Skip to content

Bump all workflow actions to a more recent version #7144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Garanas wants to merge 1 commit into from
Closed

Bump all workflow actions to a more recent version #7144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/bake-blueprints.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,14 +57,14 @@ jobs:
steps:
# Checkout the wiki generator that we use to bake blueprints
- name: Checkout Brewlan Wikigen Repository
uses: actions/checkout@v4
uses: actions/checkout@v7
Comment thread
BlackYps marked this conversation as resolved.
with:
repository: The-Balthazar/BrewWikiGen
path: ./brew-wiki-gen

# Checkout the FA repository
- name: Checkout FAF Repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
ref: ${{ inputs.reference }}
ssh-key: ${{ secrets.SSH_FAFOREVER_MACHINE_USER }}
Expand All @@ -76,7 +76,7 @@ jobs:

# Install the correct version of Lua for the wiki generator
- name: Install Lua 5.4
uses: leafo/gh-actions-lua@v10
uses: leafo/gh-actions-lua@v13
with:
luaVersion: "5.4"

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/deploy-faf.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
steps:
# https://github.com/actions/checkout/tree/v4/
- name: Checkout FA repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
ssh-key: ${{ secrets.SSH_FAFOREVER_MACHINE_USER }}
repository: FAForever/fa
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/deploy-fafbeta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ jobs:
steps:
# https://github.com/actions/checkout/tree/v4/
- name: Checkout FA repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
ssh-key: ${{ secrets.SSH_FAFOREVER_MACHINE_USER }}
ref: staging/fafbeta
Expand Down Expand Up @@ -96,7 +96,7 @@ jobs:
run: rm -f lua/ui/lobby/changelog/generated/*

- name: Retrieve generated lua changelog
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
Comment thread
BlackYps marked this conversation as resolved.
with:
name: lua_changelog
path: lua/ui/lobby/changelog/generated
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/deploy-fafdevelop.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ jobs:
steps:
# https://github.com/actions/checkout/tree/v4/
- name: Checkout FA repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
ssh-key: ${{ secrets.SSH_FAFOREVER_MACHINE_USER }}
ref: staging/fafdevelop
Expand Down Expand Up @@ -96,7 +96,7 @@ jobs:
run: rm -f lua/ui/lobby/changelog/generated/*

- name: Retrieve generated lua changelog
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: lua_changelog
path: lua/ui/lobby/changelog/generated
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/docs-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ jobs:
working-directory: docs
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
sparse-checkout: |
docs
Expand All @@ -86,14 +86,14 @@ jobs:
- name: Download artifact changelog of FAF Develop
# No artifact exists when there are no snippets to process
continue-on-error: true
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: changelog-fafdevelop
path: docs/generated

- name: Download artifact changelog of FAF Beta
continue-on-error: true
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: changelog-fafbeta
path: docs/generated
Expand Down Expand Up @@ -126,7 +126,7 @@ jobs:

- name: Setup Pages
id: pages
uses: actions/configure-pages@v5
uses: actions/configure-pages@v6

- name: Build with Jekyll
# Outputs to the './_site' directory by default
Expand All @@ -136,7 +136,7 @@ jobs:

- name: Upload artifact
# Automatically uploads an artifact from the './_site' directory by default
uses: actions/upload-pages-artifact@v3
uses: actions/upload-pages-artifact@v5
with:
path: "docs/_site/"

Expand All @@ -149,4 +149,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
uses: actions/deploy-pages@v5
14 changes: 7 additions & 7 deletions .github/workflows/docs-convert-changelog.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
echo "SCRIPTS=.github/workflows/scripts/python" >> $GITHUB_ENV

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7
Comment thread
BlackYps marked this conversation as resolved.
with:
ssh-key: ${{ secrets.SSH_FAFOREVER_MACHINE_USER }}
ref: ${{ inputs.branch }}
Expand All @@ -53,7 +53,7 @@ jobs:

- name: Download develop changelog
if: inputs.additional-changelog == 'fafdevelop'
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: changelog-fafdevelop

Expand All @@ -66,7 +66,7 @@ jobs:

- name: Download beta changelog
if: inputs.additional-changelog == 'fafbeta'
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: changelog-fafbeta

Expand All @@ -78,7 +78,7 @@ jobs:
cat changelog-fafbeta.md >> $FILE

- name: Setup python
uses: actions/setup-python@v5
uses: actions/setup-python@v6
with:
python-version: '3.8'

Expand All @@ -99,7 +99,7 @@ jobs:
python3 $SCRIPTS/changelog_overview.py "docs/_posts" "${out_dir}/overview.lua"

- name: Add the Lua changelog as an artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: lua_changelog
path: |
Expand All @@ -116,13 +116,13 @@ jobs:
apk add bash git findutils

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
sparse-checkout: |
tests/run-syntax-test.sh

- name: Download the Lua changelog artifact
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: lua_changelog

Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/docs-generate-changelog.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,14 +50,14 @@ jobs:
# We check out the scripts separate because the branch that we use to
# generate the changelog may not contain the scripts that we want to work with.
- name: Checkout scripts
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
path: scripts
sparse-checkout: |
.github/workflows/scripts/bash

- name: Checkout snippets
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
# We need to check out the fork repo when the PR branch is on a fork.
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
Expand Down Expand Up @@ -90,7 +90,7 @@ jobs:
changelog-combine.sh "$NAME"

- name: Add the changelog as an artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: ${{ env.NAME }}
path: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs-spelling-check.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
Comment thread
BlackYps marked this conversation as resolved.
with:
sparse-checkout: |
docs
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/docs-synchronize-changelog.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ jobs:
steps:

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7
Comment thread
BlackYps marked this conversation as resolved.
with:
ssh-key: ${{ secrets.SSH_FAFOREVER_MACHINE_USER }}
ref: ${{ inputs.branch || github.head_ref || github.ref_name }}
Expand All @@ -63,7 +63,7 @@ jobs:
run: rm -f lua/ui/lobby/changelog/generated/*

- name: Retrieve generated lua changelog
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: lua_changelog
path: lua/ui/lobby/changelog/generated
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs-url-check.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
Comment thread
BlackYps marked this conversation as resolved.
with:
sparse-checkout: |
docs
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/etfreeman-db-update.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ jobs:
steps:
# https://github.com/actions/checkout/tree/v4/
- name: Checkout etfreeman-db code
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
repository: FAForever/etfreeman-db
path: gh-pages
Expand All @@ -49,7 +49,7 @@ jobs:

# https://github.com/actions/download-artifact/tree/v4/
- name: Download recent build artifact
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: etfreeman-db-dist
path: dist
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/prepare-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ jobs:
version: ${{ steps.version.outputs.version }}
steps:
- name: Checkout FA repository
uses: actions/checkout@v6
uses: actions/checkout@v7
Comment thread
BlackYps marked this conversation as resolved.
with:
ssh-key: ${{ secrets.SSH_FAFOREVER_MACHINE_USER }}
ref: staging/faf
Expand Down Expand Up @@ -84,7 +84,7 @@ jobs:
git commit -m "Bump game version to ${{ steps.version.outputs.version }}"

- name: Download changelog artifact
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: changelog-faf
path: changelog/snippets
Expand Down Expand Up @@ -125,7 +125,7 @@ jobs:
# The push also triggers docs-synchronize-changelog.yaml

- name: Create Pull Request
uses: actions/github-script@v7
uses: actions/github-script@v9
with:
script: |
const version = "${{ steps.version.outputs.version }}";
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/spookydb-update.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ jobs:
steps:
# https://github.com/actions/checkout/tree/v4/
- name: Checkout spooky db code
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
repository: FAForever/spooky-db
path: gh-pages
Expand All @@ -45,7 +45,7 @@ jobs:

# https://github.com/actions/download-artifact/tree/v4/
- name: Download recent unit information
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: spookydb-dist
path: dist
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/stage-fafbeta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ jobs:
steps:
# https://github.com/actions/checkout/tree/v4/
- name: Checkout FA repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
ssh-key: ${{ secrets.SSH_FAFOREVER_MACHINE_USER }}
repository: FAForever/fa
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/stage-fafdevelop.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ jobs:
steps:
# https://github.com/actions/checkout/tree/v4/
- name: Checkout FA repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
ssh-key: ${{ secrets.SSH_FAFOREVER_MACHINE_USER }}
repository: FAForever/fa
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
- name: Install tooling
run: apk add bash git findutils
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
sparse-checkout-cone-mode: false
sparse-checkout: |
Expand Down Expand Up @@ -70,7 +70,7 @@ jobs:
- name: Install tooling
run: apk add bash git findutils
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
sparse-checkout-cone-mode: false
sparse-checkout: |
Expand All @@ -88,7 +88,7 @@ jobs:
- name: Install tooling
run: apk add bash git findutils
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
sparse-checkout-cone-mode: false
sparse-checkout: |
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/wiki-generate-blueprints.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,14 +34,14 @@ jobs:
steps:
# Checkout repos, FA repo is sparse checkout as it is quite large
- name: Checkout Brewlan Wikigen Repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
repository: The-Balthazar/BrewWikiGen
path: ./brew-wiki-gen

# FA repo is sparse checkout as it is quite large and we dont won't to incur higher action minutes for no reason
- name: Checkout FAF Repository # -png folder doesnt exist yet, confirm location.
uses: actions/checkout@v4
uses: actions/checkout@v7
Comment on lines +37 to +44

@coderabbitai coderabbitai Bot Jun 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify action versions exist and check for breaking changes

echo "=== Checking actions/checkout v7 ==="
gh api repos/actions/checkout/git/refs/tags/v7 --jq '.ref' || echo "Tag v7 not found"
echo ""

echo "=== Checking actions/upload-artifact v7 ==="
gh api repos/actions/upload-artifact/git/refs/tags/v7 --jq '.ref' || echo "Tag v7 not found"
echo ""

echo "=== Checking leafo/gh-actions-lua v13 ==="
gh api repos/leafo/gh-actions-lua/git/refs/tags/v13 --jq '.ref' || echo "Tag v13 not found"
echo ""

echo "=== Recent releases for actions/checkout ==="
gh release list --repo actions/checkout --limit 10
echo ""

echo "=== Recent releases for actions/upload-artifact ==="
gh release list --repo actions/upload-artifact --limit 10
echo ""

echo "=== Recent releases for leafo/gh-actions-lua ==="
gh release list --repo leafo/gh-actions-lua --limit 10

Repository: FAForever/fa

Length of output: 1471

🌐 Web query:

actions/checkout v7 breaking changes

💡 Result:

The primary breaking change in actions/checkout v7, released on June 18, 2026, is a new security restriction regarding fork pull request checkouts [1][2]. Key changes in v7 include: 1. Blocked Fork PR Checkouts by Default: The action now refuses to check out code from a fork pull request when used in pull_request_target or workflow_run events (specifically when the workflow is triggered by a pull_request* event) [2][3]. This is designed to prevent "pwn request" vulnerabilities where untrusted fork code could execute in the privileged context of the base repository [2][3]. 2. Opt-in Mechanism: If your workflow requires this functionality, you must explicitly opt in by setting the new input allow-unsafe-pr-checkout to true [3]. Users are strongly advised to review the security risks associated with using pull_request_target before enabling this [2][3]. 3. ESM Migration: The action has been migrated to ESM (ECMAScript Modules) to support newer versions of underlying @actions/* dependencies [1][3]. Future Backport: On July 16, 2026, GitHub will backport this security enforcement to all currently supported major versions of actions/checkout [2]. Workflows pinned to a floating major tag (e.g., actions/checkout@v4) will automatically receive this change and may start failing if they checkout fork pull request code without the new opt-in flag [2]. Workflows pinned to specific SHA, minor, or patch versions will not be affected by the automatic backport [2].

Citations:

🌐 Web query:

actions/upload-artifact v7 breaking changes

💡 Result:

The transition to actions/upload-artifact v7, released on February 26, 2026, primarily introduced a new feature rather than traditional breaking changes [1][2]. The release is backward compatible because the new archive parameter defaults to true, maintaining existing behavior [2][3]. Key aspects of the v7 release include: New Functionality: Direct Unzipped Uploads The most significant addition is the ability to upload artifacts without zipping them by setting the archive input to false [1][2]. This supports: - Single file uploads only: The action will fail if the provided path glob resolves to multiple files [1][3]. - Ignored Name Parameter: When archive is set to false, the name parameter is ignored. The resulting artifact name becomes the name of the uploaded file itself [1][3]. - Workflow Impacts: If you enable archive: false, you must ensure that any subsequent download steps (which require updating to at least actions/download-artifact v8) match the filename rather than a custom artifact name [2][3]. Technical Changes - ESM Upgrade: The action was upgraded to ECMAScript Modules (ESM) to support newer versions of the @actions/* packages [1][4]. - No Documented Breaking Changes: While some users noted that major version bumps often imply breaking changes, the maintainers provided no specific list of breaking behavioral changes for v7 [5]. The release is generally considered a drop-in replacement for v6, provided the new optional features are not used incorrectly [3]. If you are upgrading from v6 to v7, your existing workflows will continue to function as they did before, with compression enabled by default [3]. If you choose to adopt the new direct upload feature, be aware of the specific requirements regarding file counts and naming conventions [1][3].

Citations:

🌐 Web query:

leafo/gh-actions-lua v13 changes

💡 Result:

Version 13 of the leafo/gh-actions-lua GitHub Action, released on April 23, 2026, introduced several key changes [1][2]: Lua 5.5 Support The action added support for Lua 5.5.0 [1][3][4]. Consequently, the default luaVersion was updated to 5.5 (previously 5.4) [1][3]. ESM Migration The action's main.js file was converted to ES modules to maintain compatibility with updated GitHub Actions toolkit packages that are now ESM-only [1][4]. This change does not affect the action's API or inputs [1][3]. Dependency Upgrades The action updated several underlying @actions dependencies to their major versions to ensure compatibility [1][4]: @actions/core: 1.11.1 to 3.0.1 [1][4] @actions/cache: 4.1.0 to 6.0.0 [1][4] @actions/exec: 1.1.1 to 3.0.0 [1][4] @actions/io: 1.1.3 to 3.0.2 [1][4] @actions/tool-cache: 2.0.2 to 4.0.0 [1][4] Refreshed Release Tarballs The included release tarballs were updated: 5.5.0.tar.gz was added [1][3]. 5.3.6.tar.gz replaced 5.3.5.tar.gz [1][4]. 5.4.8.tar.gz replaced 5.4.1.tar.gz [1][4]. Documentation and Example Updates Example snippets were updated to use actions/checkout@v6 (replacing @master/@v4) to resolve Node.js 20 deprecation warnings, and step-security/msvc-dev-cmd@v1 was adopted as a replacement for ilammy/msvc-dev-cmd@v1 [1][3][4].

Citations:

Address breaking changes in actions/checkout v7 and leafo/gh-actions-lua v13.

The version bumps to actions/checkout v7 and leafo/gh-actions-lua v13 introduce breaking changes that may affect this workflow:

  • actions/checkout v7 (released June 18, 2026): Now blocks fork pull request checkouts by default in pull_request_target and workflow_run events. If the workflow needs to checkout fork PR code, add allow-unsafe-pr-checkout: true to the checkout step.
  • leafo/gh-actions-lua v13 (released April 23, 2026): Changes the default Lua version from 5.4 to 5.5. Verify that any Lua scripts in this workflow are compatible with Lua 5.5, or explicitly pin luaVersion: '5.4' if backward compatibility is needed.
  • actions/upload-artifact v7: No breaking changes; this upgrade is safe.
🧰 Tools
🪛 zizmor (1.25.2)

[error] 37-37: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 44-44: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/wiki-generate-blueprints.yaml around lines 37 - 44, Review
the workflow trigger events (check the top level `on:` directive) to determine
if this workflow uses `pull_request_target` or `workflow_run` events and needs
to checkout code from fork pull requests. If fork PR checkouts are needed, add
`allow-unsafe-pr-checkout: true` to both checkout action steps (the one checking
out the BrewWikiGen repository and the one checking out the FAF Repository) to
handle the breaking change in actions/checkout v7. Additionally, verify if
leafo/gh-actions-lua v13 is used anywhere in this workflow and either ensure any
Lua scripts are compatible with Lua 5.5 or explicitly pin the Lua version to 5.4
by adding `luaVersion: '5.4'` to maintain backward compatibility if needed.

with:
path: ./fa
sparse-checkout-cone-mode: |
Expand All @@ -56,13 +56,13 @@ jobs:
projectiles

- name: Checkout FAF Wiki Repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
repository: FAForever/fa.wiki
path: ./fa.wiki

- name: Install Lua 5.4
uses: leafo/gh-actions-lua@v10
uses: leafo/gh-actions-lua@v13
with:
luaVersion: "5.4"

Expand All @@ -76,7 +76,7 @@ jobs:


- name: Upload as artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: Wiki
path: fa.wiki
Expand Down
Loading