Skip to content

chore: update GitHub Actions versions #486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
noritaka1166 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: update GitHub Actions versions #486

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@ jobs:
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
TURBO_TEAM: ${{ vars.TURBO_TEAM }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6
- uses: pnpm/action-setup@v6
- uses: actions/setup-node@v4
- uses: actions/setup-node@v6
Comment on lines +38 to +40

@coderabbitai coderabbitai Bot Jun 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

What are the latest stable versions of actions/checkout and actions/setup-node GitHub Actions? Are v6 releases available and stable?

💡 Result:

As of June 14, 2026, the latest stable versions for both GitHub Actions are in the v6 major release line. Both v6 versions are fully released and stable [1][2][3]. For actions/checkout, the latest stable release is v6.0.3, published on June 2, 2026 [1][2]. For actions/setup-node, the latest stable release is v6.4.0, which was published following the v6.3.0 release [4][3]. The v6 major versions for both actions are considered standard stable releases [1][5]. Users are encouraged to use them as they represent the current supported major line for these actions [2][3].

Citations:

🌐 Web query:

What are the breaking changes between v4 and v6 for actions/checkout and actions/setup-node?

💡 Result:

The transition from v4 to v6 for both actions/checkout and actions/setup-node includes significant changes, primarily focused on security and performance. ### actions/checkout The transition to v6 introduces a major security improvement regarding credential handling, with no required changes to existing workflows [1][2]. * Credential Persistence: In v6, the persist-credentials feature has been updated to store credentials in a separate file under $RUNNER_TEMP instead of directly in the local .git/config file [1][3]. * Runner Requirements: For workflows that use Docker container actions and require authenticated Git commands, you must use Actions Runner v2.329.0 or later to support this new credential storage mechanism [2][3]. * Note on v5: Between v4 and v6, v5 was released with an update to the Node.js 24 runtime, which requires Actions Runner v2.327.1 or later [2][3]. ### actions/setup-node The v6 release for actions/setup-node includes two primary breaking changes [4][5]: * Automatic Caching Limits: Caching is now automatically enabled only for npm projects when the devEngines.packageManager or top-level packageManager field is set to npm in package.json [4][6]. For other package managers (e.g., Yarn, pnpm), caching is disabled by default and must be explicitly configured using the cache input [5]. * Removal of always-auth: The always-auth input has been removed entirely as it is deprecated. You should remove any references to this input from your workflow files to avoid errors [4][5]. * Note on v5: Similar to the checkout action, v5 of setup-node transitioned to the Node.js 24 runtime and enabled automatic caching by default [4][5]. If you are migrating from v4, be aware that these cache-related changes in v5 and v6 may affect your workflows [4][5].

Citations:

Review breaking changes introduced by the v4→v6 upgrade for both actions.

v6 versions are stable and available. However, two breaking changes require attention:

  1. actions/checkout@v6: Credential handling changed; requires Actions Runner v2.329.0+ to support the new credential storage mechanism in $RUNNER_TEMP.

  2. actions/setup-node@v6: Automatic caching is now limited to npm-only (when packageManager is set to npm in package.json). Since this workflow uses pnpm, caching must be explicitly enabled via the cache input if needed. Also, the always-auth input has been removed.

Verify that your Actions Runner meets the minimum version requirement and that the pnpm caching behavior aligns with your needs.

🧰 Tools
🪛 zizmor (1.25.2)

[warning] 38-38: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 38-38: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 39-39: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 40-40: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 38 - 40, The upgrade to v6 versions of
actions/checkout and actions/setup-node introduces breaking changes that need to
be addressed. First, verify your Actions Runner is version 2.329.0 or later to
support the new credential storage mechanism in actions/checkout@v6. Second,
since this workflow uses pnpm rather than npm, the actions/setup-node@v6 action
no longer automatically enables caching for pnpm—you must explicitly add the
`cache: 'pnpm'` input to the actions/setup-node step if caching is desired.
Additionally, remove any `always-auth` input from the actions/setup-node step if
it exists, as this input has been removed in v6.

with:
node-version: 24
cache: "pnpm"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,9 @@ jobs:
pull-requests: write
id-token: write # npm trusted publishing (OIDC)
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6
- uses: pnpm/action-setup@v6
- uses: actions/setup-node@v4
- uses: actions/setup-node@v6
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
Expand Down