Skip to content

chore: upgrade GitHub Actions versions#554

Open
vinitkumar wants to merge 3 commits into
masterfrom
codex/actions-upgrade-20260414
Open

chore: upgrade GitHub Actions versions#554
vinitkumar wants to merge 3 commits into
masterfrom
codex/actions-upgrade-20260414

Conversation

@vinitkumar
Copy link
Copy Markdown
Member

@vinitkumar vinitkumar commented Apr 14, 2026

Summary

  • upgrade outdated GitHub Actions versions listed in the repository audit
  • align workflow action references with their current supported versions

Testing

  • not run (workflow-only change)

Summary by Sourcery

Update GitHub Actions workflows to use current supported action versions across code analysis, linting, testing, coverage reporting, and publishing pipelines.

CI:

  • Bump actions/checkout to v6 across all workflows using versioned references.
  • Upgrade CodeQL actions from v2 to v4 in the codeql analysis workflow.
  • Update actions/setup-python from older major versions to v6 in lint, test, screenshots, and publish workflows.
  • Upgrade liskin/gh-problem-matcher-wrap, codecov/codecov-action, and other third-party actions to their latest specified major versions in CI workflows.

@vinitkumar vinitkumar requested a review from fsbraun April 14, 2026 04:48
@sourcery-ai
Copy link
Copy Markdown

sourcery-ai Bot commented Apr 14, 2026

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates all GitHub Actions workflow references to current, supported major versions for checkout, Python setup, CodeQL, problem-matcher wrapper, and Codecov, without changing workflow logic or behavior intent.

File-Level Changes

Change Details Files
Upgrade CodeQL workflow actions to the latest supported major versions.
  • Bump actions/checkout used by the CodeQL job from v3 to v6.
  • Update github/codeql-action init, autobuild, and analyze steps from v2 to v4 while keeping existing language matrix and query configuration.
.github/workflows/codeql.yml
Modernize lint workflows to use current actions for checkout, Python setup, and problem matcher.
  • Upgrade actions/checkout from v2/v4 to v6 in lint and ruff jobs.
  • Upgrade actions/setup-python from v2 to v6 for the flake8 job while retaining Python 3.9 configuration.
  • Bump liskin/gh-problem-matcher-wrap from v1 to v3 for the flake8 step.
.github/workflows/lint.yml
Refresh test workflow actions to latest major versions for checkout, Python setup, and Codecov upload.
  • Upgrade actions/checkout from v1 to v6 in the test job.
  • Upgrade actions/setup-python from v2 to v6 for matrix Python setup.
  • Bump codecov/codecov-action from v1 to v6 for coverage upload.
.github/workflows/test.yml
Update screenshots workflow to use current checkout and Python setup actions.
  • Upgrade actions/checkout from v1 to v6.
  • Upgrade actions/setup-python from v2 to v6 while preserving matrix configuration.
.github/workflows/screenshots.yml
Align PyPI publish workflows with latest Python setup action while keeping release logic unchanged.
  • Upgrade actions/setup-python from v1 to v6 in the live PyPI publish workflow.
  • Upgrade actions/setup-python from v1 to v6 in the test PyPI publish workflow.
.github/workflows/publish-to-live-pypi.yml
.github/workflows/publish-to-test-pypi.yml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link
Copy Markdown

@sourcery-ai sourcery-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • In the publish-to-*-pypi workflows, uses: actions/checkout@master is still present; consider updating these to actions/checkout@v6 for consistency with the other workflows and to avoid relying on the default branch.
  • You are bumping to major versions of third-party actions (e.g., Codecov, CodeQL, checkout); consider pinning to specific commit SHAs or at least verifying the new versions’ required inputs/behavior to avoid unexpected breaking changes in CI.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- In the publish-to-*-pypi workflows, `uses: actions/checkout@master` is still present; consider updating these to `actions/checkout@v6` for consistency with the other workflows and to avoid relying on the default branch.
- You are bumping to major versions of third-party actions (e.g., Codecov, CodeQL, checkout); consider pinning to specific commit SHAs or at least verifying the new versions’ required inputs/behavior to avoid unexpected breaking changes in CI.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 14, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (5fa04d9) to head (15028d4).
⚠️ Report is 24 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff            @@
##            master      #554   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            2         2           
  Lines           33        33           
  Branches         3         1    -2     
=========================================
  Hits            33        33           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants