chore(deps): update actions/setup-node action to v6#316
chore(deps): update actions/setup-node action to v6#316red-hat-konflux[bot] wants to merge 1 commit intomasterfrom
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Summary by CodeRabbit
WalkthroughUpdated GitHub Actions workflow to upgrade the Node setup action from v4 to v6 across the install, test-component, and test-storybook jobs. Node version and npm caching configuration unchanged. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/test.yml (1)
17-17: ⚡ Quick winPin
actions/setup-nodeandactions/checkoutto immutable commit SHAs instead of floating major version tags.Using
@v6and@v4tags is convenient, but pinning to full commit SHAs improves supply-chain integrity and reproducibility.This applies to lines: 17, 43, 84 (for
actions/setup-node@v6) and lines 15, 41, 82 (foractions/checkout@v4).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test.yml at line 17, Replace the floating tags "actions/setup-node@v6" and "actions/checkout@v4" with pinned immutable commit SHAs for each occurrence in the workflow; locate the `uses:` entries (the occurrences of actions/setup-node and actions/checkout) and change them to the full commit SHA form (e.g., actions/setup-node@<commit-sha> and actions/checkout@<commit-sha>) by looking up the corresponding repository commit hash on GitHub and updating lines where `uses: actions/setup-node@v6` and `uses: actions/checkout@v4` appear so each of the three occurrences is pinned.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/test.yml:
- Line 17: Replace the floating tags "actions/setup-node@v6" and
"actions/checkout@v4" with pinned immutable commit SHAs for each occurrence in
the workflow; locate the `uses:` entries (the occurrences of actions/setup-node
and actions/checkout) and change them to the full commit SHA form (e.g.,
actions/setup-node@<commit-sha> and actions/checkout@<commit-sha>) by looking up
the corresponding repository commit hash on GitHub and updating lines where
`uses: actions/setup-node@v6` and `uses: actions/checkout@v4` appear so each of
the three occurrences is pinned.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 9fb92c7a-4439-4c12-bcf6-d33e06f54724
📒 Files selected for processing (1)
.github/workflows/test.yml
This PR contains the following updates:
v4→v6Release Notes
actions/setup-node (actions/setup-node)
v6Compare Source
v5Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.