Skip to content

Commit fb7fdbf

Browse files
elkaixelkaix
authored
ci(actions): update workflows for Node 24
Update CI and release workflows to Node 24-backed actions, pin workflow actions to immutable SHAs, and replace cross-repo dispatch token minting with fail-loud GitHub App token exchange.
1 parent f0c080b commit fb7fdbf

21 files changed

Lines changed: 296 additions & 124 deletions

‎.github/workflows/changelog-entry-required.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v4
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
2929
with:
3030
fetch-depth: 0
3131
# Read-only job (git show/diff on already-fetched history, no push);

‎.github/workflows/ci-docs.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,15 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v4
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
2929

3030
- name: Set up Node.js
31-
uses: actions/setup-node@v4
31+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # pinned from v6.4.0
3232
with:
33-
node-version: "20"
33+
node-version: "24"
3434

3535
- name: Cache docs node_modules
36-
uses: actions/cache@v4
36+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # pinned from v5.0.5
3737
with:
3838
path: docs/node_modules
3939
key: ${{ runner.os }}-docs-node-modules-${{ hashFiles('docs/package.json') }}

‎.github/workflows/ci-pythinker-cli.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,17 @@ jobs:
3131
runs-on: ubuntu-22.04
3232
steps:
3333
- name: Checkout repository
34-
uses: actions/checkout@v4
34+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
3535

3636
- name: Set up Python 3.14
3737
id: setup-python
38-
uses: actions/setup-python@v5
38+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
3939
with:
4040
python-version: "3.14"
4141
allow-prereleases: true
4242

4343
- name: Set up uv
44-
uses: astral-sh/setup-uv@v1
44+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # pinned from v8.1.0
4545
with:
4646
version: "0.8.5"
4747
enable-cache: true
@@ -65,17 +65,17 @@ jobs:
6565
runs-on: ubuntu-22.04
6666
steps:
6767
- name: Checkout repository
68-
uses: actions/checkout@v4
68+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
6969

7070
- name: Set up Python ${{ matrix.python-version }}
7171
id: setup-python
72-
uses: actions/setup-python@v5
72+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
7373
with:
7474
python-version: ${{ matrix.python-version }}
7575
allow-prereleases: true
7676

7777
- name: Set up uv
78-
uses: astral-sh/setup-uv@v1
78+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # pinned from v8.1.0
7979
with:
8080
version: "0.8.5"
8181
enable-cache: true
@@ -125,29 +125,29 @@ jobs:
125125
continue-on-error: ${{ matrix.experimental == true }}
126126
steps:
127127
- name: Checkout repository
128-
uses: actions/checkout@v4
128+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
129129

130130
- name: Install GNU Make (Windows)
131131
if: runner.os == 'Windows'
132132
run: choco install make -y
133133

134134
- name: Set up Python 3.13
135135
id: setup-python
136-
uses: actions/setup-python@v5
136+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
137137
with:
138138
python-version: "3.13"
139139

140140
- name: Set up uv
141-
uses: astral-sh/setup-uv@v1
141+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # pinned from v8.1.0
142142
with:
143143
version: "0.8.5"
144144
enable-cache: true
145145
cache-dependency-glob: uv.lock
146146

147147
- name: Set up Node.js (web build)
148-
uses: actions/setup-node@v4
148+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # pinned from v6.4.0
149149
with:
150-
node-version: "20"
150+
node-version: "24"
151151
cache: "npm"
152152
cache-dependency-path: web/package-lock.json
153153

@@ -190,7 +190,7 @@ jobs:
190190
# collide on the artifact name. The probe only needs the build to
191191
# succeed; we do not consume its binary.
192192
if: success() && !matrix.experimental
193-
uses: actions/upload-artifact@v4
193+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pinned from v7.0.1
194194
with:
195195
name: pythinker-${{ matrix.target }}
196196
path: ${{ matrix.binary_path }}
@@ -202,12 +202,12 @@ jobs:
202202
runs-on: ubuntu-latest
203203
steps:
204204
- name: Checkout repository
205-
uses: actions/checkout@v4
205+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
206206
with:
207207
fetch-depth: 0
208208

209209
- name: Set up Python 3.14
210-
uses: actions/setup-python@v5
210+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
211211
with:
212212
python-version: "3.14"
213213
allow-prereleases: true
@@ -319,10 +319,10 @@ jobs:
319319
runs-on: ${{ matrix.runner }}
320320
steps:
321321
- name: Checkout repository
322-
uses: actions/checkout@v4
322+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
323323

324324
- name: Install Nix
325-
uses: DeterminateSystems/nix-installer-action@main
325+
uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # pinned from main
326326

327327
- name: Run nix package
328328
run: nix run .#pythinker-code -- --version && nix run . -- --help

‎.github/workflows/ci-pythinker-core.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,17 @@ jobs:
2828
python-version: ["3.12", "3.13", "3.14"]
2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@v4
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
3232

3333
- name: Set up Python ${{ matrix.python-version }}
3434
id: setup-python
35-
uses: actions/setup-python@v5
35+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
3636
with:
3737
python-version: ${{ matrix.python-version }}
3838
allow-prereleases: true
3939

4040
- name: Set up uv
41-
uses: astral-sh/setup-uv@v1
41+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # pinned from v8.1.0
4242
with:
4343
version: "0.8.5"
4444
enable-cache: true
@@ -65,16 +65,16 @@ jobs:
6565
FOOTER_VERSION: ${{ github.ref_name }}
6666
steps:
6767
- name: Checkout repository
68-
uses: actions/checkout@v4
68+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
6969

7070
- name: Set up Python 3.14
71-
uses: actions/setup-python@v5
71+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
7272
with:
7373
python-version: "3.14"
7474
allow-prereleases: true
7575

7676
- name: Set up uv
77-
uses: astral-sh/setup-uv@v1
77+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # pinned from v8.1.0
7878
with:
7979
version: "0.8.5"
8080
enable-cache: true
@@ -91,7 +91,7 @@ jobs:
9191
-o packages/pythinker-core/docs
9292
9393
- name: Upload docs preview
94-
uses: actions/upload-artifact@v4
94+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pinned from v7.0.1
9595
with:
9696
name: docs-preview
9797
path: packages/pythinker-core/docs

‎.github/workflows/ci-pythinker-host.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ jobs:
5151
shell: bash
5252
steps:
5353
- name: Checkout repository
54-
uses: actions/checkout@v4
54+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
5555

5656
- name: Install GNU Make (Windows)
5757
if: runner.os == 'Windows'
@@ -60,13 +60,13 @@ jobs:
6060

6161
- name: Set up Python ${{ matrix.python-version }}
6262
id: setup-python
63-
uses: actions/setup-python@v5
63+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
6464
with:
6565
python-version: ${{ matrix.python-version }}
6666
allow-prereleases: true
6767

6868
- name: Set up uv
69-
uses: astral-sh/setup-uv@v1
69+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # pinned from v8.1.0
7070
with:
7171
version: "0.8.5"
7272
enable-cache: true

‎.github/workflows/ci-pythinker-sdk.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,17 @@ jobs:
2828
python-version: ["3.12", "3.13", "3.14"]
2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@v4
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
3232

3333
- name: Set up Python ${{ matrix.python-version }}
3434
id: setup-python
35-
uses: actions/setup-python@v5
35+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
3636
with:
3737
python-version: ${{ matrix.python-version }}
3838
allow-prereleases: true
3939

4040
- name: Set up uv
41-
uses: astral-sh/setup-uv@v1
41+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # pinned from v8.1.0
4242
with:
4343
version: "0.8.5"
4444
enable-cache: true
@@ -65,16 +65,16 @@ jobs:
6565
FOOTER_VERSION: ${{ github.ref_name }}
6666
steps:
6767
- name: Checkout repository
68-
uses: actions/checkout@v4
68+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
6969

7070
- name: Set up Python 3.14
71-
uses: actions/setup-python@v5
71+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # pinned from v6.2.0
7272
with:
7373
python-version: "3.14"
7474
allow-prereleases: true
7575

7676
- name: Set up uv
77-
uses: astral-sh/setup-uv@v1
77+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # pinned from v8.1.0
7878
with:
7979
version: "0.8.5"
8080
enable-cache: true
@@ -91,7 +91,7 @@ jobs:
9191
-o sdks/pythinker-sdk/docs
9292
9393
- name: Upload docs preview
94-
uses: actions/upload-artifact@v4
94+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pinned from v7.0.1
9595
with:
9696
name: docs-preview
9797
path: sdks/pythinker-sdk/docs

‎.github/workflows/dispatch-pythinker-home-sync.yml‎

Lines changed: 42 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,48 @@ jobs:
3232
# ~1h TTL, minted fresh each run, scoped to the single private site repo.
3333
- name: Mint GitHub App token for pythinker-home
3434
id: app-token
35-
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
36-
with:
37-
app-id: ${{ secrets.PYTHINKER_RELEASE_BOT_APP_ID }}
38-
private-key: ${{ secrets.PYTHINKER_RELEASE_BOT_APP_PRIVATE_KEY }}
39-
owner: ${{ env.DISPATCH_OWNER }}
40-
repositories: ${{ env.DISPATCH_REPO }}
41-
permission-contents: write
35+
env:
36+
APP_ID: ${{ secrets.PYTHINKER_RELEASE_BOT_APP_ID }}
37+
APP_PRIVATE_KEY: ${{ secrets.PYTHINKER_RELEASE_BOT_APP_PRIVATE_KEY }}
38+
DISPATCH_OWNER: ${{ env.DISPATCH_OWNER }}
39+
DISPATCH_REPO: ${{ env.DISPATCH_REPO }}
40+
run: |
41+
set -euo pipefail
42+
if [ -z "${APP_ID:-}" ] || [ -z "${APP_PRIVATE_KEY:-}" ]; then
43+
echo "::error::Missing PYTHINKER_RELEASE_BOT_APP_ID or PYTHINKER_RELEASE_BOT_APP_PRIVATE_KEY. Configure the org-owned pythinker-release-bot App and install it on ${DISPATCH_OWNER}/${DISPATCH_REPO} with Contents: Read and write." >&2
44+
exit 1
45+
fi
46+
47+
b64url() { openssl base64 -A | tr '+/' '-_' | tr -d '='; }
48+
key_file=$(mktemp)
49+
trap 'rm -f "$key_file"' EXIT
50+
printf '%s\n' "$APP_PRIVATE_KEY" > "$key_file"
51+
chmod 600 "$key_file"
52+
53+
now=$(date +%s)
54+
header=$(printf '{"alg":"RS256","typ":"JWT"}' | b64url)
55+
payload=$(jq -nc --argjson iat "$((now - 60))" --argjson exp "$((now + 540))" --arg iss "$APP_ID" '{iat:$iat,exp:$exp,iss:$iss}' | b64url)
56+
unsigned="${header}.${payload}"
57+
signature=$(printf '%s' "$unsigned" | openssl dgst -sha256 -sign "$key_file" | b64url)
58+
jwt="${unsigned}.${signature}"
59+
60+
installation_id=$(curl --fail-with-body -sS \
61+
-H "Accept: application/vnd.github+json" \
62+
-H "Authorization: Bearer ${jwt}" \
63+
-H "X-GitHub-Api-Version: 2022-11-28" \
64+
"https://api.github.com/repos/${DISPATCH_OWNER}/${DISPATCH_REPO}/installation" \
65+
| jq -er '.id')
66+
token=$(jq -nc --arg repo "$DISPATCH_REPO" '{repositories:[$repo],permissions:{contents:"write"}}' \
67+
| curl --fail-with-body -sS \
68+
-X POST \
69+
-H "Accept: application/vnd.github+json" \
70+
-H "Authorization: Bearer ${jwt}" \
71+
-H "X-GitHub-Api-Version: 2022-11-28" \
72+
"https://api.github.com/app/installations/${installation_id}/access_tokens" \
73+
-d @- \
74+
| jq -er '.token')
75+
echo "::add-mask::$token"
76+
echo "token=$token" >> "$GITHUB_OUTPUT"
4277
4378
- name: Trigger pythinker-home sync
4479
env:

‎.github/workflows/docs-pages.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@ jobs:
2424
url: ${{ steps.deploy.outputs.page_url }}
2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@v4
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
2828

2929
- name: Set up Node.js
30-
uses: actions/setup-node@v4
30+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # pinned from v6.4.0
3131
with:
32-
node-version: "20"
32+
node-version: "24"
3333

3434
- name: Cache docs node_modules
35-
uses: actions/cache@v4
35+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # pinned from v5.0.5
3636
with:
3737
path: docs/node_modules
3838
key: ${{ runner.os }}-docs-node-modules-${{ hashFiles('docs/package.json') }}
@@ -41,7 +41,7 @@ jobs:
4141
4242
- name: Configure GitHub Pages
4343
id: pages
44-
uses: actions/configure-pages@v5
44+
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # pinned from v6.0.0
4545
with:
4646
enablement: true
4747

@@ -72,10 +72,10 @@ jobs:
7272
run: touch docs/.vitepress/dist/.nojekyll
7373

7474
- name: Upload Pages artifact
75-
uses: actions/upload-pages-artifact@v3
75+
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # pinned from v5.0.0
7676
with:
7777
path: docs/.vitepress/dist
7878

7979
- name: Deploy to GitHub Pages
8080
id: deploy
81-
uses: actions/deploy-pages@v4
81+
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # pinned from v5.0.0

0 commit comments

Comments
 (0)