Skip to content

ci: upgrade low-risk GitHub Actions dependencies #468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lizhengfeng101 merged 1 commit into from
Jul 30, 2026
Merged

ci: upgrade low-risk GitHub Actions dependencies #468

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
container:
image: golang:1.26.5
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@github-actions github-actions Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential issue: Non-existent action version. actions/checkout@v7 does not appear to be a valid release. The latest known major version is v4. Using a non-existent version tag will cause all workflow runs to fail immediately at the checkout step.

If a newer version has indeed been released, please verify the exact tag on the actions/checkout releases page before merging. Additionally, per security best practices, consider pinning third-party actions to a full commit SHA rather than a mutable tag to prevent potential tag-hijacking attacks.


- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down Expand Up @@ -84,7 +84,7 @@ jobs:
- {goos: windows, goarch: amd64}
- {goos: windows, goarch: arm64}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/deploy-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
container:
image: node:24
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand All @@ -42,7 +42,7 @@ jobs:
cp -r pages/dist/* _site/
cp pages/logo.svg _site/logo.svg

- uses: actions/upload-pages-artifact@v3
- uses: actions/upload-pages-artifact@v5
with:
path: _site

Expand All @@ -58,4 +58,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
uses: actions/deploy-pages@v5
2 changes: 1 addition & 1 deletion .github/workflows/ocr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
# pull_request_target this checks out the trusted base branch; the
# composite action performs its own full checkout (fetch-depth: 0) later.
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7

@github-actions github-actions Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential issue: actions/checkout@v7 may not exist. As of the latest known releases, actions/checkout is at v4. Jumping three major versions (v4 → v7) is highly unusual for first-party GitHub Actions. This same pattern appears across all workflow files in this PR (e.g., actions/cache@v6, actions/setup-node@v7, actions/github-script@v9), suggesting an automated bulk version bump that may reference non-existent tags.

If the workflow runs with a non-existent action version tag, it will fail immediately. Please verify that each referenced version tag actually exists in the respective action repository before merging.


- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pages-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
container:
image: node:24
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
- goos: windows
goarch: arm64
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Comment on lines +32 to 35

@github-actions github-actions Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical: Non-existent action version. actions/checkout@v7 does not exist. The latest major version is v4. Using a non-existent tag will cause this workflow to fail immediately at runtime. This same incorrect bump appears in multiple places in this file (lines 32, 73, 170) and across all other modified workflow files.

Please revert to actions/checkout@v4 or pin to a specific commit SHA for better security.

Suggestion:

Suggested change
- uses: actions/checkout@v7
- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
- uses: actions/checkout@v4
- name: Trust workspace
run: git config --global --replace-all safe.directory '*'

Expand Down Expand Up @@ -70,7 +70,7 @@ jobs:
- name: Install git
run: apt-get update && apt-get install -y git

- uses: actions/checkout@v4
- uses: actions/checkout@v7
with:
fetch-depth: 0

Expand Down Expand Up @@ -144,15 +144,15 @@ jobs:
run: sha256sum opencodereview-* | sort > sha256sum.txt

- name: Create GitHub Release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@v3

@github-actions github-actions Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical: Non-existent action version. softprops/action-gh-release@v3 does not exist. The latest major version is v2. This will cause the release job to fail when attempting to create a GitHub release.

Suggestion:

Suggested change
uses: softprops/action-gh-release@v3
uses: softprops/action-gh-release@v2

with:
body: ${{ steps.notes.outputs.body }}
files: |
opencodereview-*
sha256sum.txt

- name: Attest release artifacts
uses: actions/attest-build-provenance@v2
uses: actions/attest-build-provenance@v4

@github-actions github-actions Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical: Non-existent action version. actions/attest-build-provenance@v4 does not exist. The latest major version is v2. This will cause the attestation step to fail.

Suggestion:

Suggested change
uses: actions/attest-build-provenance@v4
uses: actions/attest-build-provenance@v2

with:
subject-path: |
opencodereview-*
Expand All @@ -167,7 +167,7 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/vscode-ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@ jobs:
run:
working-directory: extensions/vscode
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
working-directory: .

- name: Cache Yarn packages
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: ~/.cache/yarn
key: ${{ runner.os }}-yarn-${{ hashFiles('extensions/vscode/yarn.lock') }}
Expand Down
6 changes: 3 additions & 3 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ runs:

- name: Setup Node.js
if: steps.check_deps.outputs.node_installed != 'true'
uses: actions/setup-node@v4
uses: actions/setup-node@v7
with:
node-version: ${{ inputs.node_version }}

Expand All @@ -180,7 +180,7 @@ runs:
echo "PR head sha: $HEAD_SHA"

- name: Checkout base
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
# Checkout the trusted base, not the PR head. OCR reviews the
# base-to-head diff from git objects; the head commit's blobs are
Expand Down Expand Up @@ -272,7 +272,7 @@ runs:
- name: Post review comments
if: env.OCR_EXIT_CODE == '0'
id: post
uses: actions/github-script@v7
uses: actions/github-script@v9
env:
OCR_INCREMENTAL_OVERLAP_THRESHOLD: ${{ inputs.incremental_overlap_threshold }}
with:
Expand Down
Loading