chore(ci): update actions to their current major versions - #7691
Merged
Conversation
pfeerick
added
ci/cd 🔧
actions/checkout was spread across v5, v6 and v7 in different workflows; everything is now on one version. actions/checkout v5, v6, v7 -> v7 actions/download-artifact v7 -> v8 actions/setup-python v6 -> v7 actions/stale v10 -> v11 softprops/action-gh-release v2 -> v3 astral-sh/setup-uv v7 -> v10.0.1 repolevedavaj/install-nsis v1.2.1 -> v1 Already current: actions/cache@v6, actions/upload-artifact@v7, actions/upload-artifact/merge@v7, dorny/paths-filter@v4, montudor/action-zip@v1, orhun/git-cliff-action@v4 and jdpurcell/install-qt-action@v5. That last one publishes its major versions as branches rather than tags, so v5 is the moving reference even though the newest tag reads v4.1.1. setup-uv is pinned to a full version rather than a major. Its bare major tags stop at v7 - there is no v8, v9 or v10 - so a major reference cannot follow it any further. Everything else has a moving major and uses it; install-nsis v1 currently resolves to the same commit as v1.3.0. The note against action-gh-release in nightly.yml pointing at its PR 670 as the way to clear a Node.js warning goes too - v3 is what it suggested. The equivalent sweep for 2.12 is in #7687, which is where this started: build_fw there was warning that upload-artifact/merge@v4 targets Node.js 20 and was being forced onto Node.js 24. main was already past that one. Worth an eye on the first run: action-gh-release crosses a major and is what publishes the nightly release, and setup-uv crosses three. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
pfeerick
force-pushed
the
pfeerick/ci-action-versions
branch
from
August 21, 2026 03:49
f81cb87 to
92340be
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
maincounterpart to the sweep in #7687. That one started withbuild_fwwarning thatactions/upload-artifact/merge@v4targets Node.js 20 and was being forced onto Node.js 24 —mainwas already past that particular one, but several others here are behind, andactions/checkoutwas spread across three different versions (v5, v6 and v7) depending on the workflow.actions/checkoutactions/download-artifactactions/setup-pythonactions/stalesoftprops/action-gh-releaseastral-sh/setup-uvrepolevedavaj/install-nsisAlready current, untouched:
actions/cache@v6,actions/upload-artifact@v7,actions/upload-artifact/merge@v7,dorny/paths-filter@v4,montudor/action-zip@v1,orhun/git-cliff-action@v4,jdpurcell/install-qt-action@v5.Two that are not plain major bumps
astral-sh/setup-uvis pinned to a full version, not a major. Its bare major tags stop at v7 — there is nov8,v9orv10, so a major reference cannot follow it any further and@v10.0.1is the only way to be current. Everything else here has a moving major and uses it.jdpurcell/install-qt-action@v5looks wrong but is right. Its newest tag readsv4.1.1; it publishes majors as branches rather than tags, andv5resolves to a real commit. Left alone.install-nsis@v1was checked to resolve to the same commit asv1.3.0.The trailing note against
action-gh-releaseinnightly.yml, pointing at its PR 670 as the way to clear a Node.js warning, is removed — v3 is what it was suggesting.Testing
Every changed file was parsed as YAML (11/11). Beyond that this is only verifiable by running the workflows.
Warning
Two of these deserve an eye on the first run.
softprops/action-gh-releasecrosses a major version and is what publishes the nightly release, andsetup-uvcrosses three. Neither can be exercised from a PR.