ci(release): Switch from action-prepare-release to Craft #5290
Conversation
This PR migrates from the deprecated action-prepare-release to the new Craft GitHub Actions (reusable workflow or composite action). Changes: - Migrate .github/workflows/release.yml to Craft reusable workflow
Semver Impact of This PR🟢 Patch (bug fixes) 📋 Changelog PreviewThis is how your changes will appear in the changelog. Bug Fixes 🐛
Documentation 📚
Internal Changes 🔧
🤖 This preview updates automatically when you update the PR. |
The previous migration incorrectly removed the GitHub App token authentication step. This commit restores it by switching to the composite action pattern which preserves the auth flow.
![sentry[bot]](https://avatars.githubusercontent.com/u/1396951?s=60&v=4){kind=small}
.github/workflows/release.yml
Outdated
| merge_target: ${{ github.event.inputs.merge_target }} | ||
| - name: Get auth token | ||
| id: token | ||
| uses: actions/create-github-app-token@v1 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
.github/workflows/ci.yml
Outdated
|
|
||
| steps: | ||
| - uses: actions/checkout@v6.0.1 | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v2.0.1 |
There was a problem hiding this comment.
Downgrade of actions/checkout from v6 to v2
High Severity
The actions/checkout action is being changed from v6.0.1 to a SHA commented as v2.0.1 or v2 across all workflow files. This is a major version downgrade from 2025 to 2020 that loses four major versions of improvements, security fixes, and features. The v2 version runs on deprecated Node.js and lacks features like sparse-checkout that may be relied upon. This appears unintentional since other actions like actions/setup-python@v6 and actions/upload-artifact@v6 remain at modern versions.
Additional Locations (2)
| description: Version to release (or "auto") | ||
| required: false | ||
| force: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Summary
This PR migrates from the deprecated
action-prepare-releaseto the new Craft GitHub Actions.Changes
.github/workflows/release.ymlto Craft reusable workflowDocumentation
See https://getsentry.github.io/craft/github-actions/ for more information.