Revert "chore(deps): bump actions/checkout from 4 to 5 (#5927)"#5929
Revert "chore(deps): bump actions/checkout from 4 to 5 (#5927)"#5929LesnyRumcajs merged 1 commit intomainfrom
Conversation
This reverts commit 1a5897f.
LesnyRumcajs
requested review from
elmattic and
hanabi1224
and removed request for
a team
WalkthroughAll touched GitHub Actions workflows downgrade actions/checkout from v5 to v4. One workflow (.github/workflows/curio-devnet-publish.yml) also removes the Docker metadata step while still referencing its outputs in the build step, introducing missing-output references. No other steps or logic are modified. Changes
Sequence Diagram(s)Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (7)
.github/workflows/docs-deploy.yml (1)
31-31: Checkout downgrade is fine; pin to SHA for security and consider shallow clone options explicitly
- Pin actions/checkout to a commit SHA to reduce supply-chain risk.
- If the docs build doesn’t need git history/tags, keep default fetch-depth (1). If it does (e.g., for versioning), set fetch-depth: 0.
- - uses: actions/checkout@v4 + - uses: actions/checkout@<pinned-sha> # v4 + # Uncomment if your build requires full history/tags: + # with: + # fetch-depth: 0.github/workflows/lotus-devnet-publish.yml (1)
19-19: Checkout downgrade is fine; consider pinning for supply-chain hardening.
actions/checkout@v4 is correct here. Optionally pin to a specific commit SHA for defense-in-depth..github/workflows/docs-required-override.yml (1)
49-49: Consider pinning actions to a commit SHA for supply-chain security.
Optional: pin actions/checkout@v4 to its immutable SHA to avoid surprises from upstream tag retags.Example:
- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 + # Optionally pin to a specific commit SHA + # uses: actions/checkout@<commit-SHA>.github/workflows/curio-devnet-publish.yml (1)
18-20: Pin action to a commit SHA and set least-privilege permissions
- Supply-chain best practice: pin actions to a commit SHA.
- Explicitly grant only the permissions needed for GHCR pushes (packages: write, contents: read).
Add this at the job level:
permissions: contents: read packages: writeAnd pin checkout to a commit SHA (replace with the official v4 commit):
uses: actions/checkout@<sha> # v4If you want, I can fetch the current recommended v4 SHA for you.
.github/workflows/release.yml (2)
21-21: Add explicit permissions and pin actions
- For the Build job, uploading releases requires contents: write.
- Pin actions to commit SHAs.
Add to the job:
permissions: contents: writeAnd pin:
uses: actions/checkout@<sha> # v4
59-59: Tighten permissions for publish job and pin action
- cargo publish uses your crates.io token; GITHUB_TOKEN only needs contents: read.
- Pin checkout to a commit SHA.
Add to the job:
permissions: contents: readAnd pin:
uses: actions/checkout@<sha> # v4.github/workflows/unit-tests.yml (1)
44-44: Optional hardening: explicit permissions and pinning
- Unit test jobs typically only need read access.
- Pin actions to commit SHAs.
At the workflow or job level:
permissions: contents: readAnd pin:
uses: actions/checkout@<sha> # v4If any tests rely on git history or tags, set fetch-depth: 0:
with: fetch-depth: 0
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (23)
.github/workflows/butterflynet.yml(1 hunks).github/workflows/cargo-advisories.yml(1 hunks).github/workflows/checkpoints.yml(1 hunks).github/workflows/curio-devnet-publish.yml(1 hunks).github/workflows/docker.yml(3 hunks).github/workflows/dockerfile-check.yml(1 hunks).github/workflows/docs-auto-update.yml(1 hunks).github/workflows/docs-check.yml(1 hunks).github/workflows/docs-deploy.yml(1 hunks).github/workflows/docs-required-override.yml(2 hunks).github/workflows/forest.yml(20 hunks).github/workflows/go-lint.yml(1 hunks).github/workflows/link-check.yml(1 hunks).github/workflows/lotus-api-bump.yml(1 hunks).github/workflows/lotus-devnet-publish.yml(1 hunks).github/workflows/release.yml(2 hunks).github/workflows/release_dispatch.yml(2 hunks).github/workflows/rpc-parity.yml(1 hunks).github/workflows/rpc_test_repeat.yml(1 hunks).github/workflows/rust-lint.yml(2 hunks).github/workflows/scripts-lint.yml(4 hunks).github/workflows/snapshot-parity.yml(1 hunks).github/workflows/unit-tests.yml(2 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: LesnyRumcajs
PR: ChainSafe/forest#5907
File: src/rpc/methods/state.rs:523-570
Timestamp: 2025-08-06T15:44:33.467Z
Learning: LesnyRumcajs prefers to rely on BufWriter's Drop implementation for automatic flushing rather than explicit flush() calls in Forest codebase.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: Build Ubuntu
- GitHub Check: Build MacOS
- GitHub Check: cargo-publish-dry-run
- GitHub Check: tests
- GitHub Check: tests-release
- GitHub Check: All lint checks
- GitHub Check: Check
- GitHub Check: Build forest binaries on Linux AMD64
- GitHub Check: Deploy to Cloudflare Pages
- GitHub Check: Analyze (rust)
- GitHub Check: Analyze (go)
🔇 Additional comments (43)
.github/workflows/lotus-api-bump.yml (2)
14-14: Revert to actions/checkout@v4 looks good.
No functional differences in this workflow beyond the checkout version change. Safe downgrade.
14-14: All clear: no remainingactions/checkout@v5or unpairedsteps.meta.outputsreferences
Ran a repository-wide search and confirmed:
- No
uses: actions/checkout@v5occurrences- No workflows reference
steps.meta.outputs.{tags,labels}without adocker/metadata-actionstepNo further action required.
.github/workflows/scripts-lint.yml (1)
21-21: All checkout downgrades to v4 are consistent and safe.
No impact on subsequent steps. Good consistency across jobs.Also applies to: 29-29, 42-42, 55-55, 77-77
.github/workflows/dockerfile-check.yml (1)
14-14: LGTM on reverting to actions/checkout@v4.
Workflow behavior remains unchanged; Docker build/run steps unaffected..github/workflows/docs-check.yml (1)
33-33: LGTM on checkout v4.
Docs checks remain the same; no behavioral changes expected..github/workflows/cargo-advisories.yml (1)
10-10: actions/checkout@v4 downgrade verified — no remaining v5 references or metadata issues
- No occurrences of
actions/checkout@v5found across workflows.- In
.github/workflows/curio-devnet-publish.yml, themetastep (id: meta) correctly definestagsandlabelsoutputs, so downstream references are valid.Consider pinning
actions/checkout@v4to a specific commit SHA for stronger supply-chain guarantees..github/workflows/link-check.yml (1)
33-33: LGTM: Checkout reverted to v4Change is consistent with the PR’s objective; no functional impact expected for this workflow.
.github/workflows/butterflynet.yml (1)
22-22: LGTM: Checkout reverted to v4Matches the revert scope; the rest of the pipeline remains unaffected.
.github/workflows/release_dispatch.yml (1)
25-25: LGTM: Both checkout steps reverted to v4Revert is applied consistently in Build and Publish jobs. No other behavioral changes introduced.
Also applies to: 62-62
.github/workflows/rpc-parity.yml (1)
19-19: LGTM: Checkout reverted to v4Aligned with the PR’s intent. No downstream steps rely on checkout v5 specifics here.
.github/workflows/docs-required-override.yml (1)
35-35: Downgrade to actions/checkout@v4 is correct and consistent with the PR’s intent.
No functional impact expected for this workflow; paths-filter behavior is unchanged..github/workflows/rust-lint.yml (2)
48-48: Checkout downgrade to v4 looks good.
No changes required; submodules are not used here, so default v4 behavior is fine.
74-74: Checkout downgrade to v4 looks good in dependencies-check.
The Ruby setup and dependency script are unaffected..github/workflows/go-lint.yml (1)
37-37: Checked: v4 is compatible for the Go lint pipeline.
No other step depends on checkout v5 features; safe revert..github/workflows/forest.yml (20)
51-51: All checkout steps moved to v4 — consistent with revert.
MacOS job unaffected; no behavior changes expected.
78-78: Build Ubuntu: checkout@v4 change LGTM.
No impact on caching or build steps.
101-101: cargo-publish-dry-run: checkout@v4 change LGTM.
No functional differences expected.
124-124: forest-cli-check: checkout@v4 change LGTM.
Artifacts/download steps remain valid.
146-146: calibnet-check: checkout@v4 change LGTM.
All subsequent steps unaffected.
176-176: calibnet-stateless-mode-check: checkout@v4 change LGTM.
No issues spotted.
202-202: calibnet-stateless-rpc-check: checkout@v4 change LGTM.
No issues spotted.
227-227: state-migrations-check: checkout@v4 change LGTM.
No issues spotted.
249-249: calibnet-wallet-check: checkout@v4 change LGTM.
No issues spotted.
277-277: calibnet-export-check: checkout@v4 change LGTM.
No issues spotted.
299-299: calibnet-export-check-v2: checkout@v4 change LGTM.
No issues spotted.
321-321: calibnet-no-discovery-checks: checkout@v4 change LGTM.
No issues spotted.
342-342: calibnet-kademlia-checks: checkout@v4 change LGTM.
No issues spotted.
363-363: calibnet-eth-mapping-check: checkout@v4 change LGTM.
No issues spotted.
387-387: db-migration-checks: checkout@v4 change LGTM.
No issues spotted.
420-420: local-devnet-check: checkout@v4 change LGTM.
No issues spotted.
467-467: local-devnet-curio-check (disabled): checkout@v4 change LGTM.
No runtime impact since job is if: false.
504-504: bootstrap-checks-forest: checkout@v4 change LGTM.
No issues spotted.
523-523: bootstrap-checks-lotus: checkout@v4 change LGTM.
No issues spotted.
549-549: calibnet-rpc-checks: checkout@v4 change LGTM.
No issues spotted..github/workflows/docker.yml (3)
57-57: Build AMD64: checkout@v4 change LGTM.
No side effects on sccache/setup-go/cargo steps.
100-100: Build ARM64: checkout@v4 change LGTM.
Conditional execution preserved; no functional change.
137-137: LGTM: Docker workflows verified – no checkout@v5 and metadata-action outputs intactAll checks passed:
- No remaining
actions/checkout@v5usages in.github/workflows.- Every
steps.meta.outputsreference in
•.github/workflows/docker.yml
•.github/workflows/lotus-devnet-publish.yml
•.github/workflows/curio-devnet-publish.yml
has a correspondinguses: docker/metadata-action@…step withid: meta.- The single
steps.metafat.outputsin.github/workflows/docker.ymlis backed by auses: docker/metadata-action@…step withid: metafat.No further changes required.
.github/workflows/curio-devnet-publish.yml (2)
18-20: Reverting checkout to v4 looks fineNo functional concerns with actions/checkout@v4 for this workflow.
18-20: Verified: All workflows include docker/metadata-action
No workflows in .github/workflows reference steps.meta.outputs without a corresponding uses: docker/metadata-action@… step..github/workflows/release.yml (2)
21-21: Checkout downgrade to v4 is OKNo known regressions expected for this step with v4.
59-59: Checkout downgrade to v4 is OKThe publish job should continue to work with v4.
.github/workflows/unit-tests.yml (2)
44-44: Checkout downgrade to v4 is fineNo issues expected for test checkout with v4.
66-66: Checkout downgrade to v4 is fineNo issues expected for release-mode tests with v4.
3 participants
This reverts commit 1a5897f.
Summary of changes
Changes introduced in this pull request:
Reference issue to close (if applicable)
Closes
Other information and links
Change checklist
Summary by CodeRabbit