ci(deps): bump the github-actions group and migrate changesets to v2 - #233
Merged
Conversation
Takes the ten action bumps from the Dependabot group and adds the config migration changesets/action v2 requires, which the bump alone does not carry. changesets/action v2 renamed every input this workflow passes: version to version-script, title to pr-title, commit to commit-message. It also stopped reading GITHUB_TOKEN from the environment in favour of a github-token input. Unknown inputs are ignored rather than rejected, so on the bare bump the version PR would have been titled "Version Packages", which commitlint rejects. More seriously, the hasChangesets output is now has-changesets. The old name reads as empty, so "Tag release" would never have run, and with no tag there is no GitHub release and no published image. The whole release chain would have gone quiet without failing. Verified that the other nine keep every input these workflows use: build-push v7 still takes sbom, provenance and load and still emits digest for the cosign step; trivy v0.36.0 still takes image-ref, format, exit-code, severity, ignore-unfixed, skip-dirs and output; metadata v6, login v4 and buildx v4 are unchanged for our usage. ci.yml and codeql.yml were exercised by CI on the Dependabot PR itself; docker-publish and release only run post-merge. Rebased onto current main rather than merging the Dependabot branch, which was cut before the pre-1.0 changeset guard landed and would have removed it.
Bccorb
added a commit
that referenced
this pull request
Aug 31, 2026
A pull request only runs ci.yml and codeql.yml. Nothing reads release.yml or docker-publish.yml until they run for real on a tag or a push to main, which is how a broken release gate would reach main with every check green. This adds the one job that parses all five workflows on every pull request. Verified against deliberate regressions: it catches an undefined step id and malformed expression syntax, and shellcheck is preinstalled on the runner so it also covers the shell in every run: block. It does not validate inputs or outputs of third party actions, so it would not have caught the changesets v2 output rename in #233. This narrows the gap rather than closing it. actionlint is pinned by version and sha256 rather than installed through the upstream download script, which pipes an unpinned ref into bash. Dependabot tracks neither that script nor a docker:// reference, so the pair is bumped by hand and the checksum makes a swapped artifact fail loudly. Co-authored-by: Brandon Corbett <Bccorb@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #200. Same ten action bumps, plus the config migration one of them requires and a rebase that keeps a CI step #200 would have removed.
Why the bare bump was not safe
changesets/actionv2 renamed every inputrelease.ymlpasses, and renamed the output the release chain is gated on. Unknown inputs are ignored rather than rejected, so none of this would have failed loudly.version:version-script:title:pr-title:commit:commit-message:GITHUB_TOKENenvgithub-token:inputoutputs.hasChangesetsoutputs.has-changesetsThe output rename is the serious one.
Tag releaseis gated onsteps.changesets.outputs.hasChangesets == 'false', which under v2 reads as empty, never equals'false', and never runs. No tag means no GitHub release, andpublish-imageis gated onnew_tag == 'true', so no signed image either. The release pipeline would have gone quiet without a single red check.The input renames are milder but still wrong: the version PR would have been titled
Version Packages, which commitlint rejects.Read against the v2
action.ymlrather than inferred. The gate uses index syntax because the new name is hyphenated.The stale-branch problem
#200 was cut before #218 landed, so merging it would have deleted the
Check changeset bump levelstep fromci.yml, the guard that keeps a major changeset from releasing 1.0.0 as a side effect. This branch applies the bumps to currentmaininstead, so that step survives.The other nine
Checked each against its own
action.ymlfor the inputs these workflows actually pass:docker/build-push-actionv7 still takessbom,provenance,load, and still emitsdigest, which the cosign signing step consumesaquasecurity/trivy-actionv0.36.0 still takesimage-ref,format,exit-code,severity,ignore-unfixed,skip-dirs,outputdocker/metadata-actionv6,docker/login-actionv4,docker/setup-buildx-actionv4 unchanged for our usageactions/checkoutv7,actions/setup-nodev7,codecov/codecov-actionv7,github/codeql-actionv4 were all exercised green by CI on ci(deps): bump the github-actions group across 1 directory with 10 updates #200 itselfWorth being explicit about the coverage gap: a pull request only runs
ci.ymlandcodeql.yml.docker-publish.ymlandrelease.ymlrun on tag push and push to main, so nothing here proves them at PR time. That is why the changesets break needed reading rather than testing, and it is the same gap that lets a bad bump reach the release path unnoticed.Verification
actionlintover all five workflows: clean, exit 0. This is what validates theoutputs['has-changesets']expression.