Skip to content

Update actions/checkout action to v5 #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
renovate merged 1 commit into from
Aug 16, 2025
Merged

Update actions/checkout action to v5 #39

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
contents: write
steps:
- name: Checkout source branch
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You’re currently pinning actions/checkout to a commit SHA. While this is secure, it can reduce readability and requires manual updates for minor or patch releases. Consider using the official semantic version tag so you automatically pick up backwards-compatible improvements:

uses: actions/checkout@v5

Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You’re pinning actions/checkout by full commit SHA. To improve readability and simplify version bumps, you can switch to the semantic version tag. For example:

- name: Checkout source branch
  uses: actions/checkout@v5
  with:
    ref: ${{ env.SOURCE_BRANCH }}
    path: source-folder

with:
ref: ${{ env.SOURCE_BRANCH }}
path: source-folder
Expand Down Expand Up @@ -66,7 +66,7 @@ jobs:
fi

- name: Checkout release branch
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
ref: ${{ env.RELEASE_BRANCH }}
path: release-folder
Expand Down Expand Up @@ -102,7 +102,7 @@ jobs:
pull-requests: write
steps:
- name: Checkout release branch
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
ref: ${{ env.RELEASE_BRANCH }}
- name: Run the AI-assisted action (PR Summary)
Comment on lines 104 to 108
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The "Checkout release branch" step is duplicated across multiple jobs. To adhere to DRY principles, consider extracting this into a reusable workflow or a YAML anchor. Example with an anchor:

# Define an anchor at the top
x-checkout-release: &checkout-release
  uses: actions/checkout@v5
  with:
    ref: ${{ env.RELEASE_BRANCH }}

# Then reuse it
jobs:
  prepare:
    steps:
      - name: Checkout release branch
        <<: *checkout-release

This consolidates the configuration and makes future adjustments easier.

Expand All @@ -123,7 +123,7 @@ jobs:
pull-requests: write
steps:
- name: Checkout release branch
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
ref: ${{ env.RELEASE_BRANCH }}
- name: Run the AI-assisted action (PR Review)
Expand All @@ -143,7 +143,7 @@ jobs:
contents: write
steps:
- name: Checkout release branch
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
ref: ${{ env.RELEASE_BRANCH }}
- name: Create tags for new version
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/code-quality.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
path: [pr-summary, pr-review]
steps:
- name: Checkout source branch
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar to the build.yaml file, pinning the actions/checkout step to a commit SHA can be replaced with a major version tag for better clarity and automatic patch/minor updates:

uses: actions/checkout@v5

Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar to the build workflow, you can replace the full SHA of actions/checkout with a semantic version. This makes the intent clearer and keeps your workflows up to date with minor/patch releases automatically:

- name: Checkout source branch
  uses: actions/checkout@v5

- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
Comment on lines 25 to 26
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The actions/setup-node step is also pinned to a commit SHA. It’s better practice to use the official version tag so you receive non-breaking updates:

- name: Setup Node.js environment
  uses: actions/setup-node@v4
  with:
    node-version: '18'

Expand All @@ -45,7 +45,7 @@ jobs:
path: [pr-summary, pr-review]
steps:
- name: Checkout source branch
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
Expand Down