From 2bf8792f6c9be6a0b71e01e4166135bf42990904 Mon Sep 17 00:00:00 2001 From: Michal Date: Fri, 4 Sep 2026 07:24:25 +0200 Subject: [PATCH] CI: track actions/checkout@v7 instead of pinning its SHA Co-Authored-By: Claude Opus 5 --- .github/workflows/main.yml | 11 ++++------- CHANGELOG.md | 2 +- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 88c1ae5..8a8c438 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -53,12 +53,9 @@ jobs: env: BUNDLE_GEMFILE: gemfiles/${{ matrix.gemfile }}.gemfile steps: - # actions/checkout is pinned by commit SHA; dependabot bumps the SHA and - # the trailing version comment together. ruby/setup-ruby stays on the - # `v1` tag upstream documents, because a pinned release only knows the - # Ruby builds it shipped with: an added matrix entry (ROADMAP 5.2 plans - # Ruby 4.0) would fail with an unhelpful unknown-version error. - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # Both actions track their major tag, so upstream patch releases arrive + # without a commit here. Dependabot opens a PR for each new major. + - uses: actions/checkout@v7 with: # No step needs git credentials after checkout, and bundler runs # gemspec and native-extension code from the branch under test. @@ -89,7 +86,7 @@ jobs: && fromJSON('[{"name": "bundler-audit", "command": "bundle exec bundle-audit check --update"}]') || fromJSON('[{"name": "rubocop", "command": "bundle exec rubocop"}, {"name": "bundler-audit", "command": "bundle exec bundle-audit check --update"}]') }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false - name: Set up Ruby diff --git a/CHANGELOG.md b/CHANGELOG.md index c7465e0..6515d50 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,7 @@ ## [Unreleased] ### Changed -- CI pins `actions/checkout` by commit SHA (v7.0.1) instead of the mutable `v7` tag, so a repointed upstream tag cannot change what runs without a diff here. `ruby/setup-ruby` deliberately stays on `v1`, the reference upstream documents, because a pinned release only knows the Ruby builds it shipped with. Checkout also runs with `persist-credentials: false`: no step needs git credentials, and bundler evaluates gemspec and native-extension code from the branch under test. +- CI runs `actions/checkout@v7`, up from v5, alongside `ruby/setup-ruby@v1`. Both track their major tag, so upstream patch releases arrive without a commit here and Dependabot opens a pull request for each new major. Checkout also runs with `persist-credentials: false`: no step needs git credentials, and bundler evaluates gemspec and native-extension code from the branch under test. - The workflow runs once per change rather than twice. `push` is scoped to `master`, so a branch with an open pull request no longer builds under both events, and a `concurrency` group cancels superseded pull request runs. Runs on `master` are left alone, so every commit there keeps a result. - `rubocop` and `bundler-audit` share one job definition instead of two byte-identical ones, and every job carries `timeout-minutes: 30` in place of the six-hour default.