Upgrade GitHub Actions to latest versions - #3683
Conversation
248e42b to
4c7994d
Compare
…merge-after-nits; docs: INDEX +8 PRs (drip-123)
wenshao
left a comment
wenshao
left a comment
There was a problem hiding this comment.
No issues found. LGTM! ✅ — gpt-5.5 via Qwen Code /review
wenshao
left a comment
wenshao
left a comment
There was a problem hiding this comment.
Following up on the earlier /review LGTM — on a closer pass I noticed a consistency regression around ratchet annotations.
Several # ratchet:owner/repo@<version> annotations have been replaced with bare version comments (e.g. # v3.0.1), dropping the ratchet: prefix. That prefix is what ratchet reads to track each action's intended ref for future auto-upgrades.
Affected locations (non-exhaustive):
.github/actions/post-coverage-comment/action.yml:# ratchet:thollander/actions-comment-pull-request@v3→# v3.0.1.github/workflows/ci.yml:# ratchet:dorny/test-reporter@v2→# v3.0.0.github/workflows/community-report.yml(2 lines).github/workflows/docs-page-action.yml(3 lines).github/workflows/gemini-automated-issue-dedup.yml(3 lines).github/workflows/gemini-scheduled-issue-dedup.yml(2 lines).github/workflows/release.yml(docker/setup-buildx-action).github/workflows/e2e.yml(docker/setup-buildx-action)
Other workflows in this repo (e.g. actions/checkout, actions/setup-node references in release.yml) still use the canonical # ratchet:owner/repo@<ref> form, so dropping the prefix here is inconsistent and will silently break ratchet's ability to track these actions.
The SHA pins themselves remain pinned to commits, so the security posture is unchanged — but it would be worth restoring the standard format before merging. The fix is purely mechanical, e.g. # v6.0.0 → # ratchet:actions/configure-pages@v6.
Dismissing the auto-generated /review LGTM in favor of the follow-up comment above — needs the ratchet: prefix restored before this is good to merge.
4c7994d to
9382aee
Compare
DragonnZhang
left a comment
DragonnZhang
left a comment
There was a problem hiding this comment.
Review Summary
The version bumps and SHA pinning are good improvements. Two issues to address before merging:
1. Ratchet annotations stripped (consistency regression)
This project uses ratchet for GitHub Actions dependency management — all unchanged actions across 15+ workflow files use # ratchet:owner/repo@version annotations. This PR replaces those annotations with bare version comments (e.g. # v3.0.0) on 10 lines across 7 files:
| File | Lines affected |
|---|---|
ci.yml |
205, 287, 292 |
docs-page-action.yml |
30, 39, 50 |
build-and-publish-image.yml |
70, 73, 77, 92, 100 (were ratchet:exclude) |
e2e.yml |
55 |
release.yml |
269 |
post-coverage-comment/action.yml |
108 |
terminal-bench.yml |
33 |
Running ratchet check after merge would flag these lines as unmanaged. Please restore the # ratchet:owner/repo@<new-version> format (or # ratchet:exclude where that was the previous annotation).
2. Branch is stale — needs rebase
The merge-base is 76d8c0ce8, but main has since advanced with several CI-related commits, including 3cc66f9ae ("ci(deps): bump docker/* actions to Node 24 majors") which already updated the Docker action tags in build-and-publish-image.yml to v4/v6/v7 with # ratchet:exclude. The Docker action bumps in this PR partially duplicate that work. A rebase will resolve the overlap and any merge conflicts.
— qwen-code via Qwen Code /review
| if: |- | ||
| ${{ always() && (github.event.pull_request.head.repo.full_name == github.repository) }} | ||
| uses: 'dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3' # ratchet:dorny/test-reporter@v2 | ||
| uses: 'dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2' # v3.0.0 |
There was a problem hiding this comment.
The # ratchet:dorny/test-reporter@v2 annotation was replaced with # v3.0.0. Please restore the ratchet annotation format: # ratchet:dorny/test-reporter@v3. Same applies to the CodeQL lines (287, 292) and all other files in this PR where ratchet annotations were stripped.
— qwen-code via Qwen Code /review
DragonnZhang
left a comment
DragonnZhang
left a comment
There was a problem hiding this comment.
Review Summary
Echoing the findings of @wenshao and @DragonnZhang: this PR has a ratchet annotation consistency regression that needs to be addressed before merge.
Issue: Ratchet annotations stripped
Across all 7 changed files, # ratchet:owner/repo@version annotations and # ratchet:exclude markers have been replaced with bare # vX.Y.Z version comments. This breaks ratchet's ability to manage these SHA pins going forward. The ratchet update and ratchet check commands rely on the # ratchet: prefix to identify and track pinned actions.
Affected files (all changed lines):
action.yml— lost# ratchet:thollander/actions-comment-pull-request@v3build-and-publish-image.yml— lost# ratchet:excludeon 5 Docker action linesci.yml— lost# ratchet:dorny/test-reporter@v2and two CodeQL ratchet annotationsdocs-page-action.yml— lost 3 ratchet annotations (configure-pages, upload-pages-artifact, deploy-pages)e2e.yml— lost# ratchet:docker/setup-buildx-action@v3release.yml— lost# ratchet:docker/setup-buildx-action@v3
Fix: Restore the ratchet annotation format on every line, e.g.:
# ratchet:dorny/test-reporter@v3(update the version to match the new major)# ratchet:docker/setup-qemu-action@v4(replace the oldratchet:excludewith proper tracking now that these are SHA-pinned)
Positive: Docker actions now SHA-pinned
The previously unpinned Docker actions in build-and-publish-image.yml (bare @v3/@v5/@v6 tags) are now pinned to commit SHAs. This is a meaningful supply-chain security improvement. The SHA for docker/setup-buildx-action@4d04d5d... is consistent across all three files that use it.
Verdict
The version bumps and SHA pinning are directionally correct. The only blocker is restoring ratchet annotations so the project's pinning tool continues to work. Once that is fixed, this is good to merge.
— qwen-code via Qwen Code /review
|
@salmanmkc heads up — this PR currently has merge conflicts with Conflicting files:
The rest merges cleanly. Thanks! 中文@salmanmkc 提个醒 —— 这个 PR 目前和 冲突文件:
其余文件可以自动合并。谢谢! |
Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com>
9382aee to
2818e12
Compare
updated |
DragonnZhang
left a comment
DragonnZhang
left a comment
There was a problem hiding this comment.
Mechanical upgrades of third-party GitHub Actions to latest versions: dorny/test-reporter v2→v3, github/codeql-action init/analyze v3→v4.36.2, actions/configure-pages v5→v6, actions/upload-pages-artifact v3→v5, actions/deploy-pages v4→v5, docker/setup-buildx-action v4→v4.1.0, astral-sh/setup-uv v6→v8.2.0, thollander/actions-comment-pull-request to v3.0.1. All pin SHAs updated. CI green. LGTM ✅ — claude-opus-4-6 via Qwen Code /review
wenshao
left a comment
wenshao
left a comment
There was a problem hiding this comment.
No issues found. LGTM! ✅ — qwen3.7-max via Qwen Code /review
|
@qwen-code /resolve |
Integrate main's structural changes while preserving PR's action upgrades: - dorny/test-reporter: keep v3.0.0 upgrade (a43b3a5) with main's improved if-condition (skip_ci guard + unit_tests.outcome check) - integration_cli: accept main's restructuring (CodeQL moved to codeql.yml, added verify-checkout, Node setup for hosted/self-hosted, and actual integration test steps) - Auto-merged e2e.yml and release.yml: docker/setup-buildx-action v4.1.0 upgrade preserved
|
Qwen Code resolved the merge conflicts and pushed the branch update. Merge Conflict Resolution Summary — PR #3683Conflicted file
Conflict 1: "Publish Test Report" step (line ~264)
Conflicts 2 & 3:
|
1ca4818
|
@qwen-code /triage |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
There was a problem hiding this comment.
Hey @salmanmkc, thanks for keeping our Actions up to date — much appreciated.
The PR body doesn't follow our PR template though. It's missing the required headings: "What this PR does", "Why it's needed", "Reviewer Test Plan", "Risk & Scope", and "Linked Issues". The changes table is helpful, but could you restructure it under those headings so reviewers have the context they need?
Also, a couple of gaps I noticed while looking at the diff:
- codeql-action and qwen-code-action are listed in the PR body as upgraded, but neither change appears in the diff.
codeql-actionis still at the old SHA (df55935) incodeql.yml, andqwen-code-actionis unchanged across 8 usages in 6 workflow files. Were these intended to be included? - Several files referenced in the PR body (
qwen-scheduled-issue-autofix.yml,qwen-issue-followup-bot.yml,qwen-scheduled-issue-triage.yml) no longer exist onmain— the repo's workflow layout has shifted since the fork branched off.
Could you rebase on main, pick up the current file names, and either complete the remaining action bumps or drop them from the PR description? Then fill in the template headings and we'll re-run triage.
中文说明
@salmanmkc 感谢帮忙升级 Actions！
PR 描述没有按照我们的 PR 模板 来写，缺少 "What this PR does"、"Why it's needed"、"Reviewer Test Plan"、"Risk & Scope"、"Linked Issues" 等必要章节。变更表格很有用，但请按照模板重新组织一下。
另外发现几个不一致的地方：
- PR 描述中提到的 codeql-action 和 qwen-code-action 升级，diff 里并没有包含。
codeql.yml里的 codeql-action 仍是旧 SHA（df55935），qwen-code-action 在 6 个 workflow 文件的 8 处引用也都未改动。 - PR 描述中引用的几个文件（
qwen-scheduled-issue-autofix.yml、qwen-issue-followup-bot.yml、qwen-scheduled-issue-triage.yml）在main上已经不存在了——仓库的 workflow 结构在 fork 之后有过调整。
请 rebase 到最新的 main，确认当前文件名，补齐剩余的 action 升级（或从描述中移除），然后按模板补全 PR 描述，我们会重新跑一遍审查。
— Qwen Code · qwen3.7-max
The action version bumps had replaced '# ratchet:owner/repo@<ver>' annotations with bare '# vX.Y.Z' comments, which silently breaks ratchet's ability to track and update these SHA pins. Restore the annotations on every changed line (updated to the new major), matching each line's pre-existing convention on main.
|
@qwen-code /triage |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
There was a problem hiding this comment.
Hi @salmanmkc — thanks for keeping our Actions up to date, much appreciated!
The PR body doesn't follow our PR template. It's missing the required headings: What this PR does, Why it's needed, Reviewer Test Plan, Risk & Scope, and Linked Issues. The changes table is helpful, but could you restructure it under those headings?
A couple of inconsistencies between the PR body and the actual diff:
- codeql-action is listed as upgraded (
df55935→8aad20d) butcodeql.ymlis not touched in the diff — it's still at the old SHA. - qwenlm/qwen-code-action is listed as upgraded (
5fd6818→132374a) but none of the 6 workflow files that reference it (8 usages total) are changed. qwen-scheduled-issue-autofix.ymlreferenced in the body doesn't exist onmain— the file isqwen-autofix.yml.
Could you either complete those bumps or drop them from the description, fix the file name, and reformat to match the template? We'll re-run triage after that.
中文说明
@salmanmkc 感谢帮忙升级 Actions！
PR 描述没有按照我们的 PR 模板 来写，缺少 What this PR does、Why it's needed、Reviewer Test Plan、Risk & Scope、Linked Issues 等必要章节。变更表格很有用，但请按模板重新组织。
PR 描述和实际 diff 之间有几处不一致：
- codeql-action 在描述中标注为已升级（
df55935→8aad20d），但codeql.yml并未在 diff 中修改，仍为旧 SHA。 - qwenlm/qwen-code-action 在描述中标注为已升级（
5fd6818→132374a），但引用该 action 的 6 个 workflow 文件（共 8 处引用）均未修改。 - 描述中引用的
qwen-scheduled-issue-autofix.yml在main分支上不存在——实际文件名是qwen-autofix.yml。
请补齐这些升级（或从描述中移除），修正文件名，并按模板重写 PR 描述。修改后我们会重新审查。
— Qwen Code · qwen3.7-max
|
@qwen-code /triage |
|
Thanks for the PR! Template looks good ✓ — all required sections present and filled in properly. On direction: straightforward CI maintenance — keeping GitHub Actions SHA pins current per the repo's ratchet-based pinning strategy. Fully aligned, no direction concerns. On approach: scope is minimal and focused — 8 lines changed across 6 workflow files, all version bumps or SHA pin updates. No scope creep. Verified all SHA pins against upstream tags — all resolve correctly, including the One note: Moving on to code review. 🔍 中文说明感谢贡献！ 模板完整 ✓ 方向：标准的 CI 维护——按照仓库的 ratchet SHA pin 策略保持 GitHub Actions 最新。完全对齐，无方向问题。 方案：范围小且聚焦——6 个 workflow 文件改了 8 行，全是版本升级或 SHA pin 更新。已验证所有 SHA pin 与上游 tag 匹配正确，ratchet 注释一致。 提醒： 进入代码审查 🔍 — Qwen Code · qwen3.7-max |
Code ReviewThis is a pure workflow-config PR — 8 lines changed across 6 YAML files, all SHA pin + ratchet annotation updates. No application code, no new logic, no reuse concerns. Reviewed each bump against the workflow usage context:
SHA pin verification: all 7 pins resolve correctly to their tagged versions, including the No critical blockers. No AGENTS.md violations (workflow config, not application code). Real-Scenario TestingN/A — this is purely CI workflow configuration. There is no user-visible behavior to drive in tmux. The verification surface is CI itself: if the workflows execute successfully on this PR's checks, the action references resolve correctly and the input interfaces are compatible. No tmux test can substitute for or add to what CI validates here. 中文说明代码审查纯 workflow 配置 PR——6 个 YAML 文件改了 8 行，全是 SHA pin 和 ratchet 注释更新。无应用代码、无新逻辑、无复用问题。 逐项检查了每个升级在 workflow 中的使用方式：
SHA pin 验证：7 个 pin 全部正确解析到对应 tag，包括 无关键阻塞，无 AGENTS.md 违规。 真实场景测试不适用——纯 CI workflow 配置，无用户可见行为可用 tmux 测试。验证面就是 CI 本身：如果 workflow 在本 PR 的 check 中成功执行，说明 action 引用解析正确、输入接口兼容。 — Qwen Code · qwen3.7-max |
|
Clean CI maintenance PR. All SHA pins verified against upstream tags, workflow usage reviewed for each bump — no compatibility concerns. The diff is exactly what it claims to be: focused version bumps with no scope creep, no drive-by changes, nothing extraneous. The only note worth repeating: CI is the verification surface here, and that's the right call for a workflow-only change. Approving. ✅ 中文说明干净的 CI 维护 PR。所有 SHA pin 已与上游 tag 核对，逐项检查了每个升级的 workflow 用法——无兼容性问题。diff 完全如描述所述：聚焦的版本升级，无范围蔓延、无顺手改动、无多余内容。 唯一值得重复的： CI 是验证面，对于纯 workflow 改动这是正确选择。批准。✅ — Qwen Code · qwen3.7-max |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
There was a problem hiding this comment.
LGTM, looks ready to ship. ✅
yiliang114
left a comment
yiliang114
left a comment
There was a problem hiding this comment.
LGTM. Ratchet annotations restored on all the bumped actions, and the PR body now matches the actual diff. Thanks for keeping these current.
6 participants
What this PR does
Bumps a set of third-party GitHub Actions to their latest releases, keeping every action pinned to a commit SHA and preserving the repo's
# ratchet:owner/repo@<version>annotations so ratchet can keep tracking the pins.thollander/actions-comment-pull-requestpost-coverage-comment/action.ymldorny/test-reporterci.ymlactions/configure-pagesdocs-page-action.ymlactions/upload-pages-artifactdocs-page-action.ymlactions/deploy-pagesdocs-page-action.ymldocker/setup-buildx-actione2e.yml,release.ymlastral-sh/setup-uvterminal-bench.ymlWhy it's needed
Picks up upstream bug fixes and security patches in the pinned actions, and keeps the SHA pins current.
Reviewer Test Plan
How to verify
CI is the verification surface — the workflows touched here run on PR (
ci.yml), on docs publish (docs-page-action.yml), in e2e (e2e.yml), and on release (release.yml). Confirm the relevant jobs stay green. Optionally runratchet check .github/workflows/*.ymlto confirm the annotations still resolve.Evidence (Before & After)
N/A — CI/infra only, no user-visible behavior.
Tested on
Environment (optional)
N/A — workflow metadata only.
Risk & Scope
codeql-actionandqwen-code-action(listed in the original description) are no longer part of this PR — CodeQL moved to its owncodeql.ymlonmainduring the conflict resolution, so those bumps were dropped.Linked Issues
None.
中文说明
这个 PR 做了什么
把一组第三方 GitHub Actions 升级到最新发布版本，每个 action 仍然 pin 到 commit SHA，并保留仓库的
# ratchet:owner/repo@<version>注释，让 ratchet 能继续追踪这些 pin。升级清单见上方表格。为什么需要
获取被 pin 的 action 上游的 bug 修复和安全补丁，并保持 SHA pin 最新。
验证方式
以 CI 为验证面 —— 改动涉及的 workflow 会在 PR（
ci.yml）、文档发布（docs-page-action.yml）、e2e（e2e.yml）和 release（release.yml）时运行，确认相关 job 保持绿色即可。也可运行ratchet check确认注释仍能解析。非用户可见改动，Evidence 为 N/A。风险与范围
codeql-action和qwen-code-action已不在本 PR 内 —— 冲突解决时 CodeQL 已在main上迁到独立的codeql.yml，这两个升级被去掉了。