CI: actions/checkout v4 to v5 #2
Conversation
WalkthroughUpdated actions/checkout from v4 to v5 across four GitHub Actions workflows (.github/workflows/Lark-notification.yml, deploy-production.yml, init-template.yml, main.yml). No other steps, logic, or control flow were changed. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Comment |
|
Related Documentation Checked 10 published document(s). No updates required. How did I do? Any feedback? |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
.github/workflows/init-template.yml (1)
19-19: LGTM on v5; pin SHA. Avoid changing creds here due to the later auto‑commit step.
- v5 uses Node 24 and needs Actions Runner ≥ v2.327.1; confirm any self‑hosted runners. (github.com)
- Pin the action to the v5.0.0 commit for supply‑chain hardening.
- Keep default credential persistence here because git-auto-commit-action typically relies on checkout’s saved credentials to push.
- - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # actions/checkout v5.0.0Confirm the SHA maps to v5.0.0. (github.com)
.github/workflows/deploy-production.yml (1)
23-23: Good bump; please pin and disable persisted git creds.
- Node 24 runtime and Actions Runner ≥ v2.327.1 apply here as well. (github.com)
- This job doesn’t push to the repo; avoid storing git credentials.
- - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # actions/checkout v5.0.0 + with: + persist-credentials: false.github/workflows/Lark-notification.yml (1)
19-19: Looks good; pin to SHA and don’t persist credentials.
- v5 requires the Node 24 runtime and runner ≥ v2.327.1; verify any self‑hosted. (github.com)
- No pushes happen here; disable credential persistence and pin to the v5.0.0 commit.
- - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # actions/checkout v5.0.0 + with: + persist-credentials: false
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/Lark-notification.yml(1 hunks).github/workflows/deploy-production.yml(1 hunks).github/workflows/init-template.yml(1 hunks).github/workflows/main.yml(1 hunks)
🔇 Additional comments (1)
.github/workflows/main.yml (1)
16-16: Upgrade actions/checkout@v5 — pin SHA & disable persisted creds; verify runner compatibilityFile: .github/workflows/main.yml (line 16)
- Apply:
- - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # actions/checkout v5.0.0 + with: + persist-credentials: false
- Confirm: pinned SHA matches actions/checkout v5.0.0; no other workflows use older checkout versions; any self-hosted runners meet Actions Runner >= v2.327.1 (v5 requires Node 24).
Verification incomplete: ripgrep returned "No files were searched" — repo-wide checks couldn't be completed here.
1 participant
Checklist（清单）:
Closes #XXXXX
Summary by CodeRabbit
Chores
Tests
Note