From 85ee28f0b1c9072dc92b5ece3c8baa1d8fafd9b8 Mon Sep 17 00:00:00 2001 From: Nathan Heskew Date: Mon, 4 May 2026 09:21:08 -0700 Subject: [PATCH] ci: bump third-party action versions across workflows + SHA-pin pr-checks.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sweep of currently-pinned third-party action SHAs to latest stable releases past the 3-day buffer, plus SHA-pin three tag-pinned references in pr-checks.yml that were carrying supply-chain risk. Bumps applied: - **actions/checkout**: v4.3.1 → v6.0.2 (mirror of HarperFast/harper#461). v5.0.0 was the Node 20 → Node 24 jump; v6.0.2 (2026-01-09) is the latest stable, ~4 months baked. 11 instances across: - auth-gate-invariants.yml (1) - claude-issue-to-pr.yml (3) - claude-mention.yml (3) - claude-review.yml (4) - **actions/setup-node**: v6.2.0 → v6.4.0 (2026-04-20, 14 days old). Minor version. 3 instances in claude-issue-to-pr.yml, claude-mention.yml, release.yml. - **anthropics/claude-code-action**: v1.0.99 → v1.0.110 (2026-04-29, 5 days old). Patch range; v1.0.111 (2026-05-01) is at the buffer edge so conservatively held back. claude-issue- to-pr.yml, claude-mention.yml, claude-review.yml. SHA pins added to pr-checks.yml (was tag-pinned, supply-chain risk): - `actions/checkout@v4` → @de0fac2e... # v6.0.2 - `actions/setup-node@v4` → @48b55a01... # v6.4.0 - `oven-sh/setup-bun@v2` → @0c5077e5... # v2.2.0 Note: actions/setup-node went v4 → v6 in pr-checks.yml. v5 was the Node 20 → Node 24 jump; v6 minor releases since. Backwards- compatible for typical setup-node usage. Skipped (already current past buffer): - actions/create-github-app-token v3.1.1 (2026-04-11) - oven-sh/setup-bun v2.2.0 (2026-03-14, 51 days old) Verified locally: - All affected workflows parse as valid YAML. - `validate-auth-gate-invariants.sh` passes against all three claude-*.yml workflows. Continues parallel to harper#464. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/auth-gate-invariants.yml | 2 +- .github/workflows/claude-issue-to-pr.yml | 10 +++++----- .github/workflows/claude-mention.yml | 10 +++++----- .github/workflows/claude-review.yml | 10 +++++----- .github/workflows/pr-checks.yml | 8 ++++---- .github/workflows/release.yml | 2 +- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/auth-gate-invariants.yml b/.github/workflows/auth-gate-invariants.yml index 77d0b8b..9ba9920 100644 --- a/.github/workflows/auth-gate-invariants.yml +++ b/.github/workflows/auth-gate-invariants.yml @@ -30,7 +30,7 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Validate auth gate structure run: bash .github/scripts/validate-auth-gate-invariants.sh diff --git a/.github/workflows/claude-issue-to-pr.yml b/.github/workflows/claude-issue-to-pr.yml index 5f4400c..2a548dc 100644 --- a/.github/workflows/claude-issue-to-pr.yml +++ b/.github/workflows/claude-issue-to-pr.yml @@ -60,7 +60,7 @@ jobs: owner: HarperFast - name: Checkout (for CODEOWNERS read) - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: sparse-checkout: | .github/CODEOWNERS @@ -93,20 +93,20 @@ jobs: # a shallow clone; `git log` / `git blame` aren't reached for by # the current prompt. Bump to a deeper fetch only if we see the # agent blocked on history lookups. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Clone shared Harper skills # Pinned to a SHA (not `main`) so agent behavior is reproducible # across runs — updates to the skills repo require an explicit # pin bump in this workflow. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: HarperFast/skills ref: d2db99bb37a6dde868cbc5ac81ca4146be8956fb # 1.3.0 (2026-04-16) path: .harper-skills - name: Setup Node.js - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '22' cache: 'npm' @@ -121,7 +121,7 @@ jobs: - name: Claude (agent mode) id: claude-agent - uses: anthropics/claude-code-action@c3d45e8e941e1b2ad7b278c57482d9c5bf1f35b3 # v1.0.99 + uses: anthropics/claude-code-action@ef50f123a3a9be95b60040d042717517407c7256 # v1.0.110 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} show_full_output: true diff --git a/.github/workflows/claude-mention.yml b/.github/workflows/claude-mention.yml index 24cf8ef..9fee7d0 100644 --- a/.github/workflows/claude-mention.yml +++ b/.github/workflows/claude-mention.yml @@ -57,7 +57,7 @@ jobs: owner: HarperFast - name: Checkout (for CODEOWNERS read) - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: sparse-checkout: | .github/CODEOWNERS @@ -94,7 +94,7 @@ jobs: # a shallow clone; `git log` / `git blame` aren't reached for by # the current prompt. Bump to a deeper fetch only if we see the # agent blocked on history lookups. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Parse mention # Real precision gate (the job-level `if:` is a cheap pre-filter). @@ -115,7 +115,7 @@ jobs: # across runs — updates to the skills repo require an explicit # pin bump in this workflow. if: steps.mention.outputs.proceed == 'true' - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: HarperFast/skills ref: d2db99bb37a6dde868cbc5ac81ca4146be8956fb # 1.3.0 (2026-04-16) @@ -129,7 +129,7 @@ jobs: # prompt tells the agent to run `npm ci` itself before any script # that needs dependencies. if: steps.mention.outputs.proceed == 'true' - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '22' cache: 'npm' @@ -143,7 +143,7 @@ jobs: - name: Claude (agent mode) if: steps.mention.outputs.proceed == 'true' id: claude-agent - uses: anthropics/claude-code-action@c3d45e8e941e1b2ad7b278c57482d9c5bf1f35b3 # v1.0.99 + uses: anthropics/claude-code-action@ef50f123a3a9be95b60040d042717517407c7256 # v1.0.110 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} show_full_output: true diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index abe78b3..be57770 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -61,7 +61,7 @@ jobs: owner: HarperFast - name: Checkout (for CODEOWNERS read) - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: sparse-checkout: | .github/CODEOWNERS @@ -110,7 +110,7 @@ jobs: # Paired with a tightly-scoped `Bash(git :*)` allowlist # below (no `Bash(git:*)` — that would allow `git push --force`, # `git reset --hard`, etc.). - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 @@ -118,7 +118,7 @@ jobs: # Pinned to a specific SHA (not `main`) so review behavior is # reproducible across runs — updates to the skills repo require # an explicit pin bump here. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: HarperFast/skills ref: d2db99bb37a6dde868cbc5ac81ca4146be8956fb # 1.3.0 (2026-04-16) @@ -127,7 +127,7 @@ jobs: - name: Clone review prompts # Layer files live in HarperFast/ai-review-prompts (public). # Pinned to a merge SHA — bump this deliberately to adopt updates. - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: HarperFast/ai-review-prompts ref: 14c79a1c36565c764b68d3641c32bdadfc4d0512 # main 2026-04-30 (incl. concise-PR + within-PR-memory) @@ -148,7 +148,7 @@ jobs: - name: Claude review id: claude-review - uses: anthropics/claude-code-action@c3d45e8e941e1b2ad7b278c57482d9c5bf1f35b3 # v1.0.99 + uses: anthropics/claude-code-action@ef50f123a3a9be95b60040d042717517407c7256 # v1.0.110 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # Admit the issue-to-PR bot's PRs. Job-level `if:` gate above lets diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 8ca8955..f3ccc51 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -17,10 +17,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node-version }} cache: 'npm' @@ -49,10 +49,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f3808ab..4c416c2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,7 +18,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Node.js - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '22' registry-url: 'https://registry.npmjs.org'