Skip to content

Update GitHub Actions - #6843

Merged
ondrejmirtes merged 5 commits into
2.3.xfrom
update-github-actions
Oct 26, 2026
Merged

ondrejmirtes merged 5 commits into
2.3.xfrom
update-github-actions

Conversation

@ondrejmirtes

Copy link
Copy Markdown
Member

Updates pinned GitHub Actions in small steps, one commit per step:

  1. Minor and patch updates: TypedDevs/bashunit 0.52.0, WyriHaximus/github-action-get-previous-tag v2.1.0, actions/download-artifact v8.0.2, actions/upload-artifact v7.0.2, aws-actions/configure-aws-credentials v6.3.0, baptiste0928/cargo-install v3.5.0, crate-ci/typos v1.51.1, dorny/paths-filter v4.0.3, github/codeql-action v4.39.1, stefanzweifel/git-auto-commit-action v7.2.1, step-security/harden-runner v2.22.2
  2. actions/checkout v7 (also lifts apiref-infra from v4). v7 refuses to check out fork PR code under pull_request_target/workflow_run; no workflow here does that.
  3. actions/cache v6 (ESM migration, no input changes)
  4. actions/setup-node v7 (also lifts apiref-infra from v4)
  5. astral-sh/setup-uv v10 (cache changes only affect enable-cache: auto; zizmor sets enable-cache: false)

Every pinned SHA was resolved from the release tag and cross-checked against Renovate's pins. actionlint passes and typos v1.51.1 reports nothing for README.md src/.

Supersedes #6389 and the action part of #3443.

egress-policy: audit

- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
egress-policy: audit

- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: 'Get Previous tag'
id: previoustag
uses: "WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de" # v2.0.0
uses: "WyriHaximus/github-action-get-previous-tag@83f26fea93bc7efcbca2eb5591f5eaaf66b8f206" # v2.1.0

- name: "Install bashunit"
uses: "TypedDevs/bashunit@94933c088b0719e0c4cf5e3147dad67f713b970d" # 0.44.0
uses: "TypedDevs/bashunit@8d4f357f52df7596f92ece2d6c049d91d45517a2" # 0.52.0

- name: "Install bashunit"
uses: "TypedDevs/bashunit@94933c088b0719e0c4cf5e3147dad67f713b970d" # 0.44.0
uses: "TypedDevs/bashunit@8d4f357f52df7596f92ece2d6c049d91d45517a2" # 0.52.0

- name: "Install bashunit"
uses: "TypedDevs/bashunit@94933c088b0719e0c4cf5e3147dad67f713b970d" # 0.44.0
uses: "TypedDevs/bashunit@8d4f357f52df7596f92ece2d6c049d91d45517a2" # 0.52.0

- name: "Install bashunit"
uses: "TypedDevs/bashunit@94933c088b0719e0c4cf5e3147dad67f713b970d" # 0.44.0
uses: "TypedDevs/bashunit@8d4f357f52df7596f92ece2d6c049d91d45517a2" # 0.52.0

- name: Install the latest version of uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
run: "rm tmp/phpstan.phar"

- uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
- uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3

- name: "Install lucky_commit"
uses: baptiste0928/cargo-install@f204293d9709061b7bc1756fec3ec4e2cd57dec0 # v3.4.0
uses: baptiste0928/cargo-install@8195d4f734a149db85385bb4102b42efcd373759 # v3.5.0
- name: "Commit PHAR - tag"
if: "startsWith(github.ref, 'refs/tags/')"
uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
uses: stefanzweifel/git-auto-commit-action@d0b01107b5db882071f96de5dd4b54961ea93f4c # v7.2.1

- name: "Check for typos"
uses: "crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14" # v1.48.0
uses: "crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b" # v1.51.1
@ondrejmirtes
ondrejmirtes merged commit 432780a into 2.3.x Oct 26, 2026
745 of 746 checks passed
@ondrejmirtes
ondrejmirtes deleted the update-github-actions branch October 26, 2026 06:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants