Skip to content

chore(deps): bump the actions group across 1 directory with 10 updates #454

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the actions group across 1 directory with 10 updates #454

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
container:
image: golang:1.26.5
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down Expand Up @@ -84,7 +84,7 @@ jobs:
- {goos: windows, goarch: amd64}
- {goos: windows, goarch: arm64}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/deploy-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
container:
image: node:24
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand All @@ -42,7 +42,7 @@ jobs:
cp -r pages/dist/* _site/
cp pages/logo.svg _site/logo.svg

- uses: actions/upload-pages-artifact@v3
- uses: actions/upload-pages-artifact@v5
with:
path: _site

Expand All @@ -58,4 +58,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
uses: actions/deploy-pages@v5
2 changes: 1 addition & 1 deletion .github/workflows/ocr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
# pull_request_target this checks out the trusted base branch; the
# composite action performs its own full checkout (fetch-depth: 0) later.
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pages-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
container:
image: node:24
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
16 changes: 8 additions & 8 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
- goos: windows
goarch: arm64
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand All @@ -51,7 +51,7 @@ jobs:
go build -ldflags "${LD_FLAGS}" -o "${BIN_NAME}" ./cmd/opencodereview
echo "bin_name=${BIN_NAME}" >> $GITHUB_ENV

- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@v7
with:
name: binary-${{ matrix.goos }}-${{ matrix.goarch }}
path: ${{ env.bin_name }}
Expand All @@ -70,7 +70,7 @@ jobs:
- name: Install git
run: apt-get update && apt-get install -y git

- uses: actions/checkout@v4
- uses: actions/checkout@v7
with:
fetch-depth: 0

Expand Down Expand Up @@ -135,7 +135,7 @@ jobs:
echo "RELEASE_NOTES_EOF"
} >> "$GITHUB_OUTPUT"

- uses: actions/download-artifact@v4
- uses: actions/download-artifact@v8
with:
pattern: binary-*
merge-multiple: true
Comment on lines +138 to 141

@github-actions github-actions Bot Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential version mismatch between upload-artifact and download-artifact. The build job uploads artifacts using actions/upload-artifact@v7, but the release and npm-publish jobs download them using actions/download-artifact@v8. Historically, major version mismatches between upload and download artifact actions have caused failures (e.g., the v3→v4 transition broke cross-version compatibility due to backend storage changes). Please verify that upload-artifact@v7 is compatible with download-artifact@v8, or align both to the same major version.

@Hryhorii83 Hryhorii83 Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#454 (review)

Expand All @@ -144,15 +144,15 @@ jobs:
run: sha256sum opencodereview-* | sort > sha256sum.txt

- name: Create GitHub Release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@v3

@github-actions github-actions Bot Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Third-party action should be pinned to a full commit SHA. softprops/action-gh-release is a third-party action. Unlike first-party actions/* actions (where pinning to a major version tag like v3 is acceptable), third-party actions should be pinned to an immutable commit SHA to prevent supply-chain attacks via tag hijacking. Tags are mutable and can be moved to point to malicious code.

Example:

uses: softprops/action-gh-release@<full-commit-sha> # v3

with:
body: ${{ steps.notes.outputs.body }}
files: |
opencodereview-*
sha256sum.txt

- name: Attest release artifacts
uses: actions/attest-build-provenance@v2
uses: actions/attest-build-provenance@v4
with:
subject-path: |
opencodereview-*
Expand All @@ -167,15 +167,15 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'

- name: Install jq
run: apt-get update && apt-get install -y jq

- uses: actions/download-artifact@v4
- uses: actions/download-artifact@v8
with:
pattern: binary-*
merge-multiple: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/translation-sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
image: node:24.18.0
steps:
# fetch-depth: 0 so the non-blocking docs check can diff base...head.
- uses: actions/checkout@v4
- uses: actions/checkout@v7
with:
fetch-depth: 0

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/vscode-ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@ jobs:
run:
working-directory: extensions/vscode
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
working-directory: .

- name: Cache Yarn packages
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ~/.cache/yarn
key: ${{ runner.os }}-yarn-${{ hashFiles('extensions/vscode/yarn.lock') }}
Expand Down
8 changes: 4 additions & 4 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ runs:

- name: Setup Node.js
if: steps.check_deps.outputs.node_installed != 'true'
uses: actions/setup-node@v4
uses: actions/setup-node@v7
with:
node-version: ${{ inputs.node_version }}

Expand All @@ -180,7 +180,7 @@ runs:
echo "PR head sha: $HEAD_SHA"

- name: Checkout base
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
# Checkout the trusted base, not the PR head. OCR reviews the
# base-to-head diff from git objects; the head commit's blobs are
Expand Down Expand Up @@ -254,7 +254,7 @@ runs:

- name: Upload review artifacts
if: ${{ always() && inputs.upload_artifacts == 'true' }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: ocr-review-result-${{ github.run_id }}-${{ github.run_attempt }}
path: |
Expand All @@ -272,7 +272,7 @@ runs:
- name: Post review comments
if: env.OCR_EXIT_CODE == '0'
id: post
uses: actions/github-script@v7
uses: actions/github-script@v9
env:
OCR_INCREMENTAL_OVERLAP_THRESHOLD: ${{ inputs.incremental_overlap_threshold }}
with:
Expand Down