ci: update pinned GitHub Actions to their current majors - #683
Merged
Conversation
Every action except trivy-action was at least one major behind, and the codeql-action digest had gone stale against the v4 tag it comments. actions/checkout v6.1.0 -> v7.0.1 actions/setup-java v5.7.0 -> v6.0.0 actions/upload-artifact v4.6.2 -> v7.0.1 github/codeql-action v4 -> v4.37.8 (digest refresh) docker/setup-qemu-action v3.7.0 -> v4.2.0 docker/setup-buildx-action v3.12.0 -> v4.3.0 docker/build-push-action v6.19.2 -> v7.3.0 docker/login-action v3.7.0 -> v4.6.0 aquasecurity/trivy-action is already at v0.36.0, the current release. Each digest is the commit the major moving tag resolves to, which is also the latest release in that line, so the `# vN` comments Renovate reads keep tracking the major exactly as before. The majors were checked input by input rather than taken on trust: - setup-java v6 renames server-username/server-password to server-username-env-var/server-password-env-var. The old names survive as deprecated aliases and the GITHUB_ACTOR/GITHUB_TOKEN defaults moved from action.yml into the action's own code, so maven-publish.yml, which passes neither and relied on those defaults, still authenticates. central-publish.yml passes both explicitly and moves to the new names so it is not building on a deprecation. - setup-buildx-action v4 drops the config, config-inline and install inputs; docker.yml passes none of them. - upload-artifact v4 -> v7 is additive on inputs (`archive`, defaulting to the previous behaviour) and outputs are unchanged. - The rest of the majors are runtime moves to node24 with no input changes. AGENTS.md quotes a checkout pin as its worked example of SHA pinning, so that digest moves with the workflows. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012EbVuqbqEztVsS892PpQ5i
The workflows already comment their SHA pins with the major alone, but nothing said so, which is how the convention drifts back to exact versions the next time someone bumps an action by hand. The rule: pin the digest that the moving major tag resolves to, and comment it `# v7`, never `# v7.0.1`. The SHA is the real pin, so the comment only says which line the pin belongs to — and Renovate reads it as the current version, so a major-only comment makes every patch and minor release a digest refresh and reserves a comment change for an actual major. The grouped actions PR is then reviewed by looking for a changed `# vN` instead of re-reading nine version strings that moved for no behavioural reason. aquasecurity/trivy-action is the one exception, and is documented as such: it publishes no moving major tag at all — all 75 of its tags are exact `v0.x.y` releases — so it keeps `# v0.36.0` and Renovate raises its minor bumps normally. Recorded in AGENTS.md as the workflow convention it belongs to (plus the consequence for reviewing Renovate's grouped PR), summarised in CLAUDE.md beside the CI notes, and given its rationale in ADR 0005, since the comment granularity is what shapes the updates Renovate proposes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012EbVuqbqEztVsS892PpQ5i
Replaces every action's commit-SHA pin with the major tag its version comment already named, so a workflow line states what it runs instead of hiding it behind a digest, and an action's own patch and security releases reach CI without a commit here. actions/checkout@v7 actions/setup-java@v6 actions/upload-artifact@v7 github/codeql-action/*@v4 docker/setup-qemu-action@v4 docker/setup-buildx-action@v4 docker/build-push-action@v7 docker/login-action@v4 aquasecurity/trivy-action cannot follow the rule: it publishes no major tag at all — every one of its 75 tags is an exact v0.x.y release — so docker.yml names @v0.36.0 and Renovate bumps it like any other dependency. Every tag above was resolved against its upstream repository before committing, so no workflow references a ref that does not exist. Renovate would otherwise have converted all of this straight back to digests on its next run, so .github/renovate.json changes with it: the helpers:pinGitHubActionDigests preset is dropped and the github-actions rule sets pinDigests false. The dockerfile manager keeps pinDigests true — that case is genuinely different, since an image tag is re-pushed in place and those base images end up inside the released artifacts — and its rule description no longer says "for the same reason" now that the reason it referred to is gone. Validated with renovate-config-validator. The trade is recorded rather than glossed: a re-pointed tag changes what CI runs without a commit here. ADR 0005 carries it as an explicit negative consequence, with what makes it acceptable and what would make it worth revisiting. AGENTS.md and CLAUDE.md drop the SHA-pinning convention for this one and keep the Dockerfile's digest pinning distinct from it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012EbVuqbqEztVsS892PpQ5i
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every action except trivy-action was at least one major behind, and the
codeql-action digest had gone stale against the v4 tag it comments.
actions/checkout v6.1.0 -> v7.0.1
actions/setup-java v5.7.0 -> v6.0.0
actions/upload-artifact v4.6.2 -> v7.0.1
github/codeql-action v4 -> v4.37.8 (digest refresh)
docker/setup-qemu-action v3.7.0 -> v4.2.0
docker/setup-buildx-action v3.12.0 -> v4.3.0
docker/build-push-action v6.19.2 -> v7.3.0
docker/login-action v3.7.0 -> v4.6.0
aquasecurity/trivy-action is already at v0.36.0, the current release.
Each digest is the commit the major moving tag resolves to, which is also
the latest release in that line, so the
# vNcomments Renovate readskeep tracking the major exactly as before.
The majors were checked input by input rather than taken on trust:
server-username-env-var/server-password-env-var. The old names survive
as deprecated aliases and the GITHUB_ACTOR/GITHUB_TOKEN defaults moved
from action.yml into the action's own code, so maven-publish.yml, which
passes neither and relied on those defaults, still authenticates.
central-publish.yml passes both explicitly and moves to the new names
so it is not building on a deprecation.
inputs; docker.yml passes none of them.
archive, defaultingto the previous behaviour) and outputs are unchanged.
changes.
AGENTS.md quotes a checkout pin as its worked example of SHA pinning, so
that digest moves with the workflows.
Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_012EbVuqbqEztVsS892PpQ5i