Update all GitHub Actions to the latest versions #2690
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (1)
Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughThe pull request consists of updates to several GitHub Actions workflow files, primarily involving the upgrade of various action versions. The actions updated include Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
Our Pull Request Approval ProcessWe have these basic policies to make the approval process smoother for our volunteer team. Testing Your CodePlease make sure your code passes all tests. Our test code coverage system will fail if these conditions occur:
The process helps maintain the overall reliability of the code base and is a prerequisite for getting your PR approved. Assigned reviewers regularly review the PR queue and tend to focus on PRs that are passing. ReviewersDo not assign reviewers. Our Queue Monitors will review your PR and assign them.
Reviewing Your CodeYour reviewer(s) will have the following roles:
CONTRIBUTING.mdRead our CONTRIBUTING.md file. Most importantly:
Other
|
varshith257
added
the
ignore-sensitive-files-pr
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range comments (1)
.github/workflows/codeql-codescan.yml (1)
Update CodeQL actions to the latest v3 version
The workflow currently uses
v2of the CodeQL actions, butv3is now available and stable with the latest version beingv3.27.4. All three actions should be updated:
- Update
github/codeql-action/init@v2togithub/codeql-action/init@v3- Update
github/codeql-action/autobuild@v2togithub/codeql-action/autobuild@v3- Update
github/codeql-action/analyze@v2togithub/codeql-action/analyze@v3🔗 Analysis chain
Line range hint
42-52: Verify if newer versions are available for CodeQL actionsWhile updating action versions, let's verify if there are newer stable versions available for the CodeQL actions currently using
v2.🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check the latest versions of CodeQL actions # Get the latest releases for CodeQL actions echo "Latest releases for github/codeql-action:" gh api repos/github/codeql-action/releases --paginate | jq -r '.[].tag_name' | head -n 5 # Get current marketplace versions echo -e "\nMarketplace versions for CodeQL actions:" gh api graphql -f query=' { search(query: "topic:actions codeql-action", type: REPOSITORY, first: 10) { nodes { ... on Repository { name releases(first: 5, orderBy: {field: CREATED_AT, direction: DESC}) { nodes { tagName createdAt } } } } } }' | jq -r '.data.search.nodes[].releases.nodes[] | "\(.tagName) (\(.createdAt))"'Length of output: 1019
🧰 Tools
🪛 yamllint
[error] 38-38: wrong indentation: expected 6 but found 4
(indentation)
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: ASSERTIVE
📒 Files selected for processing (5)
.github/workflows/codeql-codescan.yml(1 hunks).github/workflows/issue.yml(2 hunks).github/workflows/pull-request-target.yml(2 hunks).github/workflows/pull-request.yml(6 hunks).github/workflows/stale.yml(1 hunks)
🧰 Additional context used
🪛 yamllint
.github/workflows/stale.yml
[error] 28-28: wrong indentation: expected 6 but found 4
(indentation)
🔇 Additional comments (7)
.github/workflows/codeql-codescan.yml (1)
39-39: LGTM! Safe version update for checkout action
The update from v4 to v4.2.2 for actions/checkout is a patch version update that maintains backward compatibility while incorporating bug fixes.
.github/workflows/issue.yml (2)
31-31: LGTM: Safe version bump for first-interaction action
The update from v1 to v1.3.0 is a minor version bump within the same major version, maintaining backward compatibility. The configuration remains valid.
21-21: Verify compatibility with [email protected]
The update includes a major version bump (v2.3.0 -> v3.1.0) which might introduce breaking changes.
Let's verify the changelog and compatibility:
✅ Verification successful
The previous output shows the version history but we need to verify the current configuration against v3 requirements. Let's examine the workflow file and any related configuration to ensure compatibility.
Update to [email protected] is compatible
The current configuration is compatible with v3.1.0 as it:
- Uses the correct token configuration with
repo-token - Properly configures default labels using the supported
default-labelsparameter - Correctly uses the
ignore-commentsflag - Maintains a simple labeling workflow that hasn't changed across versions
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check release notes and recent issues for breaking changes
# Fetch latest releases and their dates
gh release list --repo Renato66/auto-label
# Check for recent issues mentioning breaking changes or v3
gh search issues "repo:Renato66/auto-label breaking changes v3" --state all --json title,url,state
# Verify current usage in other workflow files
rg "Renato66/auto-label@" .github/workflows/
Length of output: 3636
Script:
#!/bin/bash
# Let's check the current configuration and compare with v3 requirements
# Check current workflow configuration
cat .github/workflows/issue.yml
# Check for any configuration files referenced
fd "auto-label" --type f
# Search for label-related configuration
rg -l "labels:" .github
Length of output: 1624
.github/workflows/pull-request-target.yml (2)
70-70: LGTM: Safe version update of first-interaction action
The update to actions/[email protected] is a minor version bump from an official GitHub action, which follows semantic versioning. This should be backward compatible and includes security updates.
22-22: Verify breaking changes in actions-comment-pull-request v3.0.1
The major version bump (v2 → v3) might introduce breaking changes. Let's verify the changes:
.github/workflows/pull-request.yml (2)
72-72: Verify if v45.0.4 is the latest stable version of tj-actions/changed-files
The changed-files action has been updated to v45.0.4 in the check_unauthorized_file_changes job.
✅ Verification successful
The workflow is using the latest stable version v45.0.4 of tj-actions/changed-files
The GitHub API confirms that v45.0.4 is indeed the latest stable release of the tj-actions/changed-files action, matching exactly with the version used in the workflow.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Verify if v45.0.4 is the latest stable version of tj-actions/changed-files
# Fetch the latest release version
LATEST=$(gh api repos/tj-actions/changed-files/releases/latest --jq .tag_name)
echo "Latest stable version: $LATEST"
echo "Current version in workflow: v45.0.4"
# Compare versions
if [ "$LATEST" != "v45.0.4" ]; then
echo "Warning: A newer version is available"
fi
Length of output: 273
28-28: Verify if v4.2.2 is the latest stable version of actions/checkout
The checkout action has been consistently updated to v4.2.2 across all jobs.
Also applies to: 38-38, 48-48, 58-58, 69-69, 98-98
✅ Verification successful
✓ The workflow is using the latest stable version of actions/[email protected]
The verification confirms that v4.2.2 is indeed the latest stable release of actions/checkout, matching exactly with the version used in the workflow.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Verify if v4.2.2 is the latest stable version of actions/checkout
# Fetch the latest release version
LATEST=$(gh api repos/actions/checkout/releases/latest --jq .tag_name)
echo "Latest stable version: $LATEST"
echo "Current version in workflow: v4.2.2"
# Compare versions
if [ "$LATEST" != "v4.2.2" ]; then
echo "Warning: A newer version is available"
fi
Length of output: 258
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
varshith257
force-pushed
the
update-github-actions
branch
from
15a4600
to
48ae553
Compare
varshith257
merged commit ae44c64
into
PalisadoesFoundation:develop-postgres
|
@varshith257 All upgraded versions pins to a specific version, rather it should pin to major version |
|
Makes sense! Patch it up |
|
@prayanshchh Are you fixing it ? |
|
yes |
|
shall I create new PR @varshith257 |
|
Yes
…On Tue, 19 Nov, 2024, 1:54 pm prayansh_chhablani, ***@***.***> wrote:
shall I create new PR @varshith257 <https://github.com/varshith257>
—
Reply to this email directly, view it on GitHub
<#2690 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/A4BF3HE2GY3XJ4UPP6S6LBD2BLYTPAVCNFSM6AAAAABR6WWKQ6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIOBVGAYTAOJQGE>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
What kind of change does this PR introduce?
Updates Github actions to the laterst versions
Issue Number:
#2678
Fixes #
Did you add tests for your changes?
No
Snapshots/Videos:
If relevant, did you update the documentation?
No
Summary
Updates github actions to latest version in .yml files
Does this PR introduce a breaking change?
No
Other information
Have you read the contributing guide?
Yes
Summary by CodeRabbit
actions/checkoutupgraded tov4.2.2.auto-labelupdated tov3.1.0.first-interactionupdated tov1.3.0.actions/comment-pull-requestupdated tov3.0.1.actions/staleupdated tov9.0.0.tj-actions/changed-filesupdated tov45.0.4.