Update GitHub Action Versions#388
Conversation
kozlov721
requested review from
conorsim,
klemen1999 and
tersekmatija
and removed request for
a team
📝 WalkthroughWalkthroughThis pull request updates GitHub Actions across multiple CI/CD workflows to use newer pinned versions. ChangesWorkflow Actions Version Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/python-publish.yaml (1)
31-34: ⚡ Quick winRe-pin
gh-action-pypi-publishto a commit SHA, not a mutable tag.This step previously used an immutable commit hash and is being changed to the floating
v1.14.0tag. This is the most security-sensitive action in the repo (it consumesPYPI_API_TOKEN), so dropping SHA pinning is a meaningful supply-chain regression — a re-tag ofv1.14.0would silently run new code with your publish credentials. Prefer pinning to the release's commit SHA (optionally with a# v1.14.0comment).Optionally, consider migrating to PyPI Trusted Publishing (OIDC) to remove the long-lived
PYPI_API_TOKENsecret entirely.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/python-publish.yaml around lines 31 - 34, The workflow currently references pypa/gh-action-pypi-publish@v1.14.0 which is a mutable tag; replace that floating tag with the action's immutable commit SHA (e.g., pypa/gh-action-pypi-publish@<commit-sha>) to re-pin the step that uses the PYPI_API_TOKEN, keeping an optional comment like "# v1.14.0" for clarity; update the uses line in the job (the line containing "uses: pypa/gh-action-pypi-publish@v1.14.0") to the commit SHA and verify the workflow still runs, and optionally consider migrating to OIDC-based PyPI Trusted Publishing to remove the long-lived secret.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tests.yaml:
- Around line 58-63: The "Free Disk Space (Ubuntu)" job step uses if: matrix.os
== 'ubuntu-latest' which never matches the workflow matrix (os:
[ubuntu-t4-4core, windows-latest]); update the condition on the step named "Free
Disk Space (Ubuntu)" to if: matrix.os == 'ubuntu-t4-4core' if you intend it to
run on the self-hosted Ubuntu leg, or remove the step entirely if disk cleanup
is not required; ensure you keep the existing uses:
jlumbroso/free-disk-space@v1.3.1 line unchanged when fixing the condition.
---
Nitpick comments:
In @.github/workflows/python-publish.yaml:
- Around line 31-34: The workflow currently references
pypa/gh-action-pypi-publish@v1.14.0 which is a mutable tag; replace that
floating tag with the action's immutable commit SHA (e.g.,
pypa/gh-action-pypi-publish@<commit-sha>) to re-pin the step that uses the
PYPI_API_TOKEN, keeping an optional comment like "# v1.14.0" for clarity; update
the uses line in the job (the line containing "uses:
pypa/gh-action-pypi-publish@v1.14.0") to the commit SHA and verify the workflow
still runs, and optionally consider migrating to OIDC-based PyPI Trusted
Publishing to remove the long-lived secret.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 84ddb5cc-14e2-4f1b-a099-660efa31a123
📒 Files selected for processing (7)
.github/workflows/actions_autoupdate.yaml.github/workflows/add-metadata.yaml.github/workflows/ci.yaml.github/workflows/python-publish.yaml.github/workflows/semgrep.yaml.github/workflows/tests.yaml.github/workflows/update-cov-report.yaml
| - name: Free Disk Space (Ubuntu) | ||
| if: matrix.os == 'ubuntu-latest' | ||
| uses: jlumbroso/free-disk-space@main | ||
| uses: jlumbroso/free-disk-space@v1.3.1 | ||
| with: | ||
| tool-cache: false | ||
| large-packages: false |
There was a problem hiding this comment.
Free Disk Space step never runs — its if references ubuntu-latest, which isn't in the matrix.
The matrix is os: [ubuntu-t4-4core, windows-latest], so if: matrix.os == 'ubuntu-latest' is never true and this step is dead. Pinning it to v1.3.1 has no effect until the condition is corrected. If disk space is needed on the self-hosted leg, change the condition to matrix.os == 'ubuntu-t4-4core'; otherwise drop the step. (Pre-existing, but worth fixing while this line is being touched.)
🔧 Proposed condition fix
- name: Free Disk Space (Ubuntu)
- if: matrix.os == 'ubuntu-latest'
+ if: matrix.os == 'ubuntu-t4-4core'
uses: jlumbroso/free-disk-space@v1.3.1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Free Disk Space (Ubuntu) | |
| if: matrix.os == 'ubuntu-latest' | |
| uses: jlumbroso/free-disk-space@main | |
| uses: jlumbroso/free-disk-space@v1.3.1 | |
| with: | |
| tool-cache: false | |
| large-packages: false | |
| - name: Free Disk Space (Ubuntu) | |
| if: matrix.os == 'ubuntu-t4-4core' | |
| uses: jlumbroso/free-disk-space@v1.3.1 | |
| with: | |
| tool-cache: false | |
| large-packages: false |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 60-60: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/tests.yaml around lines 58 - 63, The "Free Disk Space
(Ubuntu)" job step uses if: matrix.os == 'ubuntu-latest' which never matches the
workflow matrix (os: [ubuntu-t4-4core, windows-latest]); update the condition on
the step named "Free Disk Space (Ubuntu)" to if: matrix.os == 'ubuntu-t4-4core'
if you intend it to run on the self-hosted Ubuntu leg, or remove the step
entirely if disk cleanup is not required; ensure you keep the existing uses:
jlumbroso/free-disk-space@v1.3.1 line unchanged when fixing the condition.
1 participant
GitHub Actions Version Updates
Summary by CodeRabbit