mu-ref/pdf-inspector
8
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(ci): bump GitHub Actions to current majors (#237)

Browse Source 
* chore(ci): bump GitHub Actions to current majors

Node 20 action runtimes are deprecated on GitHub runners; bump every
first-party action to its latest major across all workflows:

- actions/checkout v4/v6 -> v7
- actions/cache v4 -> v6
- actions/upload-artifact v4 -> v7, download-artifact v4 -> v8
- actions/setup-node v6 -> v7, setup-python v5 -> v7
- actions/upload-pages-artifact v3 -> v5, deploy-pages v4 -> v5

Third-party pins (dtolnay/rust-toolchain, Swatinem/rust-cache,
setup-zig, setup-bun, taiki-e/install-action, maturin-action) are
already on their latest majors.

* chore(ci): pin all actions to full commit SHAs

Mutable @vN tags can be retagged; in the publish workflows that code
runs with OIDC credentials before npm/PyPI/crates.io publishes. Pin
every action (first- and third-party) to its release commit SHA with
the version in a trailing comment.

dtolnay/rust-toolchain infers the toolchain from its ref name, so the
SHA-pinned invocations pass an explicit toolchain: stable input.
This commit is contained in:
Abimael Martell
2026-08-03 11:07:36 -07:00
committed by GitHub
parent 98990cc550
commit 8121ae97ce
6 changed files with 61 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+21 -14
View File
@@ -14,13 +14,15 @@ jobs:
name: Test name: Test
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Rust - name: Install Rust
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with:
toolchain: stable
- name: Cache cargo - name: Cache cargo
uses: Swatinem/rust-cache@v2 uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
- name: Run tests - name: Run tests
run: cargo test --verbose run: cargo test --verbose
@@ -32,11 +34,12 @@ jobs:
name: Format name: Format
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Rust - name: Install Rust
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with: with:
toolchain: stable
components: rustfmt components: rustfmt
- name: Check formatting - name: Check formatting
@@ -49,15 +52,16 @@ jobs:
name: Clippy name: Clippy
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Rust - name: Install Rust
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with: with:
toolchain: stable
components: clippy components: clippy
- name: Cache cargo - name: Cache cargo
uses: Swatinem/rust-cache@v2 uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with: with:
key: clippy key: clippy
@@ -71,13 +75,15 @@ jobs:
matrix: matrix:
os: [ubuntu-latest, macos-latest] os: [ubuntu-latest, macos-latest]
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Rust - name: Install Rust
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with:
toolchain: stable
- name: Cache cargo - name: Cache cargo
uses: Swatinem/rust-cache@v2 uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with: with:
key: build key: build
@@ -88,16 +94,17 @@ jobs:
name: WebAssembly name: WebAssembly
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Rust - name: Install Rust
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with: with:
toolchain: stable
targets: wasm32-unknown-unknown targets: wasm32-unknown-unknown
components: clippy components: clippy
- name: Cache cargo - name: Cache cargo
uses: Swatinem/rust-cache@v2 uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with: with:
workspaces: | workspaces: |
wasm -> target wasm -> target
.github/workflows/pages.yml
+3 -3
View File
@@ -24,13 +24,13 @@ jobs:
name: github-pages name: github-pages
url: ${{ steps.deploy.outputs.page_url }} url: ${{ steps.deploy.outputs.page_url }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Upload site artifact - name: Upload site artifact
uses: actions/upload-pages-artifact@v3 uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
with: with:
path: site path: site
- name: Deploy to GitHub Pages - name: Deploy to GitHub Pages
id: deploy id: deploy
uses: actions/deploy-pages@v4 uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
.github/workflows/publish-crate.yml
+6 -4
View File
@@ -27,7 +27,7 @@ jobs:
published: ${{ steps.check.outputs.published }} published: ${{ steps.check.outputs.published }}
version: ${{ steps.check.outputs.version }} version: ${{ steps.check.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
fetch-depth: 2 fetch-depth: 2
@@ -85,17 +85,19 @@ jobs:
contents: read contents: read
id-token: write id-token: write
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Rust - name: Install Rust
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with:
toolchain: stable
- name: Verify package - name: Verify package
run: cargo publish --dry-run run: cargo publish --dry-run
- name: Authenticate with crates.io - name: Authenticate with crates.io
id: auth id: auth
uses: rust-lang/crates-io-auth-action@v1 uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
- name: Publish crate - name: Publish crate
run: cargo publish run: cargo publish
.github/workflows/publish-pypi.yml
+10 -10
View File
@@ -24,7 +24,7 @@ jobs:
published: ${{ steps.check.outputs.published }} published: ${{ steps.check.outputs.published }}
version: ${{ steps.check.outputs.version }} version: ${{ steps.check.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
fetch-depth: 2 fetch-depth: 2
@@ -98,21 +98,21 @@ jobs:
- os: windows-latest - os: windows-latest
target: x86_64-pc-windows-msvc target: x86_64-pc-windows-msvc
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-python@v5 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with: with:
python-version: '3.12' python-version: '3.12'
- name: Build wheel - name: Build wheel
uses: PyO3/maturin-action@v1 uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with: with:
target: ${{ matrix.target }} target: ${{ matrix.target }}
args: --release --out dist args: --release --out dist
manylinux: auto manylinux: auto
- name: Upload wheel - name: Upload wheel
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with: with:
name: wheels-${{ matrix.target }} name: wheels-${{ matrix.target }}
path: dist/*.whl path: dist/*.whl
@@ -124,16 +124,16 @@ jobs:
name: Build sdist name: Build sdist
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Build sdist - name: Build sdist
uses: PyO3/maturin-action@v1 uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
with: with:
command: sdist command: sdist
args: --out dist args: --out dist
- name: Upload sdist - name: Upload sdist
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with: with:
name: sdist name: sdist
path: dist/*.tar.gz path: dist/*.tar.gz
@@ -149,7 +149,7 @@ jobs:
id-token: write id-token: write
steps: steps:
- name: Download all artifacts - name: Download all artifacts
uses: actions/download-artifact@v4 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
path: dist path: dist
merge-multiple: true merge-multiple: true
@@ -158,7 +158,7 @@ jobs:
run: ls -la dist/ run: ls -la dist/
- name: Publish to PyPI - name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1 uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
with: with:
packages-dir: dist packages-dir: dist
# Tolerate already-uploaded files so a manual re-run can complete # Tolerate already-uploaded files so a manual re-run can complete
.github/workflows/publish-wasm.yml
+5 -4
View File
@@ -24,7 +24,7 @@ jobs:
published: ${{ steps.check.outputs.published }} published: ${{ steps.check.outputs.published }}
version: ${{ steps.check.outputs.version }} version: ${{ steps.check.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
fetch-depth: 2 fetch-depth: 2
@@ -71,14 +71,15 @@ jobs:
contents: read contents: read
id-token: write id-token: write
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Rust - name: Install Rust
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with: with:
toolchain: stable
targets: wasm32-unknown-unknown targets: wasm32-unknown-unknown
- uses: actions/setup-node@v6 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: with:
node-version: '24' node-version: '24'
registry-url: 'https://registry.npmjs.org' registry-url: 'https://registry.npmjs.org'
.github/workflows/publish.yml
+16 -15
View File
@@ -24,7 +24,7 @@ jobs:
changed: ${{ steps.check.outputs.changed }} changed: ${{ steps.check.outputs.changed }}
version: ${{ steps.check.outputs.version }} version: ${{ steps.check.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with: with:
fetch-depth: 2 fetch-depth: 2
@@ -78,33 +78,34 @@ jobs:
- os: windows-latest - os: windows-latest
target: x86_64-pc-windows-msvc target: x86_64-pc-windows-msvc
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Rust - name: Install Rust
uses: dtolnay/rust-toolchain@stable uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
with: with:
toolchain: stable
targets: ${{ matrix.target }} targets: ${{ matrix.target }}
- uses: oven-sh/setup-bun@v2 - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
with: with:
bun-version: latest bun-version: latest
- name: Install zig - name: Install zig
if: contains(matrix.target, 'musl') if: contains(matrix.target, 'musl')
uses: mlugg/setup-zig@v2 uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
with: with:
version: 0.14.1 version: 0.14.1
- name: Install cargo-zigbuild - name: Install cargo-zigbuild
if: contains(matrix.target, 'musl') if: contains(matrix.target, 'musl')
uses: taiki-e/install-action@v2 uses: taiki-e/install-action@67729d5c413db75907f0ad1e39bb04b9c868ff60 # v2.85.7
env: env:
GITHUB_TOKEN: ${{ github.token }} GITHUB_TOKEN: ${{ github.token }}
with: with:
tool: cargo-zigbuild tool: cargo-zigbuild
- name: Cache cargo - name: Cache cargo
uses: actions/cache@v4 uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with: with:
path: | path: |
~/.cargo/registry/index/ ~/.cargo/registry/index/
@@ -125,7 +126,7 @@ jobs:
run: bunx napi build --platform --release --target ${{ matrix.target }} ${{ matrix.build-flags }} run: bunx napi build --platform --release --target ${{ matrix.target }} ${{ matrix.build-flags }}
- name: Upload native binary - name: Upload native binary
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with: with:
name: bindings-${{ matrix.target }} name: bindings-${{ matrix.target }}
path: napi/*.node path: napi/*.node
@@ -133,7 +134,7 @@ jobs:
- name: Upload generated JS bindings - name: Upload generated JS bindings
if: matrix.target == 'x86_64-unknown-linux-gnu' if: matrix.target == 'x86_64-unknown-linux-gnu'
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with: with:
name: js-bindings name: js-bindings
path: | path: |
@@ -162,16 +163,16 @@ jobs:
- os: windows-latest - os: windows-latest
target: x86_64-pc-windows-msvc target: x86_64-pc-windows-msvc
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Download native binary - name: Download native binary
uses: actions/download-artifact@v4 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: bindings-${{ matrix.target }} name: bindings-${{ matrix.target }}
path: napi path: napi
- name: Download generated JS bindings - name: Download generated JS bindings
uses: actions/download-artifact@v4 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: js-bindings name: js-bindings
path: napi path: napi
@@ -194,15 +195,15 @@ jobs:
contents: read contents: read
id-token: write id-token: write
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-node@v6 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: with:
node-version: '24' node-version: '24'
registry-url: 'https://registry.npmjs.org' registry-url: 'https://registry.npmjs.org'
- name: Download all artifacts - name: Download all artifacts
uses: actions/download-artifact@v4 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
path: napi/artifacts path: napi/artifacts