From 5045f42971792be35a2f184276b8080bcc49d125 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Sun, 2 Aug 2026 23:15:00 +0300 Subject: [PATCH 1/2] Pin GHA dependencies Thanks to https://github.com/suzuki-shunsuke/pinact * Follows the recommended pattern from https://github.com/processing/p5.js/issues/8674#issuecomment-4586205003 * Complementary to https://github.com/processing/p5.js/pull/8620 --- .github/workflows/continuous-release.yml | 8 ++++---- .github/workflows/release-workflow-v1.yml | 10 +++++----- .github/workflows/release-workflow-v2.yml | 8 ++++---- .github/workflows/stewards-update.yml | 6 +++--- 4 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/continuous-release.yml b/.github/workflows/continuous-release.yml index f3b713d3f6..721cc97f36 100644 --- a/.github/workflows/continuous-release.yml +++ b/.github/workflows/continuous-release.yml @@ -19,8 +19,8 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 @@ -34,7 +34,7 @@ jobs: run: npx pkg-pr-new publish --no-template --json output.json --comment=off - name: Include PR info in output file - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 env: PR_NUMBER: ${{ github.event.pull_request.number }} with: @@ -49,7 +49,7 @@ jobs: fs.writeFileSync('output.json', JSON.stringify(output)); - name: Upload output data - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: output.zip path: output.json diff --git a/.github/workflows/release-workflow-v1.yml b/.github/workflows/release-workflow-v1.yml index f84547f3ad..3c78251379 100644 --- a/.github/workflows/release-workflow-v1.yml +++ b/.github/workflows/release-workflow-v1.yml @@ -18,10 +18,10 @@ jobs: INPUT_TOKEN: ${{ secrets.NPM_TOKEN }} steps: # 1. Setup - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: persist-credentials: false - - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 + - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: 22 # Keep at 22 purposefully for v1 - name: Check prerelease @@ -77,14 +77,14 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} - name: Publish to NPM if: ${{ steps.semver.outputs.is-prerelease != 'true' }} - uses: JS-DevTools/npm-publish@0f451a94170d1699fd50710966d48fb26194d939 # v1 + uses: JS-DevTools/npm-publish@0f451a94170d1699fd50710966d48fb26194d939 # v1.4.3 with: token: ${{ secrets.NPM_TOKEN }} # 4. Update p5.js website - name: Clone p5.js website if: ${{ steps.semver.outputs.is-prerelease != 'true' }} - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: repository: processing/p5.js-website path: website @@ -121,7 +121,7 @@ jobs: # 5. Update Bower files - name: Checkout Bower repo if: ${{ steps.semver.outputs.is-prerelease != 'true' }} - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: repository: processing/p5.js-release path: bower diff --git a/.github/workflows/release-workflow-v2.yml b/.github/workflows/release-workflow-v2.yml index 0ee420c595..cdfd639fdb 100644 --- a/.github/workflows/release-workflow-v2.yml +++ b/.github/workflows/release-workflow-v2.yml @@ -18,10 +18,10 @@ jobs: INPUT_TOKEN: ${{ secrets.NPM_TOKEN }} steps: # 1. Setup - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: persist-credentials: false - - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 + - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: 22 - name: Check prerelease @@ -82,7 +82,7 @@ jobs: generate_release_notes: true token: ${{ secrets.GITHUB_TOKEN }} - name: Publish to NPM - uses: JS-DevTools/npm-publish@0f451a94170d1699fd50710966d48fb26194d939 + uses: JS-DevTools/npm-publish@0f451a94170d1699fd50710966d48fb26194d939 # v1.4.3 with: token: ${{ secrets.NPM_TOKEN }} tag: ${{ steps.semver.outputs.is-prerelease != 'true' && 'latest' || 'beta' }} @@ -90,7 +90,7 @@ jobs: # 4. Update p5.js website - name: Clone p5.js website if: ${{ steps.semver.outputs.is-prerelease != 'true' }} - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: repository: processing/p5.js-website ref: 'main' diff --git a/.github/workflows/stewards-update.yml b/.github/workflows/stewards-update.yml index 4590619062..41a8e9257a 100644 --- a/.github/workflows/stewards-update.yml +++ b/.github/workflows/stewards-update.yml @@ -16,12 +16,12 @@ jobs: if: github.ref == 'refs/heads/main' && github.repository == 'processing/p5.js' runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Setup Node - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22 @@ -38,7 +38,7 @@ jobs: git checkout -- . - name: Create Pull Request - uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 + uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11 with: commit-message: "Update README table from stewards.yml" branch: update-readme-table From 3ef0a706f9691f4698c496b01f1e6143f83b4dcd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 3 Aug 2026 16:13:36 +0300 Subject: [PATCH 2/2] Sync actions/checkout versions https://github.com/processing/p5.js/pull/9032/changes#r3703649911 --- .github/workflows/ci-lint.yml | 2 +- .github/workflows/ci-test.yml | 2 +- .github/workflows/contributors-png.yml | 2 +- .github/workflows/release-workflow-v1.yml | 6 +++--- .github/workflows/release-workflow-v2.yml | 4 ++-- .github/workflows/stewards-update.yml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml index 8f5091ec23..b6d70336a5 100644 --- a/.github/workflows/ci-lint.yml +++ b/.github/workflows/ci-lint.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - name: Use Node.js 22.x diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml index 7f23015ba2..2b974185dc 100644 --- a/.github/workflows/ci-test.yml +++ b/.github/workflows/ci-test.yml @@ -25,7 +25,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false diff --git a/.github/workflows/contributors-png.yml b/.github/workflows/contributors-png.yml index 321b5ddfa5..d088ab662b 100644 --- a/.github/workflows/contributors-png.yml +++ b/.github/workflows/contributors-png.yml @@ -13,7 +13,7 @@ jobs: if: github.ref == 'refs/heads/main' && github.repository == 'processing/p5.js' runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false diff --git a/.github/workflows/release-workflow-v1.yml b/.github/workflows/release-workflow-v1.yml index 3c78251379..7edd793457 100644 --- a/.github/workflows/release-workflow-v1.yml +++ b/.github/workflows/release-workflow-v1.yml @@ -18,7 +18,7 @@ jobs: INPUT_TOKEN: ${{ secrets.NPM_TOKEN }} steps: # 1. Setup - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 @@ -84,7 +84,7 @@ jobs: # 4. Update p5.js website - name: Clone p5.js website if: ${{ steps.semver.outputs.is-prerelease != 'true' }} - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: processing/p5.js-website path: website @@ -121,7 +121,7 @@ jobs: # 5. Update Bower files - name: Checkout Bower repo if: ${{ steps.semver.outputs.is-prerelease != 'true' }} - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: processing/p5.js-release path: bower diff --git a/.github/workflows/release-workflow-v2.yml b/.github/workflows/release-workflow-v2.yml index cdfd639fdb..3a68bf4e77 100644 --- a/.github/workflows/release-workflow-v2.yml +++ b/.github/workflows/release-workflow-v2.yml @@ -18,7 +18,7 @@ jobs: INPUT_TOKEN: ${{ secrets.NPM_TOKEN }} steps: # 1. Setup - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 @@ -90,7 +90,7 @@ jobs: # 4. Update p5.js website - name: Clone p5.js website if: ${{ steps.semver.outputs.is-prerelease != 'true' }} - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: processing/p5.js-website ref: 'main' diff --git a/.github/workflows/stewards-update.yml b/.github/workflows/stewards-update.yml index 41a8e9257a..fecf93bda8 100644 --- a/.github/workflows/stewards-update.yml +++ b/.github/workflows/stewards-update.yml @@ -16,7 +16,7 @@ jobs: if: github.ref == 'refs/heads/main' && github.repository == 'processing/p5.js' runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false