Skip to content

Commit 3d2da34

Browse files
BartoszBlizniakclaude
BartoszBlizniak
and
claude
authored
chore(ENG-12754): upgrade pinned GitHub Actions to clear Node 20 deprecation (#312)
* ci: bump artifact and QEMU actions to Node 24 versions GitHub Actions annotations flagged actions/upload-artifact, actions/download-artifact, and docker/setup-qemu-action as running on the deprecated Node.js 20 runtime. Node 20 is forced off by default on 2026-06-16 and removed from runners on 2026-09-16. Bump to the Node 24 releases (SHA-pinned): - actions/upload-artifact v4.6.2 -> v7.0.1 - actions/download-artifact v4.3.0 -> v8.0.1 - docker/setup-qemu-action v3.7.0 -> v4.1.0 All artifact steps use upload/download by name (not artifact-ids), so the v5 single-artifact-by-ID path change does not apply. Downloads are single zipped artifacts, compatible with v8 hash-mismatch and direct-download defaults. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ci: bump remaining pinned actions to latest releases Update the rest of the SHA-pinned actions to their latest releases so the whole workflow fleet runs on the Node 24 runtime and current action code. - actions/checkout v6.0.1/v6.0.2 -> v6.0.3 - actions/setup-python 6.1.0 -> v6.2.0 - crate-ci/typos v1.42.1 -> v1.47.2 - docker/setup-buildx-action v3.12.0 -> v4.1.0 - pypa/gh-action-pypi-publish v1.13.0 -> v1.14.0 - softprops/action-gh-release v2.5.0 -> v3.0.0 - cloudsmith-io/cloudsmith-cli-action v2.0.1 -> v2.0.3 - zizmorcore/zizmor-action v0.3.0 -> v0.5.6 action-gh-release v3 and the artifact actions are Node 24 runtime bumps with no behavior change for this usage. zizmor-action v0.4/v0.5 only add opt-in options; defaults are unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ci: replace action-gh-release with gh CLI release step zizmor flagged softprops/action-gh-release as redundant: the gh CLI is preinstalled on GitHub-hosted runners, so a third-party action is not needed to create the release. Replacing it with a gh release create script step removes a supply-chain dependency. Behavior is unchanged: the release is created on the v* tag that triggered the run (GITHUB_REF_NAME, matching the action's default tag_name), titled "Release v$VERSION", with the zipapp uploaded as an asset and empty release notes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 parent 6ae4271 commit 3d2da34

4 files changed

Lines changed: 38 additions & 41 deletions

File tree

‎.github/workflows/lint.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ jobs:
1616
name: Check import sorting (isort)
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
19+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
2020
with:
2121
persist-credentials: false
2222

2323
- name: Set up Python
24-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
24+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2525
with:
2626
python-version: "3.10"
2727
cache: "pip"
@@ -39,12 +39,12 @@ jobs:
3939
name: Check code formatting (black)
4040
runs-on: ubuntu-latest
4141
steps:
42-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
42+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
4343
with:
4444
persist-credentials: false
4545

4646
- name: Set up Python
47-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
47+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
4848
with:
4949
python-version: "3.10"
5050
cache: "pip"
@@ -62,12 +62,12 @@ jobs:
6262
name: Check code style (flake8)
6363
runs-on: ubuntu-latest
6464
steps:
65-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
65+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
6666
with:
6767
persist-credentials: false
6868

6969
- name: Set up Python
70-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
70+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
7171
with:
7272
python-version: "3.10"
7373
cache: "pip"
@@ -85,12 +85,12 @@ jobs:
8585
name: Check for Python upgrades (pyupgrade)
8686
runs-on: ubuntu-latest
8787
steps:
88-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
88+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
8989
with:
9090
persist-credentials: false
9191

9292
- name: Set up Python
93-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
93+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
9494
with:
9595
python-version: "3.10"
9696
cache: "pip"
@@ -108,12 +108,12 @@ jobs:
108108
name: Run comprehensive linting (pylint)
109109
runs-on: ubuntu-latest
110110
steps:
111-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
111+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
112112
with:
113113
persist-credentials: false
114114

115115
- name: Set up Python
116-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
116+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
117117
with:
118118
python-version: "3.10"
119119
cache: "pip"
@@ -131,9 +131,9 @@ jobs:
131131
name: Check for typos (typos)
132132
runs-on: ubuntu-latest
133133
steps:
134-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
134+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
135135
with:
136136
persist-credentials: false
137137

138138
- name: Run typos
139-
uses: crate-ci/typos@65120634e79d8374d1aa2f27e54baa0c364fff5a # v1.42.1
139+
uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # v1.47.2

‎.github/workflows/release.yml‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@ jobs:
1919
CLOUDSMITH_SVC_SLUG: ${{ vars.CLOUDSMITH_SVC_SLUG }}
2020
DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
2121
steps:
22-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
2323
with:
2424
persist-credentials: false
2525

2626
- name: Set up Python 3.10
27-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
27+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2828
with:
2929
python-version: '3.10'
3030

@@ -76,15 +76,12 @@ jobs:
7676
--complete-platform .github/.platforms/windows-x86_64-py314.json
7777
7878
- name: Create Release and Upload Asset
79-
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
80-
with:
81-
name: Release v${{ env.VERSION }}
82-
files: ./cloudsmith.pyz
8379
env:
84-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
80+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
81+
run: gh release create "${GITHUB_REF_NAME}" ./cloudsmith.pyz --title "Release v${VERSION}" --notes ""
8582

8683
- name: Install and authenticate Cloudsmith CLI
87-
uses: cloudsmith-io/cloudsmith-cli-action@76c8ff51a34bea1036d9b7708f10a929624a1910 # v2.0.1
84+
uses: cloudsmith-io/cloudsmith-cli-action@159f1619275d5d3147f059c3cc110938ec221d16 # v2.0.3
8885
with:
8986
oidc-namespace: ${{ vars.CLOUDSMITH_NAMESPACE }}
9087
oidc-service-slug: ${{ vars.CLOUDSMITH_SVC_SLUG }}
@@ -103,10 +100,10 @@ jobs:
103100
run: cloudsmith push python "${CLOUDSMITH_NAMESPACE}/cli" "dist/cloudsmith_cli-${VERSION}-py2.py3-none-any.whl"
104101

105102
- name: Set up QEMU for multi-arch
106-
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
103+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
107104

108105
- name: Set up Docker Buildx
109-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
106+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
110107

111108
- name: Push Dockerised CLI to Cloudsmith (multi-arch)
112109
id: push_dockerised_cli_cloudsmith
@@ -143,12 +140,12 @@ jobs:
143140
id-token: write
144141
contents: read
145142
steps:
146-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
143+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
147144
with:
148145
persist-credentials: false
149146

150147
- name: Set up Python 3.10
151-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
148+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
152149
with:
153150
python-version: '3.10'
154151

@@ -161,6 +158,6 @@ jobs:
161158
run: python setup.py sdist bdist_wheel
162159

163160
- name: Publish to PyPI
164-
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
161+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
165162
with:
166163
packages-dir: dist/

‎.github/workflows/test.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,12 @@ jobs:
2222
python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
2323

2424
steps:
25-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
2626
with:
2727
persist-credentials: false
2828

2929
- name: Set up Python ${{ matrix.python-version }}
30-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
30+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
3131
with:
3232
python-version: ${{ matrix.python-version }}
3333
cache: 'pip'
@@ -50,7 +50,7 @@ jobs:
5050

5151
- name: Upload test results
5252
if: always()
53-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
53+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
5454
with:
5555
name: test-results-${{ matrix.python-version }}
5656
path: ./reports/pytest.xml
@@ -62,12 +62,12 @@ jobs:
6262
runs-on: ubuntu-latest
6363

6464
steps:
65-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
65+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
6666
with:
6767
persist-credentials: false
6868

6969
- name: Set up Python 3.10
70-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
70+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
7171
with:
7272
python-version: "3.10"
7373
cache: "pip"
@@ -122,7 +122,7 @@ jobs:
122122
STEPS_GET_VERSION_OUTPUTS_VERSION: ${{ steps.get_version.outputs.version }}
123123

124124
- name: Upload zipapp artifact
125-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
125+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
126126
with:
127127
name: cloudsmith-zipapp
128128
path: cloudsmith-${{ steps.get_version.outputs.version }}.pyz
@@ -142,7 +142,7 @@ jobs:
142142
image: python:${{ matrix.python-version }}-alpine
143143

144144
steps:
145-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
145+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
146146
with:
147147
persist-credentials: false
148148

@@ -151,7 +151,7 @@ jobs:
151151
run: echo "version=$(cat cloudsmith_cli/data/VERSION)" >> "$GITHUB_OUTPUT"
152152

153153
- name: Download zipapp artifact
154-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
154+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
155155
with:
156156
name: cloudsmith-zipapp
157157

@@ -179,12 +179,12 @@ jobs:
179179
python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
180180

181181
steps:
182-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
182+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
183183
with:
184184
persist-credentials: false
185185

186186
- name: Set up QEMU
187-
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
187+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
188188
with:
189189
platforms: linux/arm64
190190

@@ -193,7 +193,7 @@ jobs:
193193
run: echo "version=$(cat cloudsmith_cli/data/VERSION)" >> "$GITHUB_OUTPUT"
194194

195195
- name: Download zipapp artifact
196-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
196+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
197197
with:
198198
name: cloudsmith-zipapp
199199

@@ -220,12 +220,12 @@ jobs:
220220
python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
221221

222222
steps:
223-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
223+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
224224
with:
225225
persist-credentials: false
226226

227227
- name: Set up Python ${{ matrix.python-version }}
228-
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # 6.1.0
228+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
229229
with:
230230
python-version: ${{ matrix.python-version }}
231231

@@ -243,7 +243,7 @@ jobs:
243243
echo "version=$version" >> $env:GITHUB_OUTPUT
244244
245245
- name: Download zipapp artifact
246-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
246+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
247247
with:
248248
name: cloudsmith-zipapp
249249

‎.github/workflows/zizmor.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ jobs:
2424
actions: read
2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
27+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
2828
with:
2929
persist-credentials: false
3030

3131
- name: Run zizmor
32-
uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0
32+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

0 commit comments

Comments
 (0)