chore: update GitHub actions in CI workflows

[0xwitty]

Updates actions/checkout@v4 to actions/checkout@v5 across CI workflows.
Upgrade to actions/checkout@v5 for improved performance and stability.

Reference:
Latest version: https://github.com/actions/checkout/releases/tag/v5.0.0

Summary by CodeRabbit

• Chores
  • Upgraded CI workflows to use the latest repository checkout action across linting, testing, building, artifact handling, general checks, mobile deploy, contracts, circuits, and npm publish pipelines.
  • Improves reliability, security, and compatibility of automated processes.
  • No user-facing feature changes or behavior adjustments.
  • No changes to public APIs or local development workflows.

[coderabbitai]

Walkthrough

All affected GitHub Actions workflows update actions/checkout from v4 to v5. No other steps, triggers, environments, or control flow were modified.

Changes

Cohort / File(s)	Change Summary
Workflows: checkout v4→v5 .github/workflows/app.yml, .github/workflows/artifacts.yml, .github/workflows/circuits.yml, .github/workflows/contracts.yml, .github/workflows/general-checks.yml, .github/workflows/mobile-deploy.yml, .github/workflows/npm-publish.yml	Replace all occurrences of uses: actions/checkout@v4 with uses: actions/checkout@v5. No other edits.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~6 minutes

Possibly related PRs

• Test/pipeline trigger demo #825 — Adjusts/removes checkout usage within a composite action, intersecting with this PR’s checkout version updates.
• Test/pipeline trigger demo #826 — Modifies conditions/usage of checkout steps in workflows, related to the checkout changes here.

Suggested labels

codex

Poem

A tap on the pipeline’s flow,
v4 bows out, v5 says hello.
No steps reshuffled, no logic awry—
Just newer shoes for the same old sky.
CI hums on, neat and spry. 🚀

Tip

🔌 Remote MCP (Model Context Protocol) integration is now available!

Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats.

✨ Finishing Touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (4)

.github/workflows/artifacts.yml (1)

23-23: Optional: Pin to commit SHA to mitigate action-supply-chain risks.

Consider pinning actions/checkout to a specific commit SHA and letting Dependabot manage updates. This is particularly worthwhile on self-hosted runners.

.github/workflows/npm-publish.yml (2)

116-116: Remove redundant second checkout in publish-common.

There are two consecutive checkout steps in the same job; the second is unnecessary and adds network time.

Apply this diff to drop the duplicate:

       - uses: actions/checkout@v5
-      - uses: actions/checkout@v5
       - name: Install Dependencies
         uses: ./.github/actions/yarn-install

---

21-21: Optional: Pin checkout@v5 to a commit SHA across all publish jobs.

Pinning improves reproducibility and protects against tag retargeting. I can generate a patch once you confirm the desired v5.x.y.

Also applies to: 50-50, 80-80, 110-110, 116-116

.github/workflows/contracts.yml (1)

29-29: Second checkout is likely redundant — remove unless you need a fresh working tree.

The job performs another checkout right after setup-node with no intervening changes that modify the workspace. Dropping it saves time and avoids rate limits.

Apply this diff:

       - name: Set Node.js 20.x
         uses: actions/setup-node@v4
         with:
           node-version: 20
-      - uses: actions/checkout@v5
       - name: Install Dependencies
         uses: ./.github/actions/yarn-install

📜 Review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between cb2ef91 and 047c9ae.

📒 Files selected for processing (7)

• .github/workflows/app.yml (3 hunks)
• .github/workflows/artifacts.yml (1 hunks)
• .github/workflows/circuits.yml (1 hunks)
• .github/workflows/contracts.yml (1 hunks)
• .github/workflows/general-checks.yml (3 hunks)
• .github/workflows/mobile-deploy.yml (2 hunks)
• .github/workflows/npm-publish.yml (4 hunks)

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2025-07-14T09:03:08.292Z

Learnt from: aaronmgdr
PR: selfxyz/self#763
File: app/.github/workflows/test-coverage.yml:0-0
Timestamp: 2025-07-14T09:03:08.292Z
Learning: Node.js 22 is supported by actions/setup-nodev4 and has been in Active LTS since October 2024. It works on Linux, macOS, and Windows runners (Windows issues were resolved after version 22.8.0).

Applied to files:

• .github/workflows/npm-publish.yml
• .github/workflows/contracts.yml

🔇 Additional comments (11)

.github/workflows/mobile-deploy.yml (2)

57-57: Upgrade to actions/checkout@v5 looks good.

No workflow logic change, just the action bump. Safe and aligns with the PR scope.

---

370-370: Upgrade to actions/checkout@v5 (Android job) is correct.

Consistent with the repo-wide update; no behavioral changes expected here.

.github/workflows/artifacts.yml (1)

23-23: Checkout bumped to v5 — LGTM.

Matches the PR intent; rest of the build remains unchanged.

.github/workflows/npm-publish.yml (4)

21-21: Detect-changes: checkout@v5 with fetch-depth=2 — good call.

Depth 2 is appropriate for HEAD^ comparisons used below.

---

50-50: publish-core: checkout@v5 — looks good.

---

80-80: publish-qrcode: checkout@v5 — looks good.

---

110-110: publish-common: first checkout@v5 — OK.

.github/workflows/contracts.yml (1)

23-23: First checkout@v5 — LGTM.

.github/workflows/general-checks.yml (3)

9-9: lint: checkout@v5 — good.

---

18-18: type-check: checkout@v5 — good.

---

27-27: test-common: checkout@v5 — good.

[coderabbitai]

💡 Verification agent

🧩 Analysis chain

All checkouts bumped to v5 — consider removing redundant checkout and pinning to SHA

The version bumps look good. A few optional cleanups:

• Build job has two checkout steps; if the second is not strictly needed post-Xcode, remove it to save time. If it is needed to reset the tree, add clean: true.
• Pin actions/checkout to the v5.0.0 commit SHA for supply-chain hardening.
• Add explicit job/workflow permissions (contents: read).
• If any step needs tags/long history (e.g., embedding git metadata), set fetch-depth: 0; otherwise keep shallow.

To remove the redundant checkout (if unnecessary):

-      - uses: actions/checkout@v5
       - name: Install Mobile Dependencies
         uses: ./.github/actions/mobile-setup

If you do need the second checkout, ensure a clean working tree:

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5
+        with:
+          clean: true
+          # fetch-depth: 0   # only if you need tags/history
+          persist-credentials: false

Outside the changed lines (job-level permissions example):

jobs:
  build:
    permissions:
      contents: read
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v5
      # ...

Pin to immutable commit SHA:

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@<v5.0.0_commit_sha>

Run this web query to pull the official v5.0.0 commit SHA and confirm any breaking changes:

Also applies to: 35-35, 48-48, 56-56

---

🌐 Web query:

Provide the commit SHA for actions/checkout v5.0.0 and list any noteworthy changes/deprecations from v4 to v5 relevant to typical CI (fetch-depth defaults, token handling, submodules behavior).

💡 Result:

• Commit SHA for actions/checkout v5.0.0 (full): 08c6903cd8c0fde910a37f88322edcfb5dd907a8. (github.com)

Noteworthy changes / deprecations (v4 → v5) relevant to typical CI

• What changed in v5

  • The action’s runtime was bumped (now built to run on Node.js 24). (github.com)
  • Minimum compatible runner version: v2.327.1 — make sure your self-hosted runners or runner image meet or exceed this. (github.com)

• Defaults that matter to CI (no behavioral change vs v4)

  • fetch-depth: default is still 1 (i.e., a shallow checkout of the single commit). If you need full history/tags set fetch-depth: 0. (github.com)
  • token / credentials (persist-credentials): token default remains ${{ github.token }} and persist-credentials default remains true (the action configures the token/SSH key into local git config by default). For security, many CI workflows explicitly set persist-credentials: false and restrict GitHub token permissions. (github.com)
  • submodules: behavior remains the same — submodules: false by default; you can set submodules: true or recursive; when no ssh-key is provided, [email protected]: URLs are converted to HTTPS. Private submodules still require appropriate credentials (PAT/SSH key) to be supplied. (github.com)

Summary / recommendation

• v5’s release is primarily a runtime bump and raises the minimum runner; it did not change the common defaults you rely on (fetch-depth, token persistence, submodules). If you rely on full history, private submodules, or want to avoid persisting credentials into .git/config for security, continue to explicitly set fetch-depth, submodules/ssh-key or token, and persist-credentials as you do today. (github.com)

If you want, I can:

• paste the exact README snippets that show the defaults from the v5 tag, or
• check whether any later patch (v5.x) changed defaults after v5.0.0.

Citations:

• 1: actions/checkout@08c6903
• 2: https://github.com/actions/checkout/releases/tag/v5.0.0
• 3: https://github.com/actions/checkout/releases/tag/v5.0.0
• 4: https://github.com/actions/checkout/tree/08c6903cd8c0fde910a37f88322edcfb5dd907a8
• 5: https://github.com/actions/checkout/tree/08c6903cd8c0fde910a37f88322edcfb5dd907a8
• 6: https://github.com/actions/checkout/tree/08c6903cd8c0fde910a37f88322edcfb5dd907a8
• 7: https://github.com/actions/checkout/releases/tag/v5.0.0

---

Action: Pin checkout to v5 SHA, remove or clean redundant checkout, and add job permissions

Verified v5.0.0 commit SHA: 08c6903cd8c0fde910a37f88322edcfb5dd907a8. v5 is a runtime bump (Node.js 24) and requires runner >= v2.327.1; defaults (fetch-depth=1, persist-credentials=true, submodules=false) are unchanged.

Files/locations:

• .github/workflows/app.yml — lines: 22, 35, 48, 56

Suggested changes (apply to each checkout use-site):

If the second checkout is redundant — remove it:

-      - uses: actions/checkout@v5
       - name: Install Mobile Dependencies
         uses: ./.github/actions/mobile-setup

If you need the second checkout to reset the tree — pin and ensure a clean working tree:

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        with:
+          clean: true
+          persist-credentials: false
+          # fetch-depth: 0   # enable only if you need full history/tags

Pin all checkouts to the immutable commit SHA:

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8

Add job-level permissions (example):

jobs:
  build:
    permissions:
      contents: read
    runs-on: macos-14
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
      # ...

Notes:

• Keep fetch-depth: 0 only if you truly need history/tags (CI speed/security tradeoff).
• persist-credentials: false is recommended to avoid exposing the token in .git/config.
• If you use private submodules or need tags/history, ensure credentials and fetch-depth are set appropriately.
• Verify runner images/self-hosted runners meet minimum v2.327.1.

[coderabbitai]

💡 Verification agent

🧩 Analysis chain

Checkout upgraded to v5 — looks good; consider pin-to-SHA and least-privilege perms

Nice, straightforward bump to actions/checkout@v5.

• Security: Consider pinning to the v5.0.0 commit SHA instead of the moving major tag.
• Least privilege: Add explicit permissions to the job/workflow (contents: read).
• If you rely on tags/longer history (e.g., versioning), set fetch-depth: 0; otherwise keep shallow for speed.

Apply if desired:

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5
+        with:
+          # Set to 0 only if tags/history are needed for your steps
+          # fetch-depth: 0
+          persist-credentials: false

Outside this line (job-level permissions):

jobs:
  run_circuit_tests:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    # ...

To safely pin to the immutable commit for v5.0.0, fetch the official SHA and replace the tag:

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@<v5.0.0_commit_sha>

Run this web query to retrieve the official v5.0.0 commit SHA from GitHub:

---

🌐 Web query:

What is the official commit SHA for actions/checkout v5.0.0, and are there any breaking changes or deprecations compared to v4?

💡 Result:

The official commit SHA for actions/checkout v5.0.0 is 08c6903b48a2e7e2c3c2be1663d5936ae65f3b8f[5].
You can reference v5.0.0 in your workflow as:

uses: actions/checkout@08c6903b48a2e7e2c3c2be1663d5936ae65f3b8f

or simply with the semver tag:

uses: actions/checkout@v5

which currently resolves to v5.0.0.

---

Breaking changes and deprecations from v4 to v5:

As of August 2025, the official documentation and changelog for v5 are not widely indexed. However, based on available documentation and usage notes[10][5][6]:

• No critical breaking changes are explicitly documented in the indexed sources as of this date. Usage examples, core options, and default behaviors (such as fetch-depth, submodule handling, and authentication) remain consistent between v4 and v5[10][6].
• All existing parameters from v4 (e.g., ref, token, fetch-depth, lfs, submodules, set-safe-directory, and persist-credentials) continue to be supported in v5, with the same default values and behaviors[6][10].
• Use of the full commit SHA for action references is required: GitHub Actions no longer supports short SHAs for referencing actions, a security measure in place since 2021[3]. Always use tags (like v5) or the full SHA[3].
• Authentication and permissions recommendations: There are no changes from v4; using a GITHUB_TOKEN or a personal access token (PAT) is still the required method for push operations[4][10].
• No new major features, removals, or input deprecations have been announced via the official repo or Spacelift documentation as of mid-2025[6][10].

Suggested Actions If Migrating from v4:

• Review your workflow file to ensure you are not referencing the action using a short SHA[3].
• No other action should be required unless you rely on unindexed, unofficial, or breaking changes not covered in the official migration notes.

If you require authoritative confirmation of breaking changes for enterprise/compliance use, consult the actions/checkout repository release notes directly for any updates after v5.0.0, as there may be future revisions or clarifications not reflected in currently indexed resources.

Citations:

• 1: Unexpected Results from Checkout for the Commit Hash actions/checkout#198
• 2: https://github.com/actions/github-script
• 3: https://github.blog/changelog/2021-01-21-github-actions-short-sha-deprecation/
• 4: https://github.com/stefanzweifel/git-auto-commit-action
• 5: https://github.com/actions/checkout/actions/runs/16880287745
• 6: https://spacelift.io/blog/github-actions-checkout
• 7: https://github.com/marketplace/actions/commit-hash
• 8: https://github.com/marketplace/actions/github-script
• 9: https://schnerring.net/blog/checking-out-code-committed-within-the-same-github-actions-workflow-run/
• 10: https://github.com/actions/checkout

---

Fix: pin actions/checkout@v5, restrict permissions, and avoid persisting credentials

I checked: actions/checkout v5.0.0 SHA is 08c6903b48a2e7e2c3c2be1663d5936ae65f3b8f, and there are no documented breaking changes vs v4. Apply the small hardening changes below.

Files to update

• .github/workflows/circuits.yml — checkout step (around line 25)
• .github/workflows/circuits.yml — job-level permissions for the workflow job that runs the circuit tests

Replace checkout step (pin to immutable SHA, disable credential persistence; keep fetch-depth shallow unless you need tags/history):

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903b48a2e7e2c3c2be1663d5936ae65f3b8f
+        with:
+          # Set to 0 only if tags/history are needed for your steps
+          # fetch-depth: 0
+          persist-credentials: false

Add least-privilege permissions at job (or workflow) level — example for the job named run_circuit_tests:

jobs:
  run_circuit_tests:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    # ...

Reasoning (short): pinning to the full SHA prevents unexpected changes if the tag is moved; setting persist-credentials: false avoids leaking GITHUB_TOKEN to third-party actions; restricting contents: read applies least privilege for checkout-only workflows.

🤖 Prompt for AI Agents

In .github/workflows/circuits.yml around line 25, the checkout step should be
hardened and the job should be given least-privilege permissions: pin
actions/checkout to the immutable commit SHA noted (v5.0.0 SHA
08c6903b48a2e7e2c3c2be1663d5936ae65f3b8f), set persist-credentials: false to
avoid leaking GITHUB_TOKEN, and keep fetch-depth shallow unless deeper
history/tags are required; also add job-level permissions for the
run_circuit_tests job (permissions: contents: read) so the workflow only has
read access to the repository contents.

[coderabbitai]

💡 Verification agent

🧩 Analysis chain

Optional: Pin checkout to a commit SHA for supply-chain hardening.

To prevent tag-hijacking and ensure reproducible CI, consider pinning actions/checkout to its commit SHA (and optionally keep a comment with the human-friendly version). I can provide an automated script to fetch the right SHA across all workflows.

Run to see current v5 SHA and all occurrences:

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "actions/checkout@v5 current tag SHA:"
git ls-remote https://github.com/actions/checkout refs/tags/v5 | awk '{print $1"  refs/tags/v5"}'

echo
echo "Occurrences of checkout@v5 in workflows:"
rg -nP -C2 --type=yaml 'uses:\s*actions/checkout@v5' .github/workflows

Length of output: 6249

---

Pin actions/checkout@v5 to a commit SHA (supply-chain hardening)

Resolved v5 tag SHA: 08c6903cd8c0fde910a37f88322edcfb5dd907a8 — replace all uses of actions/checkout@v5 with the pinned SHA.

Files/locations to update:

• .github/workflows/mobile-deploy.yml — line 57 (also line 370)
• .github/workflows/npm-publish.yml — lines 21, 50, 80, 110, 116
• .github/workflows/contracts.yml — lines 23, 29
• .github/workflows/circuits.yml — line 25
• .github/workflows/general-checks.yml — lines 9, 18, 27
• .github/workflows/artifacts.yml — line 23
• .github/workflows/app.yml — lines 22, 35, 48, 56

Suggested replacement (apply in each location):

•  - uses: actions/checkout@v5
  

•  - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # pinned to actions/checkout v5
  

If you want, I can open a PR or provide a short script to update all workflow files automatically.

🤖 Prompt for AI Agents

.github/workflows/mobile-deploy.yml around lines 57 and 370: replace the
unpinned usage "actions/checkout@v5" with the resolved v5 commit SHA by changing
the step to use "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8"
(apply the same pinned SHA replacement to all other workflow files/lines listed
in the review to harden the supply chain).

[transphorm]

@0xwitty thanks for opening this pull request. can you please re-create and open against the dev branch? thank you!