From ea1de6a3a87d8595906356a2154196ae5ad70117 Mon Sep 17 00:00:00 2001 From: igor-ctrl Date: Wed, 5 Aug 2026 09:40:21 -0500 Subject: [PATCH] chore(ci): bump GitHub Actions off Node 20 to clear deprecation warnings actions/checkout v4.2.2->v5.1.0, actions/upload-artifact v4.6.2->v5.0.0, actions/download-artifact v4.3.0->v5.0.0, actions/setup-node v4->v5.0.0, astral-sh/setup-uv v5->v9.0.0, and pypa/gh-action-pypi-publish v1.14.0->v1.14.2, all re-pinned by commit SHA per the existing convention. site.yml's checkout/setup-node were moved from bare tags to SHA pins for consistency with publish.yml and tests.yml. Verified against each release's notes that none of the breaking changes in these majors apply here: no pull_request_target/workflow_run triggers (checkout v5.1.0's fork-PR restriction), no by-ID artifact downloads (download-artifact v5's path-nesting fix), no manifest-file/server-url inputs (setup-uv v7/v8). gh-action-pypi-publish stays on the same 1.14.x Trusted Publisher + attestations flow that published bc-cli 0.7.0. --- .github/workflows/publish.yml | 10 +++++----- .github/workflows/site.yml | 4 ++-- .github/workflows/tests.yml | 4 ++-- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 4964b33..7d2e3f2 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -32,10 +32,10 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install uv - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - name: Sanity-check that the tag matches pyproject.toml's version # `git tag v0.2.0` while pyproject.toml still says 0.1.0 produces @@ -54,7 +54,7 @@ jobs: run: uv build - name: Upload built artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 with: name: dist path: dist/ @@ -77,7 +77,7 @@ jobs: contents: read steps: - name: Download built artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0 with: name: dist path: dist/ @@ -87,4 +87,4 @@ jobs: # the OIDC exchange automatically when the project is configured # on PyPI's side. If publishing breaks with "Invalid token", the # PyPI Trusted Publisher config doesn't match this workflow. - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml index 3877a3f..b450a85 100644 --- a/.github/workflows/site.yml +++ b/.github/workflows/site.yml @@ -18,10 +18,10 @@ jobs: run: working-directory: bcli-site steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: "22" diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index aa48b67..dee12b3 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -29,10 +29,10 @@ jobs: # so a maintainer can audit the version without resolving SHAs. # Bumping requires checking the new SHA against the upstream # release notes and updating both fields together. - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install uv - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 with: enable-cache: true python-version: ${{ matrix.python-version }}