NO-JIRA: chore(deps): update external GitHub Actions to latest versions#2827
NO-JIRA: chore(deps): update external GitHub Actions to latest versions#2827jiridanek merged 10 commits intoopendatahub-io:mainfrom
Conversation
Changes in v6: - Node.js 24 support (requires runner v2.327.1+) - Persist credentials to separate file under $RUNNER_TEMP - Improved worktree support for persist-credentials includeIf Breaking: Requires Actions Runner v2.329.0 for Docker container actions
Changes in v6: - Node.js 24 support (requires runner v2.327.1+) - Improved toolchain handling for reliable selection - Support for .tool-versions file (v6.1.0) - Fallback to go.dev/dl instead of storage.googleapis.com Breaking: Improved toolchain handling may affect existing setups
Changes in v6: - Node.js 24 support (requires runner v2.327.1+) - New pip-version input to specify pip version - Enhanced reading from .python-version file - Version parsing from Pipfile - v6.1.0: pip-install input and GraalPy early-access support New feature: Consider using pip-version input for reproducible builds
Changes in v5: - Node.js 24 support (requires runner v2.327.1+) - v5.0.1 fixes Node.js 24 punycode deprecation warning No new features, primarily runtime upgrade
Changes from v0.5.0 to v1: - Promoted to stable API (v1.0.0) - Added reopened event support (v0.6.0) - Documented outputs in action manifest - Security fix for undici Now uses stable v1 major version tag
Changes in v8: - Node.js 24 support (requires runner v2.327.1+) No new features, primarily runtime upgrade
docker/login-action is currently using @V3 which is a floating major version tag. Latest release is v3.6.0. New features available: - registry-auth input for raw authentication (v3.6.0) - Dual-stack endpoints for AWS ECR (v3.5.0) No changes needed - floating tag auto-updates to latest v3.x
Changes in v8: - Node.js 24 support (requires runner v2.327.1+) - v7.0.9 fixed compatibility with actions/checkout@v6 Updated SHA from c5a7806660adbe173f04e3e038b0ccdcd758773c (v6.1.0) to 98357b18bf14b5342f975ff684046ec3b2a07725 (v8.0.0)
Changes in v3.0.1: - Use provided GITHUB_* URL variables - Fix output coloring - Update dependencies Updated SHA from 4f22ef80902ad409ed55a99dc5133cc1250a0d03 (v3.0.0) to 3b0972b2276b171b212f8c4efbca59ebba26eceb (v3.0.1)
repo-sync/pull-request is currently using @v2 which is a floating major version tag. Latest release is v2.12.1. Changes since v2: - Third-party repository support (v2.10) - Logging and pr_created flag (v2.11) - Fix special characters in repo URL (v2.12.1) No changes needed - floating tag auto-updates to latest v2.x
github-actions
bot
added
the
review-requested
📝 WalkthroughWalkthroughThis PR systematically upgrades GitHub Actions workflow dependencies across the repository. Changes include bumping Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jiridanek
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/actions/install-podman-action/action.yml (1)
16-22: LGTM, but note runner version requirement and cache service migration.The upgrade from
actions/cache@v4to@v5maintains the same cache syntax and configuration. However:
- Minimum runner requirement: v5 requires GitHub Actions runner >= 2.327.1. Self-hosted runners must be updated.
- Cache service migration: v5 uses the new cache service (v2) APIs. This is a backend change, though backward compatible with the new service. The legacy service sunset is scheduled for February 1, 2025.
- Node.js 24: v5 runs on Node.js 24 (v4 uses Node.js 20). Verify any custom actions or dependencies are compatible.
The cache configuration itself (path, key) remains unchanged and will continue to work.
🤖 Fix all issues with AI agents
In @.github/workflows/test-provision-k8s.yaml:
- Line 19: Update the runner version requirement text that accompanies the
actions/checkout@v6 upgrade to specify Actions Runner v2.329.0 or later (not
v2.327.1+); keep the actions/checkout@v6 usage as-is and note that standard
checkout on ubuntu-24.04 already meets this requirement and no workflow changes
are needed for the credential storage behavior.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (27)
.github/actions/install-podman-action/action.yml.github/workflows/auto-add-issue-to-project.yml.github/workflows/build-notebooks-TEMPLATE.yaml.github/workflows/build-notebooks-pr-aipcc.yaml.github/workflows/build-notebooks-pr-rhel.yaml.github/workflows/build-notebooks-pr.yaml.github/workflows/build-notebooks-push.yaml.github/workflows/code-quality.yaml.github/workflows/create-release.yaml.github/workflows/docs.yaml.github/workflows/notebooks-digest-updater.yaml.github/workflows/notebooks-release.yaml.github/workflows/notify-team-to-review-pr.yml.github/workflows/params-env.yaml.github/workflows/piplock-renewal.yaml.github/workflows/pr-merge-image-delete.yml.github/workflows/purge-ghcr.yaml.github/workflows/sec-scan.yml.github/workflows/security.yaml.github/workflows/software-versions.yaml.github/workflows/sync-branches-through-pr.yml.github/workflows/test-install-podman.yaml.github/workflows/test-provision-k8s.yaml.github/workflows/test-trivy-scan-action.yaml.github/workflows/update-buildconfigs.yaml.github/workflows/update-commit-latest-env.yaml.github/workflows/update-tags.yaml
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-12-19T15:54:11.014Z
Learnt from: jiridanek
Repo: opendatahub-io/notebooks PR: 2790
File: .github/workflows/build-notebooks-TEMPLATE.yaml:209-213
Timestamp: 2025-12-19T15:54:11.014Z
Learning: Podman buildenv behavior: --unsetenv removes variables from the final image, not during build. If you need a variable during the build (e.g., for compilation), pass it with --env=VAR=value; after build, use --unsetenv=VAR to remove it from the final image. Apply this pattern in workflow steps that build notebooks to ensure sensitive or build-time vars are not left in the final image.
Applied to files:
.github/workflows/test-provision-k8s.yaml.github/workflows/docs.yaml.github/workflows/test-trivy-scan-action.yaml.github/workflows/software-versions.yaml.github/workflows/notebooks-release.yaml.github/workflows/security.yaml.github/workflows/create-release.yaml.github/workflows/test-install-podman.yaml.github/workflows/build-notebooks-pr-rhel.yaml.github/workflows/build-notebooks-pr.yaml.github/workflows/update-tags.yaml.github/workflows/update-buildconfigs.yaml.github/workflows/update-commit-latest-env.yaml.github/workflows/build-notebooks-pr-aipcc.yaml.github/workflows/build-notebooks-TEMPLATE.yaml.github/workflows/build-notebooks-push.yaml.github/workflows/params-env.yaml.github/workflows/piplock-renewal.yaml.github/workflows/notebooks-digest-updater.yaml.github/workflows/purge-ghcr.yaml.github/workflows/code-quality.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Test Template with Minimal Notebook / build
🔇 Additional comments (36)
.github/workflows/update-commit-latest-env.yaml (1)
24-27: LGTM — checkout v6 upgrade is appropriate.The upgrade aligns with the PR's goal of Node.js 24 compatibility. The
tokenparameter continues to work in v6, and the credential helper will still support thegit pushoperation at line 43. Theubuntu-latestrunner should meet the v2.327.1+ requirement..github/workflows/auto-add-issue-to-project.yml (1)
18-25: LGTM! Upgrade to stable v1 API is safe.The version bump from
v0.5.0tov1aligns with the PR objectives to move to the stable v1 API with security fixes. The inputs (project-url,github-token) are confirmed as supported in v1 with no breaking changes, and the GitHub App token approach is the recommended authentication method..github/workflows/test-trivy-scan-action.yaml (2)
24-25: LGTM!Consistent upgrade to
actions/checkout@v6in the image scan job.
75-76: LGTM!Consistent upgrade to
actions/checkout@v6in the filesystem scan job..github/workflows/create-release.yaml (1)
47-49: LGTM!The upgrade to
actions/checkout@v6preserves thefetch-depth: 0setting required for release tag generation with full git history..github/workflows/software-versions.yaml (1)
28-28: LGTM!Consistent upgrade to
actions/checkout@v6..github/workflows/notebooks-release.yaml (2)
75-77: LGTM!The upgrade to
actions/checkout@v6looks correct. The workflow usesGITHUB_TOKENfrom environment variables for git operations rather than relying on checkout-persisted credentials, so the credential path change in v6 shouldn't affect this workflow.Ensure the GitHub-hosted runners support Actions Runner v2.327.1+ which is required for
checkout@v6. As of late 2025, GitHub-hosted runners should meet this requirement, but verify CI passes.
108-110: LGTM!Same as above—this checkout step correctly uses
fetch-depth: 0and the workflow's git operations rely onGITHUB_TOKENenvironment variable..github/workflows/notify-team-to-review-pr.yml (1)
22-33: LGTM!The upgrade to
actions/github-script@v8is appropriate for Node.js 24 compatibility. The script uses standard Octokit REST API calls which remain compatible across versions..github/workflows/security.yaml (1)
28-29: LGTM!The upgrade to
actions/checkout@v6is appropriate. This workflow performs read-only security scanning without any git operations that would depend on persisted credentials..github/workflows/code-quality.yaml (3)
15-15: LGTM!The upgrade to
actions/checkout@v6is appropriate. This job only performs read-only git operations (git status,git diff) to verify generated code is committed.
44-44: LGTM!Checkout upgrade is correct for this test job which doesn't perform any git operations after checkout.
74-74: LGTM!Checkout upgrade is correct for this static analysis job which only reads files without git operations.
.github/workflows/update-buildconfigs.yaml (1)
37-40: LGTM. The upgrade toactions/checkout@v6is compatible with this workflow. Theci/buildconfig-updater.shscript is a simple file editor that doesn't reference any credential paths, and the workflow usesGITHUB_TOKENvia environment variable for all git operations..github/workflows/docs.yaml (1)
19-19: LGTM!The
actions/checkoutupgrade to v6 is appropriate for Node.js 24 compatibility. This workflow performs a simple checkout followed by script execution, so the v6 credential handling changes don't impact it..github/workflows/update-tags.yaml (1)
17-20: LGTM!The upgrade to
actions/checkout@v6is correct. This workflow performs git push operations (line 68), and v6 continues to persist credentials by default (now stored in$RUNNER_TEMPinstead of.git/config), so authenticated git commands will continue to work..github/workflows/build-notebooks-push.yaml (1)
32-36: LGTM!Both action upgrades are appropriate:
actions/checkout@v6: Node.js 24 compatibilityactions/setup-go@v6: Node.js 24 support with improved toolchain handling; thecache-dependency-pathoption remains compatible.github/workflows/build-notebooks-pr.yaml (1)
31-35: LGTM!The upgrades to
actions/checkout@v6andactions/setup-go@v6are correct. The subsequentgit fetchoperations (lines 40-41) will continue to work as they fetch public refs from the same repository..github/workflows/build-notebooks-pr-aipcc.yaml (1)
53-62: LGTM!All action upgrades are correct and consistent:
- Both conditional
actions/checkout@v6steps (lines 53 and 57) are updated consistentlyactions/setup-go@v6upgrade maintains the same cache configurationThe security gating (lines 40-49) that runs before checkout remains intact, which is critical for this
pull_request_targetworkflow..github/workflows/notebooks-digest-updater.yaml (1)
53-67: LGTM!The
actions/checkoutupdates from v5 to v6 are consistent with the PR objectives. The existing configuration options (ref,fetch-depth) remain compatible with v6..github/workflows/sec-scan.yml (3)
31-34: LGTM!The
actions/checkout@v6update is consistent with the PR-wide version bump.
54-58: LGTM!Checkout steps for upstream repository references are correctly updated to v6.
96-99: LGTM!The
actions/setup-python@v6update maintains compatibility with the existingpython-version-fileconfiguration..github/workflows/build-notebooks-pr-rhel.yaml (1)
51-60: LGTM!The
actions/checkout@v6andactions/setup-go@v6updates are consistent with the PR objectives. The security check correctly precedes checkout for thispull_request_targetworkflow, which is essential for safe handling of untrusted PR code..github/workflows/sync-branches-through-pr.yml (2)
22-25: LGTM!The
actions/checkout@v6update is consistent with the PR objectives.
38-47: SHA pin is correct for v8.0.0. The commit98357b18bf14b5342f975ff684046ec3b2a07725correctly corresponds topeter-evans/create-pull-request@v8.0.0. The options used (branch,title,body) remain fully compatible with v8.0.0; no breaking changes affect these parameters..github/workflows/build-notebooks-TEMPLATE.yaml (3)
75-85: LGTM!The
actions/checkout@v6updates are consistent with the PR objectives. The conditional checkout logic and LFS support configuration remain compatible with v6.
134-136: LGTM!The
actions/setup-go@v6update forscripts/buildinputsis consistent with the PR objectives.
404-408: LGTM!The second
actions/setup-go@v6instance forscripts/check-payloadcorrectly uses a separatecache-dependency-pathand maintains the customGOPATHconfiguration..github/workflows/test-install-podman.yaml (1)
25-25: LGTM!The upgrade to
actions/checkout@v6is appropriate. This workflow usesubuntu-24.04which should have the required Actions Runner v2.327.1+ for Node.js 24 support. The workflow doesn't use git credentials post-checkout, so the credential location change in v6 won't impact functionality..github/workflows/pr-merge-image-delete.yml (2)
17-19: LGTM!The upgrade to
actions/checkout@v6is appropriate. Thefetch-depth: '0'option for full history remains fully supported.
26-43: LGTM!The upgrade to
actions/github-script@v8is appropriate. The script logic usingcontext.issue.numberandgithub.rest.repos.listPullRequestsAssociatedWithCommitis standard GitHub API usage that remains compatible with v8..github/workflows/piplock-renewal.yaml (2)
75-77: LGTM!The upgrade to
actions/setup-python@v6is appropriate. Thepython-versioninput usage remains unchanged and compatible.
64-67: No changes required for credential handling.This workflow correctly passes the custom
tokentoactions/checkout@v6, which is the recommended approach for authenticated push operations in v6. The token is securely persisted to$RUNNER_TEMPby default and will be available for subsequentgit pushcommands. The change in credential storage location is a security improvement and does not affect the workflow's functionality..github/workflows/params-env.yaml (1)
21-21: LGTM!The upgrade to
actions/checkout@v6is appropriate. This workflow uses default checkout options and doesn't perform git operations post-checkout, so the credential location change has no impact..github/workflows/purge-ghcr.yaml (1)
23-23: LGTM! SHA-pinned patch update is correct.Good security practice keeping the SHA-pinned reference with an inline version comment. This patch bump (v3.0.0 → v3.0.1) is low-risk and the SHA
3b0972b2276b171b212f8c4efbca59ebba26ecebcorrectly corresponds to the v3.0.1 release tag.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Check the git diff for the workflow file to confirm v5→v6 upgrade
git diff HEAD -- .github/workflows/test-provision-k8s.yamlRepository: opendatahub-io/notebooks
Length of output: 50
🌐 Web query:
actions/checkout v6 requirements changes breaking
💡 Result:
Short summary — what changed in actions/checkout v6 that can break workflows:
-
Credential storage: persist-credentials still exists but v6 no longer writes the token directly into .git/config; it stores credentials in $RUNNER_TEMP and references them from .git/config. Workflows or build/publish steps that assumed credentials were inside the repo (or that packaged .git/config) may break or behave differently. [1][3]
-
Runner minimum for container-authenticated git: if you run authenticated git commands from inside a Docker container action, runners must be v2.329.0 or later. Jobs on older self-hosted runners (or older GitHub-hosted runners) will fail for that scenario. [1][2]
-
Related/node-runtime notes: earlier major updates (v5) moved node runtime versions and had their own runner minimums (v2.327.1 for Node24/Node20 transitions); check your other actions for similar runtime/runner requirements. [2]
If you want, tell me whether you use GitHub-hosted or self-hosted runners and I’ll list concrete fixes (pinning action version, upgrading runner, or changing persist-credentials usage).
Sources: [1] actions/checkout v6 release/marketplace notes; [2] actions/checkout README; [3] GitHub Community discussion about the v6 credential change.
🌐 Web query:
actions/checkout v6 changelog release notes
💡 Result:
Summary of actions/checkout v6 release notes — key changes:
- persist-credentials now writes credentials to a separate file under $RUNNER_TEMP (improved credential security). [1][3]
- No workflow changes required; git fetch/push continue to work automatically. [1]
- Running authenticated git commands from a Docker container action requires Actions Runner v2.329.0 or later. [1][2]
- v6 updates README to document Node.js 24 runtime support and related runner requirements. [3][2]
Sources:
- actions/checkout README / "What's new" (v6). [1]
- GitHub Marketplace Checkout v6 notes. [2]
- actions/checkout changelog / release commits (v6, v6.0.1). [3]
🏁 Script executed:
# Read the actual workflow file to confirm current state
cat -n .github/workflows/test-provision-k8s.yaml | head -30Repository: opendatahub-io/notebooks
Length of output: 659
Update runner version requirement for actions/checkout v6.
The upgrade to actions/checkout@v6 is appropriate. However, the runner version requirement is inaccurate: v6 requires Actions Runner v2.329.0 or later for authenticated git commands executed from Docker container actions, not v2.327.1+. For standard checkout operations, ubuntu-24.04 runners meet the requirement. The credential storage improvement (now using $RUNNER_TEMP instead of .git/config) requires no workflow changes.
🤖 Prompt for AI Agents
In @.github/workflows/test-provision-k8s.yaml at line 19, Update the runner
version requirement text that accompanies the actions/checkout@v6 upgrade to
specify Actions Runner v2.329.0 or later (not v2.327.1+); keep the
actions/checkout@v6 usage as-is and note that standard checkout on ubuntu-24.04
already meets this requirement and no workflow changes are needed for the
credential storage behavior.
|
@jiridanek: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: atheo89 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
…ns (opendatahub-io#2827) * chore(deps): update actions/checkout v5 → v6 Changes in v6: - Node.js 24 support (requires runner v2.327.1+) - Persist credentials to separate file under $RUNNER_TEMP - Improved worktree support for persist-credentials includeIf Breaking: Requires Actions Runner v2.329.0 for Docker container actions * chore(deps): update actions/setup-go v5 → v6 Changes in v6: - Node.js 24 support (requires runner v2.327.1+) - Improved toolchain handling for reliable selection - Support for .tool-versions file (v6.1.0) - Fallback to go.dev/dl instead of storage.googleapis.com Breaking: Improved toolchain handling may affect existing setups * chore(deps): update actions/setup-python v5 → v6 Changes in v6: - Node.js 24 support (requires runner v2.327.1+) - New pip-version input to specify pip version - Enhanced reading from .python-version file - Version parsing from Pipfile - v6.1.0: pip-install input and GraalPy early-access support New feature: Consider using pip-version input for reproducible builds * chore(deps): update actions/cache v4 → v5 Changes in v5: - Node.js 24 support (requires runner v2.327.1+) - v5.0.1 fixes Node.js 24 punycode deprecation warning No new features, primarily runtime upgrade * chore(deps): update actions/add-to-project v0.5.0 → v1 Changes from v0.5.0 to v1: - Promoted to stable API (v1.0.0) - Added reopened event support (v0.6.0) - Documented outputs in action manifest - Security fix for undici Now uses stable v1 major version tag * chore(deps): update actions/github-script v7 → v8 Changes in v8: - Node.js 24 support (requires runner v2.327.1+) No new features, primarily runtime upgrade * chore(deps): docker/login-action v3 already using floating tag docker/login-action is currently using @V3 which is a floating major version tag. Latest release is v3.6.0. New features available: - registry-auth input for raw authentication (v3.6.0) - Dual-stack endpoints for AWS ECR (v3.5.0) No changes needed - floating tag auto-updates to latest v3.x * chore(deps): update peter-evans/create-pull-request v6.1.0 → v8.0.0 Changes in v8: - Node.js 24 support (requires runner v2.327.1+) - v7.0.9 fixed compatibility with actions/checkout@v6 Updated SHA from c5a7806660adbe173f04e3e038b0ccdcd758773c (v6.1.0) to 98357b18bf14b5342f975ff684046ec3b2a07725 (v8.0.0) * chore(deps): update snok/container-retention-policy v3.0.0 → v3.0.1 Changes in v3.0.1: - Use provided GITHUB_* URL variables - Fix output coloring - Update dependencies Updated SHA from 4f22ef80902ad409ed55a99dc5133cc1250a0d03 (v3.0.0) to 3b0972b2276b171b212f8c4efbca59ebba26eceb (v3.0.1) * chore(deps): repo-sync/pull-request v2 already using floating tag repo-sync/pull-request is currently using @v2 which is a floating major version tag. Latest release is v2.12.1. Changes since v2: - Third-party repository support (v2.10) - Logging and pr_created flag (v2.11) - Fix special characters in repo URL (v2.12.1) No changes needed - floating tag auto-updates to latest v2.x (cherry picked from commit 53f5ce7)
3 participants
Summary
Updates external GitHub Actions to their latest versions for improved security, performance, and Node.js 24 compatibility.
Changes
actions/checkout$RUNNER_TEMPactions/setup-goactions/setup-pythonactions/cacheactions/add-to-projectactions/github-scriptpeter-evans/create-pull-requestsnok/container-retention-policySecurity Improvements
actions/checkout@v6: Credentials are now persisted to a separate file under$RUNNER_TEMPinstead of.git/config, reducing risk of accidental credential exposure in artifacts. See PR #2286 for details.Breaking Changes
actions/*now require Actions Runner v2.327.1+ (GitHub-hosted runners are already updated)Notes
docker/login-action@v3andrepo-sync/pull-request@v2use floating major version tags and are already receiving updates automaticallypeter-evans/create-pull-request,snok/container-retention-policy) have been updated to new SHAsTesting