From 1457d6f35663b4ae0d7ebb56f3f058cb7cc602e0 Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Mon, 31 Aug 2026 08:52:05 -0400 Subject: [PATCH] ci(deps): bump the github-actions group and migrate changesets to v2 Takes the ten action bumps from the Dependabot group and adds the config migration changesets/action v2 requires, which the bump alone does not carry. changesets/action v2 renamed every input this workflow passes: version to version-script, title to pr-title, commit to commit-message. It also stopped reading GITHUB_TOKEN from the environment in favour of a github-token input. Unknown inputs are ignored rather than rejected, so on the bare bump the version PR would have been titled "Version Packages", which commitlint rejects. More seriously, the hasChangesets output is now has-changesets. The old name reads as empty, so "Tag release" would never have run, and with no tag there is no GitHub release and no published image. The whole release chain would have gone quiet without failing. Verified that the other nine keep every input these workflows use: build-push v7 still takes sbom, provenance and load and still emits digest for the cosign step; trivy v0.36.0 still takes image-ref, format, exit-code, severity, ignore-unfixed, skip-dirs and output; metadata v6, login v4 and buildx v4 are unchanged for our usage. ci.yml and codeql.yml were exercised by CI on the Dependabot PR itself; docker-publish and release only run post-merge. Rebased onto current main rather than merging the Dependabot branch, which was cut before the pre-1.0 changeset guard landed and would have removed it. --- .github/workflows/ci.yml | 6 +++--- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/docker-publish.yml | 18 +++++++++--------- .github/workflows/release.yml | 24 +++++++++++++++--------- 4 files changed, 31 insertions(+), 25 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 01df7ec..2ef9760 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,10 +10,10 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version-file: '.nvmrc' cache: 'npm' @@ -47,7 +47,7 @@ jobs: run: CI=true npm run coverage - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@v7 with: token: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e239edc..a73df10 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,10 +24,10 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: javascript-typescript # security-extended adds rules that are lower signal on their own but @@ -36,9 +36,9 @@ jobs: queries: security-extended - name: Autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@v4 - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 with: category: /language:javascript-typescript diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 06fa5cb..0680ea4 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -35,15 +35,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ inputs.image_tag || github.ref_name }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -51,7 +51,7 @@ jobs: - name: Extract Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: | ghcr.io/${{ env.IMAGE_NAME }} @@ -64,7 +64,7 @@ jobs: # the local daemon, which is why this is separate from the push below. # Buildx caches the layers, so the second build is cheap. - name: Build image for scanning - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . push: false @@ -73,7 +73,7 @@ jobs: platforms: linux/amd64 - name: Scan image for vulnerabilities - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: image-ref: ${{ env.IMAGE_NAME }}:scan format: table @@ -96,7 +96,7 @@ jobs: # Runs even when the gate above failed, so the findings that blocked the # release are visible rather than only in the job log. if: always() - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: image-ref: ${{ env.IMAGE_NAME }}:scan format: sarif @@ -107,14 +107,14 @@ jobs: - name: Upload scan findings if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: trivy-results.sarif category: trivy-image - name: Build and push Docker image id: push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . push: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3864c0b..73be19d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -27,12 +27,12 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@v7 with: node-version-file: '.nvmrc' cache: npm @@ -57,13 +57,16 @@ jobs: - name: Create or update version and changelog PR id: changesets - uses: changesets/action@v1 + uses: changesets/action@v2 with: - version: npm run version-packages - title: 'chore: update version and changelog' - commit: 'chore: update version and changelog' - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # v2 renamed every one of these. Unknown inputs are ignored rather than + # rejected, so the old names would have left the version PR titled + # "Version Packages", which commitlint rejects. + version-script: npm run version-packages + pr-title: 'chore: update version and changelog' + commit-message: 'chore: update version and changelog' + # v2 no longer reads GITHUB_TOKEN from the environment. + github-token: ${{ secrets.GITHUB_TOKEN }} # Once the version PR is merged there are no changesets left, so the # version in package.json is the one to release. Tag it (idempotently) so @@ -72,7 +75,10 @@ jobs: # not trigger other workflows; the image build is invoked directly below. - name: Tag release id: tag - if: steps.changesets.outputs.hasChangesets == 'false' + # Renamed from hasChangesets in changesets/action v2. The old name reads as + # empty, never equals 'false', and would silently stop every release here. + # Index syntax because the new name is hyphenated. + if: steps.changesets.outputs['has-changesets'] == 'false' run: | set -euo pipefail VERSION="$(node -p "require('./package.json').version")"