[TASK] Update and SHA-pin all GitHub Actions#1184
Conversation
CybotTM
changed the title
|
The best course of action seems to be to merge this and try it out and watch the first runs of the pipelines. I see less risk in hardening the versions but you made major upgrades to some versions so we would have to watch the pipelines closely. Best would be to merge this when no TYPO3 Core releases are planned that week so we dont have suddenly all the important manuals rendering. |
CybotTM
force-pushed
the
feature/update-actions
branch
from
c8903b8 to
123d809
Compare
|
Despite switching to commit hashes not discussing it for now, this pull-requests misses to provide a detail analysis and risk-assesment about raising marketplace action one or in some cases two major versions. Actions following semver could introduce breaking things with new versions, dropping stuff and similar and possibile need adjustments. None of them is contained or mentioned in the pull-request nor the single commit messages. Taken into account that this pull-request not only changes the version of official github provided actions, but also 3rd party market place actions this is would have to read that up. Can you please provide a detailed risk-assesment about the raises and the analysis if there are changes or a statement about that it is okay with a reasoning for each of the updated action ? Note The list needs to be reviewable and easy verifiable, providing links Important DISCLAIMER Not part of the documentation team, above mentioned |
|
I am done with the PR, close it if it does not meet your ad-hoc requirements. I'm fine with rejecting this PR, would just be nice to have such requirements defined upfront not afterwards. |
|
I added the major version changes, I skipped minor and bugfix, as these are already auto-merged currently. |
|
Save CO² - update your node! ;-) |
|
To make review easie rand reduce scope, I would suggest to avoid mixing concerns and do the SHA pinning and Major version bumbs in separate PRs. That way we can review the structural change (pinning) independently from the version upgrades. |
CybotTM
force-pushed
the
feature/update-actions
branch
from
123d809 to
0ac7156
Compare
CybotTM
force-pushed
the
feature/update-actions
branch
from
0ac7156 to
b678c6c
Compare
CybotTM
force-pushed
the
feature/update-actions
branch
from
0a5f91a to
e9a6fba
Compare
CybotTM
force-pushed
the
feature/update-actions
branch
3 times, most recently
from
ada2863 to
fa10807
Compare
CybotTM
force-pushed
the
feature/update-actions
branch
from
fa10807 to
74bc804
Compare
Updates and SHA-pins all GitHub Actions in non-CI workflow files (Docker, deploy, split-repositories, Dependabot auto-merge/approve). main.yaml is excluded — it will be migrated to shared reusable workflows via TYPO3-Documentation#1196. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
CybotTM
force-pushed
the
feature/update-actions
branch
from
74bc804 to
70225eb
Compare
3 participants
Summary
Updates and SHA-pins all GitHub Actions in non-CI workflow files for supply
chain security.
main.yamlis excluded from this PR — it will be migrated to shared reusableworkflows via #1196.
Files changed
.github/workflows/docker.yaml— metadata-action, login-action, setup-qemu, setup-buildx, build-push, upload/download-artifact, checkout.github/workflows/docker-test.yaml— checkout.github/workflows/deploy-azure-assets.yaml— checkout.github/workflows/split-repositories.yaml— checkout, cache, use-github-token, use-subsplit-publish.github/workflows/pr-auto-merge.yaml— dependabot/fetch-metadata.github/workflows/pr-auto-approve.yaml— dependabot/fetch-metadataVersion updates
All versions verified as latest releases via the GitHub API on 2026-07-04.
9c091bb255cc8345dc802804af1e73f996fe6ef7bb05f3f553b7df96043fb46d3e5f45b225dd0e3415e6289d00010151Reviewer note on test coverage
Several bumps cross a major version (docker/* actions, upload/download-artifact, fetch-metadata, cache). Their latest release notes show no input/behavior breaking changes affecting our usage, but note that
docker.yaml(publish path),split-repositories.yamlanddeploy-azure-assets.yamlonly run on push/tag events, so PR CI does not exercise them — worth a close look at the first post-merge runs.Related
main.yamlto shared reusable workflows