Update github actions (major)#2254
Conversation
merge
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While the PR successfully upgrades several core GitHub Actions and is considered 'up to standards' by Codacy, there are critical functional considerations regarding breaking changes in the new major versions.
Key risks include the migration to ESM in actions/github-script, which will break any existing logic using require(), and the new default exclusion of dotfiles in actions/upload-pages-artifact. Furthermore, several workflows modified in this PR are synchronized from templates; manual changes to these files will likely be overwritten in future synchronization cycles. These items should be addressed to ensure the reliability of the CI/CD pipeline and maintain configuration integrity.
About this PR
- The upgrade to the latest major version of actions/github-script represents an ESM-only migration. Any internal scripts within your workflows that utilize
require('@actions/github')will fail at runtime. Ensure all inline or referenced scripts are updated to use ESMimportsyntax or the provided global context.
Test suggestions
- Verify that documentation artifacts uploaded via actions/upload-pages-artifact still render correctly on GitHub Pages, specifically checking for the presence of hidden files like .nojekyll.
- Validate that internal JavaScript logic in squad-heartbeat.yml and squad-issue-assign.yml remains compatible with the ESM-only actions/github-script@v9 (no use of require('@actions/github')).
- Confirm that the deployment workflow in deploy-pages.yml successfully executes with actions/deploy-pages@v5.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that documentation artifacts uploaded via actions/upload-pages-artifact still render correctly on GitHub Pages, specifically checking for the presence of hidden files like .nojekyll.
2. Validate that internal JavaScript logic in squad-heartbeat.yml and squad-issue-assign.yml remains compatible with the ESM-only actions/github-script@v9 (no use of require('@actions/github')).
3. Confirm that the deployment workflow in deploy-pages.yml successfully executes with actions/deploy-pages@v5.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
This workflow is marked as a synchronized file managed via a source template (templates/workflows/squad-heartbeat.yml). Manual changes here create configuration drift and risk being overwritten during the next synchronization. Please apply these updates to the source template or use the 'squad' utility to maintain consistency across all managed locations.
| - name: 📤 Upload Pages artifact | ||
| if: github.ref == 'refs/heads/main' | ||
| uses: actions/upload-pages-artifact@v3 | ||
| uses: actions/upload-pages-artifact@v5 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Starting with the recent major version updates, this action excludes dotfiles by default. If the 'artifacts/docs' directory requires a .nojekyll file or other hidden configuration files for correct GitHub Pages rendering, you must now explicitly set the 'include-hidden-files' input to true.
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
from
0ae219d to
591e8c7
Compare
This PR contains the following updates:
v4→v7v4→v5v7→v9v3→v5Release Notes
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
v5Compare Source
actions/deploy-pages (actions/deploy-pages)
v5.0.0Compare Source
Changelog
See details of all code changes since previous release.
v5Compare Source
actions/github-script (actions/github-script)
v9.0.0Compare Source
New features:
getOctokitfactory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients withgetOctokitfor details and examples.ACTIONS_ORCHESTRATION_IDenvironment variable is automatically appended to the user-agent string for request tracing.Breaking changes:
require('@​actions/github')no longer works in scripts. The upgrade to@actions/githubv9 (ESM-only) meansrequire('@​actions/github')will fail at runtime. If you previously used patterns likeconst { getOctokit } = require('@​actions/github')to create secondary clients, use the new injectedgetOctokitfunction instead — it's available directly in the script context with no imports needed.getOctokitis now an injected function parameter. Scripts that declareconst getOctokit = ...orlet getOctokit = ...will get aSyntaxErrorbecause JavaScript does not allowconst/letredeclaration of function parameters. Use the injectedgetOctokitdirectly, or usevar getOctokit = ...if you need to redeclare it.@actions/githubinternals beyond the standardgithub/octokitclient, you may need to update those references for v9 compatibility.What's Changed
New Contributors
Full Changelog: actions/github-script@v8.0.0...v9.0.0
v9Compare Source
v8.0.0Compare Source
v8: .0.0Compare Source
What's Changed
v2.327.1
Release Notes
Make sure your runner is updated to this version or newer to use this release.
New Contributors
Full Changelog: actions/github-script@v7.1.0...v8.0.0
actions/upload-pages-artifact (actions/upload-pages-artifact)
v5.0.0Compare Source
Changelog
include-hidden-filesinput @jonchurch (#137)See details of all code changes since previous release.
v5Compare Source
v4.0.0Compare Source
What's Changed
If you need to include dotfiles in your artifact: instead of using this action, create your own artifact according to these requirements https://github.com/actions/upload-pages-artifact?tab=readme-ov-file#artifact-validation
actions/upload-artifactto SHA by @heavymachinery in #127Full Changelog: actions/upload-pages-artifact@v3.0.1...v4.0.0
v4Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.