From bb1ad2888791a4162040f72263b1e0df129a9e35 Mon Sep 17 00:00:00 2001 From: Emir Beganovic Date: Fri, 9 Oct 2026 22:14:54 +0200 Subject: [PATCH] CI: the four actions at their latest releases, and Dependabot weekly actions/checkout v5.0.0 -> v7.0.1 actions/upload-artifact v6.0.0 -> v7.0.2 actions/download-artifact v4.3.0 -> v8.0.2 docker/setup-buildx-action v4.3.0 -> v4.4.1 Each stays pinned to a commit, with the version in its comment. From the release notes, what the new majors change and why none of it touches these workflows: download-artifact v5 moved the path of an artifact fetched by ID, and ours is fetched by name; v8 fails on a checksum mismatch where v4 said nothing, which is what a publish job wants. checkout v7 refuses a fork's code under pull_request_target and workflow_run, and the one workflow_run here checks nothing out. The Node 24 releases need runner 2.327.1; ours run 2.337.0. Pinned actions do not update themselves, so .github/dependabot.yml asks for one grouped pull request a week. --- .github/dependabot.yml | 12 ++++++++++++ .github/workflows/install-test.yml | 6 +++--- .github/workflows/nightly-build.yml | 12 ++++++------ .github/workflows/unit-test.yml | 2 +- 4 files changed, 22 insertions(+), 10 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..fc02641 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +# Every action is pinned to a commit, so nothing updates by itself. Once a +# week Dependabot proposes the newer releases in one pull request, moving each +# commit and the version in its comment together. +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + actions: + patterns: ["*"] diff --git a/.github/workflows/install-test.yml b/.github/workflows/install-test.yml index 3235746..ebd55ed 100644 --- a/.github/workflows/install-test.yml +++ b/.github/workflows/install-test.yml @@ -28,7 +28,7 @@ jobs: runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || 'namespace-profile-linux-amd64-16x32' }} timeout-minutes: 75 steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Fail early and loudly if the runner ever has less disk than this needs. - name: Check disk space @@ -37,7 +37,7 @@ jobs: avail_gb=$(df -BG --output=avail / | tail -1 | tr -dc 0-9) [ "$avail_gb" -ge 40 ] || { echo "::error::only ${avail_gb} GB free, the ISO build and install test need ~40 GB"; exit 1; } - - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Build the ISO run: NO_BOOT_OFFER=1 ./bin/omarchy-iso-make @@ -118,7 +118,7 @@ jobs: - name: Upload test artifacts if: always() - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: install-test-${{ github.run_id }}-${{ github.run_attempt }} path: | diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml index 188d856..c8437e5 100644 --- a/.github/workflows/nightly-build.yml +++ b/.github/workflows/nightly-build.yml @@ -55,7 +55,7 @@ jobs: outputs: channels: ${{ steps.plan.outputs.channels }} steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: plan env: @@ -82,7 +82,7 @@ jobs: VERSION: ${{ matrix.version }} RELEASE: ${{ matrix.release }} steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Runner run: | @@ -98,7 +98,7 @@ jobs: avail_gb=$(df -BG --output=avail / | tail -1 | tr -dc 0-9) [ "$avail_gb" -ge 50 ] || { echo "::error::only ${avail_gb} GB free, the build, the install test and the image need ~50 GB"; exit 1; } - - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 if: matrix.channel == 'edge' # No package cache, on purpose: every package the ISO is made of is @@ -190,7 +190,7 @@ jobs: } >>"$GITHUB_STEP_SUMMARY" - name: Keep the release for the publish job - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nightly-${{ matrix.channel }}-${{ github.run_id }} path: out/ @@ -200,7 +200,7 @@ jobs: - name: Keep the install test's logs if: always() - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nightly-install-test-${{ matrix.channel }}-${{ github.run_id }}-${{ github.run_attempt }} path: | @@ -243,7 +243,7 @@ jobs: RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }} BUCKET: omarchy-nightly steps: - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nightly-${{ matrix.channel }}-${{ github.run_id }} path: out diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 6310014..84171f9 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # The tests run where the code they cover runs: on Arch, the same as # the live ISO and an Omarchy workstation. The container boots systemd