Skip to content

Revert/main #18729

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Single-Dancer wants to merge 4 commits into from
Closed

Revert/main #18729

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ecdbd83
Revert "chore: stencil update (#18649)"
Dec 19, 2025
05736cb
Revert "test(babel-plugin-transform-solid-jsx): vitest (#18607)"
Dec 19, 2025
c481ac1
fix: 目前 macos 无法正常执行测试，暂时跳过，等待后续优化
Jan 8, 2026
4e27eab
chore(ci): 替换过期的macos镜像
Single-Dancer Jan 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/auto-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v5
Copy link

@coderabbitai coderabbitai bot Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

GitHub Actions checkout v5 v6 breaking changes differences

💡 Result:

Summary — main differences / breaking changes between actions/checkout v5 and v6

  • Credentials persistence: v6 no longer writes the auth token into .git/config; it stores credentials in a separate file under $RUNNER_TEMP and uses git includeIf to reference it. This improves credential security and isolates creds from repository git config. No workflow changes are required for most users — ordinary git fetch/push still work. [1][2]

  • Runner/minimum requirements: v5 bumped the action runtime to Node.js 24 and required Actions Runner >= v2.327.1; v6 also documents Node 24 support and requires Actions Runner >= v2.329.0 for running authenticated git commands from inside a Docker container action. If you run container actions that need authenticated git access, ensure your runner meets the v6 minimum. [1][2]

  • Behavior impact & migration: because v6 uses includeIf and a separate cred file, most existing workflows (including git push using the built-in token) continue to work without changes. Edge cases include custom SSH-key setups or nonstandard runner environments — verify those workflows and, for private secondary repos, continue to use a PAT when needed. v6 also added worktree support for the new persist-credentials includeIf in patch releases. [1][3]

References

  • actions/checkout README (v6 changelog & usage notes). [1]
  • Marketplace summary / v6 “what’s new” (credentials, runner notes). [2]
  • v6.0.1 release notes (worktree support, README clarifications). [3]

🌐 Web query:

GitHub Actions checkout v5 security vulnerabilities maintenance status

💡 Result:

Short answer: actions/checkout@v5 is a maintained release (v5.0.0 published Aug 11, 2025) but the official repo says GitHub is not accepting general contributions and will focus internal resources while still providing security fixes and major-breaking-change fixes. For credential/security improvements you should consider moving to v6 (which adds improved credential storage). [1][2][3][4]

Details (concise)

  • v5 release (node24 upgrade): v5.0.0 (released Aug 11, 2025). [2]
  • Maintenance policy: README states GitHub isn’t taking general contributions to this repo but will continue to provide security updates and fix major breaking changes. [1]
  • Security posture / advisories: GitHub tracks Actions advisories in the Advisory Database and Dependabot will surface alerts for vulnerable actions — check the Advisory Database / Dependabot for any CVEs/GHSAs affecting the action you use. [4]
  • Practical recommendation: prefer actions/checkout@v6 if you want the latest credential-security improvements; otherwise pin to a specific patch release (or SHA) and monitor Dependabot/GitHub Advisory Database for updates. [3][4]

Sources:

  • actions/checkout README (maintenance note). [1]
  • actions/checkout v5 changelog / release. [2]
  • Marketplace / v6 feature notes (credential improvements). [3]
  • GitHub docs on monitoring Actions advisories / Dependabot. [4]

🌐 Web query:

GitHub Actions checkout version 5 end of support deprecated

💡 Result:

Short answer: actions/checkout@v5 is not marked as deprecated or end-of-support in the official repo/Marketplace, but v6 is available and contains security/credential improvements — you should upgrade to v6 when your runners meet the minimum version requirements. See the official repo and Marketplace release notes for v5→v6 details. [1][2]

Sources:

  • actions/checkout repository (Changelog/README showing v5 and v6 notes). [1]
  • GitHub Marketplace entry for actions/checkout (v6 and v5 "What's new" notes). [2]

确认 actions/checkout 版本降级的原因

从 v6 降级到 v5 可能源于运行环境限制。v5 仍在维护中并会收到安全更新，但 v6 需要 Actions Runner >= v2.329.0。建议确认：

  1. 当前运行环境的 Actions Runner 版本是否满足 v6 的最低要求（>= v2.329.0）
  2. 如果不满足，v5 是合理的选择，但应在 GitHub 安全公告中监控该版本的安全补丁

v6 相比 v5 的主要改进是凭证存储方式（独立于 git config），这在安全性上有所提升。如果运行环境支持，建议升级到 v6；否则 v5 作为临时方案是可接受的。

🤖 Prompt for AI Agents 
In @.github/workflows/auto-review.yml at line 14, 确认为 actions/checkout@v5
的降级原因：检查 CI 运行环境的 Actions Runner 版本是否满足 v6 的最低要求 (>= v2.329.0); 如果满足，将 uses:
actions/checkout@v5 更改为 uses: actions/checkout@v6 并验证凭证行为；如果不满足，保留 uses:
actions/checkout@v5，但在 PR 或 CI 配置中记录理由并添加一条任务以定期在 GitHub 安全公告或依赖扫描中监控 v5 的安全补丁。

- name: GITHUB CONTEXT
env:
GITHUB_CONTEXT: ${{ toJson(github) }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/build-rust-binding.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
matrix:
node-version: [18.x]
settings:
- host: macos-13
- host: macos-latest
target: x86_64-apple-darwin
build: |
pnpm build:binding:release
Expand All @@ -36,7 +36,7 @@ jobs:
target: x86_64-unknown-linux-musl
docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
build: set -e && pnpm build:binding:release && strip crates/native_binding/*.node
- host: macos-13
- host: macos-latest
target: aarch64-apple-darwin
build: |
pnpm build:binding:release --target aarch64-apple-darwin
Expand All @@ -45,7 +45,7 @@ jobs:
runs-on: ${{ matrix.settings.host }}
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v5
- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/build-rust-wasm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v5
- name: Setup Rust
uses: dtolnay/rust-toolchain@stable
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependabot-update-lockfile.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v5
with:
ref: ${{ github.head_ref }}

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/issue-labeler.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
template: [bug_report.yml]

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v5

- name: 解析模板
uses: stefanbuck/github-issue-parser@v3
Expand Down
23 changes: 15 additions & 8 deletions .github/workflows/nodejs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,18 +40,18 @@ jobs:
strategy:
matrix:
node-version: [18.x, 20.x]
host: [macos-13, windows-latest, ubuntu-latest]
host: [macos-latest, windows-latest, ubuntu-latest]
exclude:
- node-version: 18.x
host: macos-13
host: macos-latest
- node-version: 18.x
host: windows-latest
- node-version: 20.x
host: macos-13
host: macos-latest
- node-version: 20.x
host: windows-latest
include:
- host: macos-13
- host: macos-latest
target: x86_64-apple-darwin
- host: windows-latest
target: x86_64-pc-windows-msvc
Expand All @@ -63,7 +63,7 @@ jobs:
runs-on: ${{ matrix.host }}
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v5
Copy link

@coderabbitai coderabbitai bot Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

actions/checkout GitHub Action latest stable version v6 v5 compatibility issues

💡 Result:

Short answer

  • actions/checkout v6 is the current stable major release; it is compatible with most workflows that used v5 and does not require workflow changes. [1][2]

Key differences and compatibility notes

  • Credentials handling: v6 stores persisted credentials in a separate file under $RUNNER_TEMP instead of writing them directly into .git/config. This is intended to improve security and should not break normal git commands because the action configures Git to include that file. No workflow edits are required for typical use. [1][2]
  • Docker/container caveat: if you run authenticated git commands from inside a Docker container action, v6 requires GitHub Actions Runner v2.329.0 or later. Ensure self-hosted runners are upgraded if you rely on that pattern. [1][2]
  • Runner minimums: v5 required newer runner support for its node runtime (node20) with a minimum Actions Runner noted in docs; v6 similarly documents runner requirements for specific features — check your runner version if you use older/self-hosted runners. [2][3]

If you want, tell me which workflows or runner types you use (hosted vs self-hosted, container vs standard) and I’ll check for any specific breaking issues.

Sources
[1] actions/checkout Marketplace listing — “Checkout v6” notes.
[2] actions/checkout GitHub repo README (v6 changelog + details).
[3] related actions release notes referencing runner minimums (example: setup-go/setup-node docs referencing runner versions).

🌐 Web query:

actions/checkout@v6 release notes breaking changes

💡 Result:

Short summary of breaking changes in actions/checkout@v6:

  1. Credentials handling changed — persist-credentials now writes credentials to a separate file under $RUNNER_TEMP (not directly to .git/config). For most workflows this is transparent and git fetch/push continue to work without changes. [1][2]

  2. Running authenticated git commands from inside a Docker container action may require a minimum Actions Runner version (v2.329.0 or later). Check your runner version if you rely on in-container authenticated git. [2]

  3. Runtime update / runner minimums noted in the v6 release (Node.js 24 runtime support and related runner requirements). Confirm runner compatibility if you run self-hosted or older GHES versions. [1][4]

Notes: the maintainers describe this as non-breaking for typical workflows, but some platform-specific or custom SSH/PAT setups may need review; see the discussion/issue threads for edge cases. [3]

Sources: [1] actions/checkout README (v6) — GitHub. [2] GitHub Marketplace listing for Checkout (v6). [3] GitHub issue discussion about v6 behavior. [4] v6 release notes.

应该有文档说明为什么从 v6 降级到 v5

根据官方文档，actions/checkout@v6 是当前的稳定主版本，与 v5 工作流广泛兼容。v6 的主要变更（凭证存储方式）对典型工作流是透明的，不需要修改工作流。

降级到 v5 不是常见做法，请补充说明原因。可能的原因包括：

  • 自托管 Runner 版本限制
  • 需要在 Docker 容器内运行认证的 git 命令（v6 需要 Runner v2.329.0+）

请在代码注释或 PR 描述中说明这个版本选择的具体原因。

🤖 Prompt for AI Agents 
In @.github/workflows/nodejs.yml at line 66, The workflow currently pins
actions/checkout to actions/checkout@v5 without explanation; add a short comment
next to the uses: actions/checkout@v5 line (or a clear note in the PR
description) stating why you intentionally downgraded from v6 (e.g., self-hosted
Runner version constraints, need to run git auth inside Docker, or other
compatibility reason), include the minimum runner version or environment
constraint that necessitates v5, and ensure the comment references the exact
symbol "uses: actions/checkout@v5" so reviewers can see the rationale at a
glance.

- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
Expand All @@ -74,7 +74,7 @@ jobs:
node-version: ${{ matrix.node-version }}
cache: 'pnpm'
- name: Install dependencies
run: pnpm install --frozen-lockfile
run: pnpm -r install --frozen-lockfile
- name: Lint
run: pnpm lint
- name: Download artifact bindings-${{ matrix.target }}
Expand Down Expand Up @@ -110,7 +110,14 @@ jobs:
env:
NODE_OPTIONS: --max_old_space_size=4096
- name: test
run: pnpm run pretest:ci && pnpm test
#TODO: 需要优化测试流程，目前 macos 无法正常执行测试，暂时跳过，等待后续优化
shell: bash
run: |
if [ "${{ matrix.host }}" = "macos-latest" ]; then
pnpm -r --aggregate-output --filter=./packages/* --filter=./tests --filter=!@tarojs/components test:ci
else
pnpm test
fi
Comment on lines 112 to +120
Copy link

@coderabbitai coderabbitai bot Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

macOS 测试绕过方案需要更明确的文档和跟踪

当前的条件测试逻辑为 macOS 排除了 @tarojs/components 包。虽然 TODO 注释提到"等待后续优化"，但缺少：

  1. 具体失败原因的文档说明
  2. 跟踪此技术债的 issue 链接
  3. 明确的时间表或负责人

建议：

  • 创建专门的 GitHub issue 跟踪此问题
  • 在注释中添加 issue 链接
  • 记录 macOS 测试失败的具体原因

您是否需要我帮助创建跟踪此技术债的 issue？

🤖 Prompt for AI Agents 
In @.github/workflows/nodejs.yml around lines 112 - 120, Update the test step
that skips @tarojs/components on macOS by creating a GitHub issue to track the
macOS test failure and then annotate the TODO with that issue link; in the
workflow block where the step name is "test" and the conditional checks
matrix.host == "macos-latest" (and runs the pnpm -r ...
--filter=!@tarojs/components command), add a concise comment that includes the
issue number/URL, the observed failure symptoms, the owner or assignee, and a
target timeframe for resolution so the skip is clearly tracked and can be
removed once fixed.

# 以下 coverage 流程通过 artifact 拆分文件作为单独 job 上传时间损耗过长，因此在在 node test 后直接继续执行
- name: Upload [taro-cli] coverage to Codecov
uses: codecov/codecov-action@v5
Expand Down Expand Up @@ -151,7 +158,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v5
- name: Setup Rust
uses: dtolnay/rust-toolchain@stable
with:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
steps:
# Setup
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v5

# Log meta
- name: GITHUB CONTEXT
Expand Down Expand Up @@ -91,7 +91,7 @@ jobs:
steps:
# Setup
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v5
with:
ref: ${{ github.ref_name }}
- name: Setup pnpm
Expand Down Expand Up @@ -276,7 +276,7 @@ jobs:
run: pnpm build

- name: Checkout Harmony Project
uses: actions/checkout@v6
uses: actions/checkout@v5
with:
repository: NervJS/taro-harmony-project
path: packages/taro-platform-harmony-cpp/harmony_project
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/sync-components-types.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
uses: actions/checkout@v5

- name: Checkout taro-docs
uses: actions/checkout@v6
uses: actions/checkout@v5
with:
repository: NervJS/taro-docs
fetch-depth: 1
Expand Down
9 changes: 3 additions & 6 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,7 @@
"lint:style": "stylelint ./packages/**/*.{css,scss}",
"format": "prettier --write --cache .",
"format:check": "prettier --check --cache .",
"pretest:ci": "node ./scripts/download.mjs",
"test": "pnpm --if-present -r --filter=./packages/* --filter=./tests test:ci",
"test": "pnpm --if-present -r --aggregate-output --filter=./packages/* --filter=./tests test:ci",
"test:binding": "pnpm --filter @tarojs/binding run test",
"updateSnapshot": "pnpm --if-present -r --aggregate-output --filter=./tests --filter=./packages/* updateSnapshot",
"version": "run-s version:*",
Expand Down Expand Up @@ -110,7 +109,7 @@
"@types/webpack-dev-server": "^3.11.3",
"@typescript-eslint/eslint-plugin": "^7.8.0",
"@typescript-eslint/parser": "^7.8.0",
"@vitest/coverage-istanbul": "^4.0.14",
"@vitest/coverage-istanbul": "^3.2.4",
"babel-jest": "^29.7.0",
"babel-plugin-syntax-jsx": "6.18.0",
"babel-preset-power-assert": "3.0.0",
Expand Down Expand Up @@ -152,7 +151,6 @@
"power-assert": "^1.6.1",
"prettier": "^2.7.1",
"prop-types": "^15.7.2",
"puppeteer": "^20.9.0",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"rimraf": "^5.0.0",
Expand All @@ -166,8 +164,7 @@
"ts-node": "^10.9.1",
"tslib": "^2.6.2",
"typescript": "~5.4.5",
"vite": "^7.2.6",
"vitest": "^4.0.14"
"vitest": "^3.2.4"
},
"pnpm": {
"packageExtensions": {
Expand Down
1 change: 0 additions & 1 deletion packages/babel-plugin-transform-react-jsx-to-rn-stylesheet/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@
"clean": "rimraf ./dist",
"test": "vitest run",
"test:ci": "vitest run --coverage",
"updateSnapshot": "vitest run --update",
"dev": "tsc -w",
"build": "tsc"
},
Expand Down
Loading