Carlos Florêncio
52 lines
2.9 KiB
Markdown
52 lines
2.9 KiB
Markdown
---
|
|
id: "02-container-workflows"
|
|
title: "Upgrade Node-20 docker actions in container workflows"
|
|
status: done
|
|
wave: 1
|
|
depends_on: []
|
|
plan: "plan.md"
|
|
---
|
|
|
|
# Task 02: Upgrade Node-20 docker actions in container workflows
|
|
|
|
- **Acceptance:** every `uses:` pin in `universal-rebuild.yml` and `ci-base-image.yml` runs on Node 24; the docker v3/v6 pins (login, setup-buildx, build-push) move to the v4/v7 lines with Node 24 runtime.
|
|
- **Verification:**
|
|
- `python3 .github/scripts/lint-action-pinning.py`
|
|
- runtime audit per `audit.md` for the two files
|
|
- `python3 -c "import yaml,sys; [yaml.safe_load(open(f)) for f in sys.argv[1:]]" .github/workflows/universal-rebuild.yml .github/workflows/ci-base-image.yml`
|
|
- **Files likely touched:**
|
|
- `.github/workflows/universal-rebuild.yml` (setup-buildx:55 → v4.2.0; login:58 → v4.6.0; build-push:69 → v7.3.0)
|
|
- `.github/workflows/ci-base-image.yml` (setup-buildx:40 → v4.2.0; login:51 → v4.6.0; build-push:102,120 → v7.3.0)
|
|
- **Dependencies:** None.
|
|
- **Parallelism:** sequential by default; parallel-safe if run alongside tasks 01, 03, 04 (all files disjoint).
|
|
|
|
## Changes
|
|
|
|
| File:line | From | To |
|
|
|---|---|---|
|
|
| universal-rebuild.yml:55 | `docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3` | `docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0` |
|
|
| universal-rebuild.yml:58 | `docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3` | `docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0` |
|
|
| universal-rebuild.yml:69 | `docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6` | `docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0` |
|
|
| ci-base-image.yml:40 | `docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3` | `docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0` |
|
|
| ci-base-image.yml:51 | `docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3` | `docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0` |
|
|
| ci-base-image.yml:102,120 | `docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6` | `docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0` |
|
|
|
|
Line numbers are 2026-08-07 snapshots; match by `uses:` string if they moved.
|
|
Do not change `with:` blocks — none use inputs removed by docker v4/v7
|
|
(deprecated buildx inputs, `DOCKER_BUILD_NO_SUMMARY`).
|
|
|
|
## Inputs
|
|
|
|
plan.md target table + docker compatibility notes; `audit.md`.
|
|
|
|
## Output contract
|
|
|
|
Summary, files changed, exact commands and outcomes, audit output for the two files, task/plan status updates.
|
|
|
|
## Results
|
|
|
|
- Applied 2 setup-buildx, 2 login-action, 3 build-push replacements across universal-rebuild.yml / ci-base-image.yml.
|
|
- `python3 .github/scripts/lint-action-pinning.py` → all 18 workflows SHA-pinned.
|
|
- Runtime audit: all pins in the two files `node24`, zero `node20`.
|
|
- YAML parse OK; `git diff --check` clean. None.
|