ci(workflows): update GitHub Actions - #2263
josecelano merged 1 commit into
Conversation
da2ce7
left a comment
da2ce7
left a comment
There was a problem hiding this comment.
Reviewed under .github/skills/dev/pr-reviews/review-pr/SKILL.md and .github/skills/dev/maintenance/update-github-workflow-actions/SKILL.md at head 4a1e9f66a953256b0c7ad10f9f430f8e9ca0c99d. Recomputed from the bytes at this head.
Scope. One commit on top of develop 02815dcb, 5 workflow files, 13 lines: docker/setup-buildx-action v4.3.0 → v4.4.1 (4 sites), docker/build-push-action v7.3.0 → v7.4.0 (4 sites), taiki-e/install-action v2.87.12 → v2.87.14 (3 sites), codecov/codecov-action v7.0.0 → v7.1.1 (2 sites). A git grep over .github/workflows at this head finds no surviving old pin for any of the four, every reference stays an explicit version, and the four skill-link: update-github-workflow-actions markers are intact.
Upstream deltas. docker/setup-buildx-action v4.3.0…v4.4.1 (39 commits) and docker/build-push-action v7.3.0…v7.4.0 (76 commits) change no line of either action.yml, so every input this repository passes (file, push, load, target, tags, labels, cache-from, cache-to) keeps its contract. taiki-e/install-action v2.87.12…v2.87.14 is manifest updates only, action.yml untouched. codecov/codecov-action v7.0.0…v7.1.1 is two commits: 7.1.0 adds an opt-in cleanup input defaulting to 'false' (legacy behaviour preserved; neither workflow here sets it), 7.1.1 is a one-line dist/codecov.sh fix.
Allowed-actions policy. From the repository-level policy (the organization endpoint returns 403 for this account too, as the description says): taiki-e/[email protected] matches the configured taiki-e/install-action@v2.* pattern; docker/* and codecov/* are not in patterns_allowed and run under verified_allowed: true, which is version-agnostic — the same mechanism that ran testing.yaml green on develop at 02815dcb today with the v4.3.0/v7.3.0 docker actions. No policy change is needed, and none is claimed.
What CI exercises here. container.yaml and testing.yaml run on this pull request, so the docker and taiki-e bumps are exercised before merge. The two codecov/codecov-action call sites are not: coverage.yaml triggers only on push to develop, and upload_coverage_pr.yaml is workflow_run-triggered from the default branch, so v7.1.1 first runs after merge — routine given the delta above, noted for the post-merge Coverage run.
Relation to #2257. Dependabot's #2257 moves the same two codecov lines to v7.1.1's predecessor (v7.1.0) and is approved. Merging this PR first supersedes it (dependabot closes it as up to date); merging #2257 first conflicts with this PR on those two lines. Either order is fine; this one is the more complete.
Verification. On the project build host at this head: pre-commit.sh --format=json 8/8 pass, 66 s (includes linter all); git diff --check clean. Commit subject is Conventional Commits, no attribution trailer, no banned token, git merge-tree against develop clean.
CI at this head was queued when this was posted (five runs accepted, none a startup failure).
Checklist: metadata ✔ (title, description with the skill link, target develop); code quality ✔ (pins consistent across all sites); tests N/A (workflow pins only); documentation N/A; Rust-specific N/A.
|
ACK 4a1e9f6 — four workflow action pins moved to current exact releases (docker buildx 4.4.1 / build-push 7.4.0, taiki-e install-action 2.87.14, codecov-action 7.1.1); no input contracts changed, no allowlist change needed |
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Updates GitHub Actions workflow dependencies to newer exact release versions while preserving existing workflow behavior and action owners.
Changes:
- Upgraded Docker Buildx and Build Push actions in container and testing workflows.
- Upgraded Codecov action references in coverage workflows.
- Upgraded
taiki-e/install-actionreferences in tool-installation workflows.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/container.yaml |
Updates Docker Buildx and Build Push action versions. |
.github/workflows/coverage.yaml |
Updates the tool-installation and Codecov action versions. |
.github/workflows/generate_coverage_pr.yaml |
Updates the tool-installation action version. |
.github/workflows/testing.yaml |
Updates tool-installation and Docker action versions. |
.github/workflows/upload_coverage_pr.yaml |
Updates the Codecov action version. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #2263 +/- ##
========================================
Coverage 85.78% 85.78%
========================================
Files 353 353
Lines 31438 31438
Branches 31438 31438
========================================
Hits 26969 26969
Misses 4087 4087
Partials 382 382 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
4a1e9f6 to
f86a8e1
Compare
|
ACK f86a8e1 |
Summary
Updated GitHub Actions workflow references to current compatible exact versions:
docker/setup-buildx-actionfromv4.3.0tov4.4.1docker/build-push-actionfromv7.3.0tov7.4.0codecov/codecov-actionfromv7.0.0tov7.1.1taiki-e/install-actionfromv2.87.12tov2.87.14No compatibility issues were identified. All existing semantic workflow markers were retained.
Files/packages touched
.github/workflows/container.yaml.github/workflows/coverage.yaml.github/workflows/generate_coverage_pr.yaml.github/workflows/testing.yaml.github/workflows/upload_coverage_pr.yamlOrganization allowed-actions policy
No organization allowlist change is required. The existing
taiki-e/install-action@v2.*pattern permitsv2.87.14. The Docker and Codecov actions are permitted by the organization’s verified-action policy, which is version-agnostic. Existing allowlist entries are unchanged and retained for other Torrust repositories.Validation
linter yamlgit diff --checkTORRUST_GIT_HOOKS_LOG_DIR=.tmp ./contrib/dev-tools/git/hooks/pre-commit.sh --format=json4a1e9f66and approved the update; affected workflow runs were accepted without allowlist failures.