Update GitHub Action references - #658
Conversation
Every woocommerce/grow reference now pins the actions-v3.0.6 release build. The references were split across two builds: the actions with nested remote action references pinned actions-v3.0.5, and the rest still pinned the actions-v3.0.4 build under a comment that named the moving actions-v3 tag. The actions-v3.0.6 build also resolves sibling actions through the self repository syntax, so publish-extension-dev-build no longer calls get-release-notes from the previous release.
The SHAs are unchanged. The comments named only a major tag, which moves, while the SHA is frozen at one release. Naming the exact release makes it possible to tell how far a pin lags upstream without resolving the SHA. actions/checkout v6 -> v6.1.0 actions/upload-artifact v7 -> v7.0.1 actions/github-script v9 -> v9.0.0
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (10)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates GitHub Actions workflow references to use a single pinned woocommerce/grow release build (actions-v3.0.6) and replaces moving-tag comments (e.g., # v6) with exact release annotations (e.g., # v6.1.0) while keeping the pinned SHAs unchanged.
Changes:
- Standardize all
woocommerce/grow/*workflow action usages to theactions-v3.0.6build SHA. - Update trailing comments for pinned third-party actions to name the exact upstream release tag (with patch version).
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/prepare-release.yml | Updates actions/checkout comment to v6.1.0 and pins woocommerce/grow/prepare-extension-release to actions-v3.0.6. |
| .github/workflows/prepare-release-via-deploy.yml | Updates actions/checkout to # v6.1.0 and actions/github-script to # v9.0.0 (SHA unchanged). |
| .github/workflows/php-unit-tests.yml | Moves woocommerce/grow action references (releases, PHP, MySQL) to actions-v3.0.6 and updates actions/checkout comment. |
| .github/workflows/php-hook-documentation.yml | Pins woocommerce/grow/hook-documentation to actions-v3.0.6 and updates actions/checkout comment. |
| .github/workflows/php-coding-standards.yml | Pins woocommerce/grow/prepare-php to actions-v3.0.6 and updates actions/checkout comment. |
| .github/workflows/js-linting.yml | Pins woocommerce/grow/prepare-node and eslint-annotation to actions-v3.0.6 and updates actions/checkout comment. |
| .github/workflows/e2e-tests.yml | Pins woocommerce/grow actions to actions-v3.0.6, updates actions/checkout comment, and annotates upload-artifact as v7.0.1. |
| .github/workflows/deploy.yml | Updates actions/checkout comment to v6.1.0 for the private action checkout step. |
| .github/workflows/build.yml | Pins woocommerce/grow actions to actions-v3.0.6, updates actions/checkout comment, and annotates upload-artifact as v7.0.1. |
| .github/workflows/branch-labels.yml | Pins woocommerce/grow/branch-label to the actions-v3.0.6 build SHA. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Changes proposed in this Pull Request:
Follow-up to the recent SHA pinning PRs. Two changes, one commit each.
Move every
woocommerce/growreference to theactions-v3.0.6release build. The references were split across two builds. The actions with nested remote action references pinnedactions-v3.0.5, while the rest still pinned theactions-v3.0.4build under a comment that named the movingactions-v3tag. Inactions-v3.0.6, sibling actions resolve through the self repository syntax ($/), sopublish-extension-dev-buildno longer callsget-release-notesfrom the previous release. Every reference now points at one build, with a comment that names it.Name the exact release in the comments beside the third-party SHAs. The SHAs are unchanged. A comment like
# v6names a tag that moves, while the SHA is frozen at one release. Naming the exact release (# v6.1.0) makes it possible to tell how far a pin lags upstream without resolving the SHA, and matches how theactions-v3.0.6build annotates its own pins.Changelog entry