Repository navigation
Conversation
|
Size Change: 0 B Total Size: 7.75 MB |
desrosj
force-pushed
the
fix-actions-7.1/update-actions-to-latest
branch
from
September 1, 2026 13:45
1dca3d2 to
86380e5
Compare
desrosj
changed the base branch from
wp/7.1
to
fix-actions-7.1/remove-rn-workflows
September 1, 2026 13:45
desrosj
changed the base branch from
fix-actions-7.1/remove-rn-workflows
to
fix-actions-7.1/reference-trunk-workflow-lint
September 1, 2026 14:00
desrosj
force-pushed
the
fix-actions-7.1/update-actions-to-latest
branch
from
September 1, 2026 14:00
86380e5 to
4c62b11
Compare
desrosj
force-pushed
the
fix-actions-7.1/update-actions-to-latest
branch
from
September 10, 2026 18:17
4c62b11 to
32e23d5
Compare
desrosj
force-pushed
the
fix-actions-7.1/update-actions-to-latest
branch
from
September 10, 2026 20:10
32e23d5 to
f79261c
Compare
desrosj
force-pushed
the
fix-actions-7.1/update-actions-to-latest
branch
from
September 10, 2026 23:59
f79261c to
dc996fd
Compare
desrosj
marked this pull request as ready for review
September 11, 2026 00:38
desrosj
marked this pull request as draft
September 11, 2026 00:40
desrosj
marked this pull request as ready for review
September 11, 2026 00:41
desrosj
force-pushed
the
fix-actions-7.1/update-actions-to-latest
branch
from
September 11, 2026 00:55
6df314e to
e4938e2
Compare
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Use desired version of Node.js | ||
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
|
|
||
| - name: Use desired version of Node.js | ||
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 |
| # passing a custom cache suffix ensures that the cache is flushed at least once per week. | ||
| - name: Install Composer dependencies | ||
| uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4.0.0 | ||
| uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 |
| # passing a custom cache suffix ensures that the cache is flushed at least once per week. | ||
| - name: Install Composer dependencies | ||
| uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4.0.0 | ||
| uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 |
desrosj
force-pushed
the
fix-actions-7.1/update-actions-to-latest
branch
from
September 11, 2026 16:58
ad32ce5 to
f0958c2
Compare
`actions/checkout` was pinned to v7.0.0 across every workflow file that uses it. v7.0.1 is the latest release. Rebased onto real wp/7.1's own restructuring of end2end-test.yml (the report-to-issues job was replaced upstream by a pr-meta job as part of unifying PR automation comments, WordPress#82249) -- bumps all 4 checkout calls actually present now, including the new pr-meta job's, which still carried the old pin.
`.github/setup-node/action.yml` (the composite action most workflows call into for Node.js setup) still pinned `actions/setup-node` to v6.4.0, older than the v7.0.0 pin some workflow files call the action with directly. v7.0.0 is the latest release.
`docker/login-action` was pinned to v4.4.0 in `build-plugin-zip.yml`. v4.6.0 is the latest release.
`oras-project/setup-oras` was pinned to v2.0.0 in `build-plugin-zip.yml`. v2.0.1 is the latest release.
`actions/labeler` was pinned to v6.1.0 in `pr-labeling-automation.yml`. v7.0.0 is the latest release.
`publish-npm-packages.yml` was restored to this branch after this layer's original `actions/checkout` bump had already been applied to every other workflow file, so its three `actions/checkout` calls were left on the old v7.0.0 pin. This follow-up brings it in line with the rest of the layer's final state, pinning it to v7.0.1 like every other workflow file in the tree.
Brings the remaining direct `actions/setup-node` calls (in `bundle-size.yml`, `build-plugin-zip.yml`, `static-checks.yml`, and `publish-npm-packages.yml`) in line with what the composite `.github/setup-node/action.yml` and every other workflow file already use.
Corrects five pinned-SHA version comments that no longer matched what the SHA actually resolves to: - `preactjs/compressed-size-action`: `v2.10.0` -> `2.10.0` (the real tag has no leading "v"). - `shivammathur/setup-php` (x2): `v2.37.2` -> `2.37.2`. The SHA is also the current tip of the `master` branch, which zizmor's own fix offered as an alternative, but a branch name is a moving target and would go stale the moment `master` advances further -- the version tag stays accurate indefinitely and matches this repo's existing convention for every other pin. - `ramsey/composer-install` (x2): `v4.0.0` -> `4.0.0` (same "v" prefix issue as `compressed-size-action`). No pinned SHA was changed, only the trailing comments.
This file didn't exist yet when this layer originally bumped every other workflow's `actions/checkout` pin, since `storybook-check.yml` was removed by the `remove-rn-workflows` layer and only restored afterward. Now that it's back, bring its pin in line with the same `v7.0.1` target every other file in this stack already uses.
desrosj
force-pushed
the
fix-actions-7.1/update-actions-to-latest
branch
from
September 11, 2026 18:24
9608774 to
4108635
Compare
| actions: read | ||
| contents: read | ||
| uses: ./.github/workflows/reusable-workflow-lint.yml | ||
| uses: WordPress/gutenberg/.github/workflows/reusable-workflow-lint.yml@trunk |
desrosj
removed this pull request from stack #177
September 11, 2026 18:31
desrosj
added this pull request to stack #278
September 11, 2026 18:33
🤖 PR meta 🤖📦 Bundle sizeSize Change: +1.3 kB (+0.02%) Total Size: 7.75 MB 📦 View Changed
|
Owner
Author
|
Migrated to real upstream: WordPress#82789. Closing this fork PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Updates 8 third-party GitHub Actions used across this branch's workflows (including the composite
.github/setup-node/action.ymlaction) to their latest published releases, pinned to full-length commit SHAs.actions/checkoutv7.0.1actions/setup-node(composite action)v7.0.0docker/login-actionv4.6.0oras-project/setup-orasv2.0.1actions/labelerv7.0.0actions/stalev11.0.0astral-sh/setup-uvv10.0.1github/codeql-action/upload-sarifv4.37.8Why?
This ensures that no deprecations or platform-level changes prevent workflows from running.
Use of AI Tools
This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.