Skip to content

Commit 9ec9d12

Browse files
Robdel12Robdel12
authored
🔒 Upgrade + Pin GitHub Actions Workflows (#268)
## Why We wanted to fix the Node 20 deprecation path correctly, not paper over it. The initial env override (`FORCE_JAVASCRIPT_ACTIONS_TO_NODE24`) was a temporary safety net. This PR replaces that approach with proper action upgrades and immutable action pinning for workflow supply-chain hardening. ## What Changed - Removed the temporary workflow env override: - `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` - Upgraded core workflow actions to current majors that run on modern runtimes: - `actions/checkout` -> `v6` - `actions/setup-node` -> `v6` - `actions/cache` -> `v5` - `dorny/paths-filter` -> `v4` - `browser-actions/setup-chrome` -> `v2` - Replaced legacy `actions/create-release@v1` in `release-beta.yml` with: - `softprops/action-gh-release@v2` - Pinned all workflow `uses:` references to immutable commit SHAs, with inline version comments for readability. ## Verification - `npm run lint` - Manual workflow diff review across all touched files in `.github/workflows` to confirm: - no remaining version-tag refs for upgraded actions in this change set - no remaining `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` usage - release-beta now uses `softprops/action-gh-release` ## Notes This keeps behavior explicit and reviewable while reducing surprise CI drift and improving workflow security posture.
1 parent 2195eb1 commit 9ec9d12

13 files changed

Lines changed: 78 additions & 80 deletions

‎.github/workflows/ci.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ jobs:
1212
runs-on: ubuntu-latest
1313
timeout-minutes: 8
1414
steps:
15-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1616

1717
- name: Use Node.js 22
18-
uses: actions/setup-node@v4
18+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
1919
with:
2020
node-version: 22
2121
cache: 'npm'
@@ -40,10 +40,10 @@ jobs:
4040
node-version: [22, 24]
4141

4242
steps:
43-
- uses: actions/checkout@v4
43+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4444

4545
- name: Use Node.js ${{ matrix.node-version }}
46-
uses: actions/setup-node@v4
46+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
4747
with:
4848
node-version: ${{ matrix.node-version }}
4949
cache: 'npm'

‎.github/workflows/release-beta.yml‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,13 @@ jobs:
2828

2929
steps:
3030
- name: Checkout code
31-
uses: actions/checkout@v4
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3232
with:
3333
token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
3434
fetch-depth: 0
3535

3636
- name: Setup Node.js
37-
uses: actions/setup-node@v4
37+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3838
with:
3939
node-version: '22'
4040
cache: 'npm'
@@ -80,12 +80,10 @@ jobs:
8080
echo "EOF" >> $GITHUB_OUTPUT
8181
8282
- name: Create GitHub Release
83-
uses: actions/create-release@v1
84-
env:
85-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83+
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
8684
with:
8785
tag_name: ${{ steps.version.outputs.new_version }}
88-
release_name: 🧪 ${{ steps.version.outputs.new_version }}
86+
name: 🧪 ${{ steps.version.outputs.new_version }}
8987
body: ${{ steps.release_notes.outputs.notes }}
9088
draft: false
9189
prerelease: true

‎.github/workflows/release-ember-client.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ jobs:
2727

2828
steps:
2929
- name: Checkout code
30-
uses: actions/checkout@v4
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3131
with:
3232
token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
3333
fetch-depth: 0
3434

3535
- name: Set up Node.js
36-
uses: actions/setup-node@v4
36+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3737
with:
3838
node-version: '22'
3939
registry-url: 'https://registry.npmjs.org'
@@ -71,7 +71,7 @@ jobs:
7171
echo "tag=ember/v$NEW_VERSION" >> $GITHUB_OUTPUT
7272
7373
- name: Generate changelog
74-
uses: openai/codex-action@v1
74+
uses: openai/codex-action@a26d2d4d8b78a694338b8e3715c3630254340b2c # v1
7575
with:
7676
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
7777
sandbox: workspace-write
@@ -187,7 +187,7 @@ jobs:
187187
} >> $GITHUB_OUTPUT
188188
189189
- name: Create GitHub Release
190-
uses: softprops/action-gh-release@v2
190+
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
191191
with:
192192
tag_name: ${{ steps.version.outputs.tag }}
193193
name: 🐹 Ember SDK v${{ steps.version.outputs.version }}

‎.github/workflows/release-ruby-client.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ jobs:
2222

2323
steps:
2424
- name: Checkout code
25-
uses: actions/checkout@v4
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2626
with:
2727
token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
2828
fetch-depth: 0
2929

3030
- name: Set up Ruby
31-
uses: ruby/setup-ruby@v1
31+
uses: ruby/setup-ruby@97ecb7b512899eb71ab1bf2310a624c6f1589ac6 # v1
3232
with:
3333
ruby-version: '3.3'
3434

@@ -73,7 +73,7 @@ jobs:
7373
echo "tag=ruby/v$NEW_VERSION" >> $GITHUB_OUTPUT
7474
7575
- name: Generate changelog
76-
uses: openai/codex-action@v1
76+
uses: openai/codex-action@a26d2d4d8b78a694338b8e3715c3630254340b2c # v1
7777
with:
7878
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
7979
sandbox: workspace-write
@@ -183,7 +183,7 @@ jobs:
183183
} >> $GITHUB_OUTPUT
184184
185185
- name: Create GitHub Release
186-
uses: softprops/action-gh-release@v2
186+
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
187187
with:
188188
tag_name: ${{ steps.new_version.outputs.tag }}
189189
name: 💎 Ruby Client v${{ steps.new_version.outputs.version }}

‎.github/workflows/release-static-site-client.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ jobs:
2222

2323
steps:
2424
- name: Checkout code
25-
uses: actions/checkout@v4
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2626
with:
2727
token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
2828
fetch-depth: 0
2929

3030
- name: Set up Node.js
31-
uses: actions/setup-node@v4
31+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3232
with:
3333
node-version: '22'
3434
registry-url: 'https://registry.npmjs.org'
@@ -62,7 +62,7 @@ jobs:
6262
echo "tag=static-site/v$NEW_VERSION" >> $GITHUB_OUTPUT
6363
6464
- name: Generate changelog
65-
uses: openai/codex-action@v1
65+
uses: openai/codex-action@a26d2d4d8b78a694338b8e3715c3630254340b2c # v1
6666
with:
6767
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
6868
sandbox: workspace-write
@@ -193,7 +193,7 @@ jobs:
193193
} >> $GITHUB_OUTPUT
194194
195195
- name: Create GitHub Release
196-
uses: softprops/action-gh-release@v2
196+
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
197197
with:
198198
tag_name: ${{ steps.version.outputs.tag }}
199199
name: 🏗️ Static Site Plugin v${{ steps.version.outputs.version }}

‎.github/workflows/release-storybook-client.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ jobs:
2222

2323
steps:
2424
- name: Checkout code
25-
uses: actions/checkout@v4
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2626
with:
2727
token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
2828
fetch-depth: 0
2929

3030
- name: Set up Node.js
31-
uses: actions/setup-node@v4
31+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3232
with:
3333
node-version: '22'
3434
cache: 'npm'
@@ -63,7 +63,7 @@ jobs:
6363
echo "tag=storybook/v$NEW_VERSION" >> $GITHUB_OUTPUT
6464
6565
- name: Generate changelog
66-
uses: openai/codex-action@v1
66+
uses: openai/codex-action@a26d2d4d8b78a694338b8e3715c3630254340b2c # v1
6767
with:
6868
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
6969
sandbox: workspace-write
@@ -184,7 +184,7 @@ jobs:
184184
} >> $GITHUB_OUTPUT
185185
186186
- name: Create GitHub Release
187-
uses: softprops/action-gh-release@v2
187+
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
188188
with:
189189
tag_name: ${{ steps.version.outputs.tag }}
190190
name: 📚 Storybook Plugin v${{ steps.version.outputs.version }}

‎.github/workflows/release-swift-client.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222

2323
steps:
2424
- name: Checkout code
25-
uses: actions/checkout@v4
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2626
with:
2727
token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
2828
fetch-depth: 0
@@ -75,7 +75,7 @@ jobs:
7575
echo "tag=swift/v$NEW_VERSION" >> $GITHUB_OUTPUT
7676
7777
- name: Generate changelog
78-
uses: openai/codex-action@v1
78+
uses: openai/codex-action@a26d2d4d8b78a694338b8e3715c3630254340b2c # v1
7979
with:
8080
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
8181
sandbox: workspace-write
@@ -173,7 +173,7 @@ jobs:
173173
} >> $GITHUB_OUTPUT
174174
175175
- name: Create GitHub Release
176-
uses: softprops/action-gh-release@v2
176+
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
177177
with:
178178
tag_name: ${{ steps.new_version.outputs.tag }}
179179
name: 📱 Swift SDK v${{ steps.new_version.outputs.version }}

‎.github/workflows/release-vitest-client.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ jobs:
2222

2323
steps:
2424
- name: Checkout code
25-
uses: actions/checkout@v4
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2626
with:
2727
token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
2828
fetch-depth: 0
2929

3030
- name: Set up Node.js
31-
uses: actions/setup-node@v4
31+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3232
with:
3333
node-version: '22'
3434
registry-url: 'https://registry.npmjs.org'
@@ -62,7 +62,7 @@ jobs:
6262
echo "tag=vitest/v$NEW_VERSION" >> $GITHUB_OUTPUT
6363
6464
- name: Generate changelog
65-
uses: openai/codex-action@v1
65+
uses: openai/codex-action@a26d2d4d8b78a694338b8e3715c3630254340b2c # v1
6666
with:
6767
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
6868
sandbox: workspace-write
@@ -173,7 +173,7 @@ jobs:
173173
} >> $GITHUB_OUTPUT
174174
175175
- name: Create GitHub Release
176-
uses: softprops/action-gh-release@v2
176+
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
177177
with:
178178
tag_name: ${{ steps.version.outputs.tag }}
179179
name: 🧪 Vitest Integration v${{ steps.version.outputs.version }}

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ jobs:
2222

2323
steps:
2424
- name: Checkout code
25-
uses: actions/checkout@v4
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2626
with:
2727
token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
2828
fetch-depth: 0
2929

3030
- name: Setup Node.js
31-
uses: actions/setup-node@v4
31+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3232
with:
3333
node-version: '22'
3434
cache: 'npm'
@@ -66,7 +66,7 @@ jobs:
6666
echo "tag=$PREV_TAG" >> $GITHUB_OUTPUT
6767
6868
- name: Generate release notes
69-
uses: openai/codex-action@v1
69+
uses: openai/codex-action@a26d2d4d8b78a694338b8e3715c3630254340b2c # v1
7070
with:
7171
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
7272
sandbox: workspace-write
@@ -120,7 +120,7 @@ jobs:
120120
fi
121121
122122
- name: Create GitHub Release
123-
uses: softprops/action-gh-release@v2
123+
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
124124
with:
125125
tag_name: ${{ steps.version.outputs.new_version }}
126126
name: ✨ ${{ steps.version.outputs.new_version }}

‎.github/workflows/reporter.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ jobs:
1313
timeout-minutes: 8
1414

1515
steps:
16-
- uses: actions/checkout@v4
16+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1717

1818
- name: Use Node.js 22
19-
uses: actions/setup-node@v4
19+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
2020
with:
2121
node-version: 22
2222
cache: 'npm'
@@ -32,7 +32,7 @@ jobs:
3232
run: echo "version=$(npx playwright --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')" >> $GITHUB_OUTPUT
3333

3434
- name: Cache Playwright browsers
35-
uses: actions/cache@v4
35+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
3636
id: playwright-cache
3737
with:
3838
path: ~/.cache/ms-playwright

0 commit comments

Comments
 (0)