ci: bump third-party action versions across workflows + SHA-pin pr-checks.yml - #69
Merged
Merged
Conversation
…ecks.yml Sweep of currently-pinned third-party action SHAs to latest stable releases past the 3-day buffer, plus SHA-pin three tag-pinned references in pr-checks.yml that were carrying supply-chain risk. Bumps applied: - **actions/checkout**: v4.3.1 → v6.0.2 (mirror of HarperFast/harper#461). v5.0.0 was the Node 20 → Node 24 jump; v6.0.2 (2026-01-09) is the latest stable, ~4 months baked. 11 instances across: - auth-gate-invariants.yml (1) - claude-issue-to-pr.yml (3) - claude-mention.yml (3) - claude-review.yml (4) - **actions/setup-node**: v6.2.0 → v6.4.0 (2026-04-20, 14 days old). Minor version. 3 instances in claude-issue-to-pr.yml, claude-mention.yml, release.yml. - **anthropics/claude-code-action**: v1.0.99 → v1.0.110 (2026-04-29, 5 days old). Patch range; v1.0.111 (2026-05-01) is at the buffer edge so conservatively held back. claude-issue- to-pr.yml, claude-mention.yml, claude-review.yml. SHA pins added to pr-checks.yml (was tag-pinned, supply-chain risk): - `actions/checkout@v4` → @de0fac2e... # v6.0.2 - `actions/setup-node@v4` → @48b55a01... # v6.4.0 - `oven-sh/setup-bun@v2` → @0c5077e5... # v2.2.0 Note: actions/setup-node went v4 → v6 in pr-checks.yml. v5 was the Node 20 → Node 24 jump; v6 minor releases since. Backwards- compatible for typical setup-node usage. Skipped (already current past buffer): - actions/create-github-app-token v3.1.1 (2026-04-11) - oven-sh/setup-bun v2.2.0 (2026-03-14, 51 days old) Verified locally: - All affected workflows parse as valid YAML. - `validate-auth-gate-invariants.sh` passes against all three claude-*.yml workflows. Continues parallel to harper#464. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
|
Reviewed; no blockers found. |
heskew
added a commit
that referenced
this pull request
Jun 26, 2026
…on + log-count fix) (#135) Moves the claude-review (was 9eb635a, week-of-06-08) and gemini-review (was 48e539a, post-#66) callers up to ai-review-prompts main 1bbc562: - #67 — week-of-06-15 calibration: "error/abort paths that crash or leak" Robustness rule; "explicitly-throwaway / empty-diff PRs" ignore; the mechanical-diff ignore narrowed to inert CI-config with a workflow- security carve-out. - #69 — log-review finding-count fix: a finding-bearing review is no longer logged to ai-review-log as "no blockers" when the count is spelled out or inline-only (ai-review-log #683). uses: and ai-review-prompts-ref: move in lockstep. Part of the harper / harper-pro / oauth rollout of this batch. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
heskew
added a commit
that referenced
this pull request
Jun 29, 2026
…t-ref tracking #71) (#136) * chore(ci): bump ai-review-prompts to 67d7611 (prompt-ref tracking) Forward bump 1bbc562 -> 67d7611 (ai-review-prompts #71): the log step now records which prompt version produced each ai-review-log entry — a `**Prompt ref:**` body field plus a `prompt:<shortsha>` label — so calibration can attribute verdicts to a specific prompt version instead of a date bucket. No prompt-content change vs 1bbc562 (which already carried the #67 calibration + #69 log-count fix); this turns on per-version tracking. `uses:` and `ai-review-prompts-ref:` move in lockstep. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(ci): re-point bump to 9cf49d2 (add #70 week-of-06-22 calibration) #70 (week-of-06-22 calibration) merged after this bump was opened, so re-point 67d7611 -> 9cf49d2 to land the calibration AND the #71 prompt-ref tracking together in a single bump rather than forcing a second one. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two things in one PR — they're both "all third-party actions on this repo to current SHA-pinned versions past the 3-day buffer":
Bumps
SHA pins (pr-checks.yml)
`actions/setup-node` went `v4 → v6` in pr-checks.yml. v5 was the Node 20 → Node 24 jump; v6 minor releases since. Backwards-compatible for typical setup-node usage.
Held back
Verified locally
Test plan
🤖 Generated with Claude Code