Update github actions (major)#137
Conversation
Up to standards ✅🟢 Issues
|
merge
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The PR performs major version updates for core GitHub Actions including actions/checkout, actions/deploy-pages, actions/github-script, and actions/upload-pages-artifact. While the quality analysis is positive, there are significant functional risks associated with these major jumps.
Specifically, actions/upload-pages-artifact@v5 now excludes hidden files (dotfiles) by default. This change frequently breaks GitHub Pages deployments that rely on files like .nojekyll to bypass Jekyll processing. Additionally, the move to actions/github-script@v9 introduces a transition to ESM-only execution, which may break existing scripts that rely on CommonJS syntax or specific internal imports. These risks should be validated before merging to ensure CI/CD stability.
Test suggestions
- Verify 'Squad Heartbeat' workflow execution with github-script@v9 (ensure no ESM compatibility issues).
- Verify 'Squad Issue Assign' workflow correctly interacts with GitHub API using github-script@v9.
- Confirm GitHub Pages deployment includes necessary dotfiles (e.g., .nojekyll) after upload-pages-artifact@v5 update.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify 'Squad Heartbeat' workflow execution with github-script@v9 (ensure no ESM compatibility issues).
2. Verify 'Squad Issue Assign' workflow correctly interacts with GitHub API using github-script@v9.
3. Confirm GitHub Pages deployment includes necessary dotfiles (e.g., .nojekyll) after upload-pages-artifact@v5 update.
Low confidence findings
- While the inline scripts in this PR are relatively simple, the update to
actions/github-script@v9enforces ESM. If any of the workflows (e.g., triage or heartbeat) involve complex logic or external dependencies that rely on CommonJSrequirecalls, they may fail during execution.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
10 times, most recently
from
b7d8282 to
fab2779
Compare
renovate
Bot
force-pushed
the
renovate/major-github-actions
branch
from
fab2779 to
031b2e4
Compare
1 participant
This PR contains the following updates:
v4→v7v4→v5v7→v9v3→v5Release Notes
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
v5Compare Source
actions/deploy-pages (actions/deploy-pages)
v5.0.0Compare Source
Changelog
See details of all code changes since previous release.
v5Compare Source
actions/github-script (actions/github-script)
v9.0.0Compare Source
New features:
getOctokitfactory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients withgetOctokitfor details and examples.ACTIONS_ORCHESTRATION_IDenvironment variable is automatically appended to the user-agent string for request tracing.Breaking changes:
require('@​actions/github')no longer works in scripts. The upgrade to@actions/githubv9 (ESM-only) meansrequire('@​actions/github')will fail at runtime. If you previously used patterns likeconst { getOctokit } = require('@​actions/github')to create secondary clients, use the new injectedgetOctokitfunction instead — it's available directly in the script context with no imports needed.getOctokitis now an injected function parameter. Scripts that declareconst getOctokit = ...orlet getOctokit = ...will get aSyntaxErrorbecause JavaScript does not allowconst/letredeclaration of function parameters. Use the injectedgetOctokitdirectly, or usevar getOctokit = ...if you need to redeclare it.@actions/githubinternals beyond the standardgithub/octokitclient, you may need to update those references for v9 compatibility.What's Changed
New Contributors
Full Changelog: actions/github-script@v8.0.0...v9.0.0
v9Compare Source
v8.0.0Compare Source
v8: .0.0Compare Source
What's Changed
v2.327.1
Release Notes
Make sure your runner is updated to this version or newer to use this release.
New Contributors
Full Changelog: actions/github-script@v7.1.0...v8.0.0
actions/upload-pages-artifact (actions/upload-pages-artifact)
v5.0.0Compare Source
Changelog
include-hidden-filesinput @jonchurch (#137)See details of all code changes since previous release.
v5Compare Source
v4.0.0Compare Source
What's Changed
If you need to include dotfiles in your artifact: instead of using this action, create your own artifact according to these requirements https://github.com/actions/upload-pages-artifact?tab=readme-ov-file#artifact-validation
actions/upload-artifactto SHA by @heavymachinery in #127Full Changelog: actions/upload-pages-artifact@v3.0.1...v4.0.0
v4Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.