac31 # v2.67.18 |
There was a problem hiding this comment.
The spacing before the version comment should be consistent with the rest of the codebase. The existing convention in this repository uses a single space between the SHA and the comment (e.g., @sha # v1.0.0), but this change introduces two spaces. For consistency, this should use a single space like other action references in the workflow files.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1529 +/- ##
==========================================
- Coverage 92.02% 92.01% -0.01%
==========================================
Files 89 89
Lines 18500 18500
==========================================
- Hits 17024 17023 -1
- Misses 1476 1477 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Sorry, we don't do this manually, renovate will upgrade them automatically. |
2 participants
Summary
Upgrade GitHub Actions to their latest versions for improved features, bug fixes, and security updates.
Changes
actions/attest-build-provenance00014ed977bb37astral-sh/setup-uv61cb8a9803947bdocker/login-action5e57cd1c94ce9fj178/prek-action9d6a309564dda4taiki-e/install-action81a2f66650c5caWhy upgrade?
Keeping GitHub Actions up to date ensures:
Security Note
Actions that were previously pinned to commit SHAs remain pinned to SHAs (updated to the latest release SHA) to maintain the security benefits of immutable references.
Testing
These changes only affect CI/CD workflow configurations and should not impact application functionality. The workflows should be tested by running them on a branch before merging.