Carlos Florêncio
65 lines
4.4 KiB
Markdown
65 lines
4.4 KiB
Markdown
---
|
||
id: "01-test-workflows"
|
||
title: "Upgrade Node-20 actions in test workflows"
|
||
status: done
|
||
wave: 1
|
||
depends_on: []
|
||
plan: "plan.md"
|
||
---
|
||
|
||
# Task 01: Upgrade Node-20 actions in test workflows
|
||
|
||
- **Acceptance:** every `uses:` pin in `backend-tests.yml`, `frontend-tests.yml`, `cargo-audit.yml`, and `e2e-tests.yml` that previously ran on Node 20 now pins a commit whose `action.yml` declares `runs.using: node24`; the pinning lint and contract tests still pass.
|
||
- **Verification:**
|
||
- `python3 .github/scripts/lint-action-pinning.py`
|
||
- `python3 .github/scripts/lint-action-pinning_test.py`
|
||
- `python3 .github/scripts/release-workflow-contract_test.py` (unchanged assertions still pass)
|
||
- runtime audit for the four files per `audit.md` (all `runs.using` = node24/composite)
|
||
- `python3 -c "import yaml,sys; [yaml.safe_load(open(f)) for f in sys.argv[1:]]" .github/workflows/backend-tests.yml .github/workflows/frontend-tests.yml .github/workflows/cargo-audit.yml .github/workflows/e2e-tests.yml`
|
||
- **Files likely touched:**
|
||
- `.github/workflows/backend-tests.yml` (cache:73,176 → v6.1.0; go-test-action:240 → v1.1.0; upload-artifact:247 → v7.0.1)
|
||
- `.github/workflows/frontend-tests.yml` (cache:73 → v6.1.0)
|
||
- `.github/workflows/cargo-audit.yml` (cache:53 → v6.1.0)
|
||
- `.github/workflows/e2e-tests.yml` (cache:67,165,273,480 → v6.1.0; upload-artifact:96,103,114,211,219,384,392,509 → v7.0.1; download-artifact:176,185,191,345,354,360,491 → v8.0.1; login-action:288 → v4.6.0)
|
||
- **Dependencies:** None.
|
||
- **Parallelism:** sequential by default; parallel-safe if run alongside tasks 02–04 (all files disjoint).
|
||
|
||
## Changes
|
||
|
||
Replace each listed `uses:` line with the target SHA, keeping the `# vX` version comment accurate:
|
||
|
||
| File:line | From | To |
|
||
|---|---|---|
|
||
| backend-tests.yml:73,176 | `actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4` | `actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0` |
|
||
| backend-tests.yml:240 | `robherley/go-test-action@3856e4e57831b3b6d6d8d89f91747e5200c533f7 # v0` | `robherley/go-test-action@2f859e0c8769d755d3174eecb9af8f64660827f3 # v1.1.0` |
|
||
| backend-tests.yml:247 | `actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5` | `actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1` |
|
||
| frontend-tests.yml:73 | `actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4` | `actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0` |
|
||
| cargo-audit.yml:53 | `actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4` | `actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0` |
|
||
| e2e-tests.yml:67,165,273,480 | `actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4` | `actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0` |
|
||
| e2e-tests.yml:96,103,114,211,219,384,392,509 | `actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5` | `actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1` |
|
||
| e2e-tests.yml:176,185,191,345,354,360,491 | `actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5` | `actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1` |
|
||
| e2e-tests.yml:288 | `docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3` | `docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0` |
|
||
|
||
Line numbers are 2026-08-07 snapshots; if a line moved, match by the `uses:`
|
||
string instead of the number.
|
||
|
||
Do not touch `e2e-tests.yml` checkout (already v6 `df4cb1c…`).
|
||
|
||
## Inputs
|
||
|
||
plan.md target table + compatibility notes; `audit.md` for the runtime check.
|
||
|
||
## Output contract
|
||
|
||
Summary, files changed, exact commands run and outcomes, final audit output for the four files, task/plan status updates.
|
||
|
||
## Results
|
||
|
||
- Applied 8 cache, 1 go-test-action, 9 upload-artifact, 7 download-artifact, 1 login-action replacements across backend-tests.yml / frontend-tests.yml / cargo-audit.yml / e2e-tests.yml (match-by-`uses:` verified).
|
||
- `python3 .github/scripts/lint-action-pinning.py` → "✓ All 18 workflow file(s) use SHA-pinned action refs."
|
||
- `python3 .github/scripts/lint-action-pinning_test.py` → 9 tests OK.
|
||
- `python3 .github/scripts/release-workflow-contract_test.py` → 24 tests OK (unchanged pins still asserted).
|
||
- Runtime audit (audit_final.py): every pin in the four files `node24`/`composite`, zero `node20`.
|
||
- YAML parse of all 18 workflows OK; `git diff --check` clean.
|
||
- No security/trust or external side-effect boundaries beyond publishing new action pins to CI.
|