ci: upgrade the GitHub Actions to their current majors - #167
Merged
Merged
Conversation
Every run was annotating "Node.js 20 is deprecated" for actions/checkout@v4 and actions/setup-node@v4, which GitHub forces onto Node 24 anyway. The rest of the actions were behind by one to three majors for the same reason. actions/checkout v4 -> v7 actions/setup-node v4 -> v7 actions/upload-artifact v4 -> v7 actions/configure-pages v4 -> v6 actions/upload-pages-artifact v3 -> v5 actions/deploy-pages v4 -> v5 actions/dependency-review-action v4 -> v5 All of these need Actions Runner 2.327.1 or newer, which the GitHub-hosted runners already exceed. One change is not mechanical. upload-pages-artifact stopped including hidden files in v4, and TypeDoc writes a .nojekyll into docs/api under its default githubPages setting. Losing that file would put the published API docs through Jekyll. The step now sets include-hidden-files, restoring the v3 behaviour. Checked and not affected: - checkout v7 blocks fork checkouts under pull_request_target and workflow_run. claude.yml uses neither. - setup-node v5 caches automatically when package.json declares packageManager, and v6 narrows that to npm. This package declares no packageManager field and every step already sets cache: npm. - upload-artifact v7 adds an opt-in unzipped upload; the default is unchanged. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JktBrqK6LaxcbiiTfDyUC7
Dependency ReviewThe following issues were found:
License Issues.github/workflows/release.yml
OpenSSF Scorecard
Scanned Files
|
|
🎉 This PR is included in version 3.0.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every workflow run was annotating:
The other actions were behind for the same reason. All of them now sit on their current major.
actions/checkoutactions/setup-nodeactions/upload-artifactactions/configure-pagesactions/upload-pages-artifactactions/deploy-pagesactions/dependency-review-actionAll require Actions Runner 2.327.1 or newer. The GitHub-hosted runners are well past that.
The one non-mechanical change
upload-pages-artifactstopped including hidden files in v4. TypeDoc 0.28 writes a.nojekyllintodocs/apiunder its defaultgithubPagessetting, and losing it would put the published API docs through Jekyll..github/workflows/docs.ymlnow setsinclude-hidden-files: true, which restores the v3 behaviour.Breaking changes checked and ruled out
checkout@v7blocks fork checkouts underpull_request_targetandworkflow_run.claude.ymltriggers onissue_comment,issues,pull_request_reviewandpull_request_review_comment— none of the affected events.setup-node@v5caches automatically whenpackage.jsondeclarespackageManager, and v6 narrows that to npm only. This package declares nopackageManagerfield, and every step already passescache: 'npm'explicitly.upload-artifact@v7adds an opt-in unzipped single-file upload via a newarchiveinput. The default is unchanged.🤖 Generated with Claude Code
https://claude.ai/code/session_01JktBrqK6LaxcbiiTfDyUC7
🔖 Claude agent: M2:Resortable Release
session id:
4abbd3dd-78c3-4334-a069-05481c380a2f