From 36729b99f5235f5c5e28a9663fd6fec36c48c5da Mon Sep 17 00:00:00 2001 From: Derek Date: Wed, 5 Aug 2026 13:50:41 +1000 Subject: [PATCH] fix(ci): onboard Renovate and move onto current action majors Every action here was several majors behind because this repo has no Renovate config at all - nothing was ever going to bump it. checkout v4 (current v7), setup-node v4 (v7), setup-go v5 (v7), upload-artifact v4 (v7), download-artifact v4 (v8). Adding renovate.json is the actual fix; the bumps just clear the backlog it would otherwise open five PRs for. The org preset also SHA-pins actions, so Renovate will convert these tags to commit SHAs on its first run - which is why they are left as tags here rather than pinned by hand. The majors carry real breaking changes, so each was checked rather than assumed: - checkout v6+ and the artifact actions v6/v7+ need Actions Runner >= 2.329.0 / 2.327.1. The ARC scale set this repo uses reports 2.336.0. - download-artifact v5's breaking path change applies to downloads BY ID; this workflow downloads by name into an explicit path. - upload-artifact v7's direct uploads and download-artifact v8's "no longer unzips everything" are one generation and move together, which is the supported path. Splitting them is what breaks. Left alone deliberately: Swatinem/rust-cache@v2 and EmbarkStudios/cargo-deny-action@v2 are already the current major, and dtolnay/rust-toolchain@stable / taiki-e/install-action@nextest name a channel rather than a version. NOTE: release.yml only runs on a release, so those steps are not exercised until the next one. Refs hyperi-io/hyperi-ci#100 --- .github/workflows/ci.yml | 6 +++--- .github/workflows/release.yml | 18 +++++++++--------- renovate.json | 7 +++++++ 3 files changed, 19 insertions(+), 12 deletions(-) create mode 100644 renovate.json diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 78fe1dd..8ee714f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: name: Lint and format runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Rust uses: dtolnay/rust-toolchain@stable @@ -55,7 +55,7 @@ jobs: matrix: os: [ubuntu-latest, macos-latest, windows-latest] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Rust uses: dtolnay/rust-toolchain@stable @@ -94,7 +94,7 @@ jobs: name: cargo-deny runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: EmbarkStudios/cargo-deny-action@v2 with: command: check diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d836bf8..e645780 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: name: Build Linux binaries runs-on: ${{ vars.GH_RUNNER_DEFAULT || 'ubuntu-latest' }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -53,7 +53,7 @@ jobs: cp target/aarch64-unknown-linux-gnu/release/git-scrub dist/git-scrub-linux-arm64 - name: Upload linux binaries - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: linux-binaries path: | @@ -68,7 +68,7 @@ jobs: name: Build macOS binaries runs-on: macos-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -92,7 +92,7 @@ jobs: cp target/aarch64-apple-darwin/release/git-scrub dist/git-scrub-darwin-arm64 - name: Upload macOS binaries - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: macos-binaries path: | @@ -118,13 +118,13 @@ jobs: env: HOMEBREW_APP_ID: ${{ secrets.HOMEBREW_APP_ID }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 persist-credentials: false - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: "lts/*" @@ -139,7 +139,7 @@ jobs: conventional-changelog-conventionalcommits - name: Install Go (for nFPM) - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version: ">=1.22" cache: false @@ -151,13 +151,13 @@ jobs: # Download artefacts from the build jobs - name: Download linux binaries - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: linux-binaries path: dist/ - name: Download macOS binaries - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: macos-binaries path: dist/ diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..89b0ca9 --- /dev/null +++ b/renovate.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "description": "Inherits the org preset: 7-day supply-chain cooldown on external dependencies, same-org and CVE bypasses, PR-only, grouped updates, and SHA-pinning for GitHub Actions (helpers:pinGitHubActionDigests converts tag-pinned actions to commit SHAs).", + "extends": [ + "github>hyperi-io/renovate-config" + ] +}