Carlos Florêncio
3.8 KiB
3.8 KiB
id, title, status, wave, depends_on, plan
| id | title | status | wave | depends_on | plan |
|---|---|---|---|---|---|
| 03-release-workflow | Upgrade Node-20 actions in release.yml | done | 1 | plan.md |
Task 03: Upgrade Node-20 actions in release.yml
- Acceptance: every
uses:pin inrelease.ymlruns on Node 24; the release workflow contract test still passes. - Verification:
python3 .github/scripts/lint-action-pinning.pypython3 .github/scripts/release-workflow-contract_test.py- runtime audit per
audit.mdfor release.yml python3 -c "import yaml,sys; [yaml.safe_load(open(f)) for f in sys.argv[1:]]" .github/workflows/release.yml
- Files likely touched:
.github/workflows/release.ymlonly. - Dependencies: None.
- Parallelism: sequential by default; parallel-safe if run alongside tasks 01, 02, 04 (all files disjoint).
Changes
| File:line | From | To |
|---|---|---|
| release.yml:103,612,677,741,877,1412,1621,1803,1975,2017,2070 | actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 |
unchanged (already node24) |
| release.yml:1491,1681 | actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 |
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 |
| release.yml:697,826,1253,1380 | actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 |
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
| release.yml:1416,1495 | actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 |
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| release.yml:749,959,1873,1879,2037 | actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5 |
actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| release.yml:1433,1510,1569,1688,1743 | docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 |
docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 |
| release.yml:1430,1507,1566,1625,1685,1740 | docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 |
docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 |
| release.yml:1452,1524,1642,1696 | docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 |
docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 |
| release.yml:1446,1518,1557,1636 | docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 |
docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 |
| release.yml:1940 | softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 |
softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 |
Line numbers are 2026-08-07 snapshots; match by uses: string if they moved.
The # v6 checkout rows are listed for completeness — they are already
node24 and require no edit. Do not change with: blocks; inputs used
(files:, body_path:, tag_name:, tags: type=raw,…) are all preserved
in the target versions. The contract test pins
crazy-max/ghaction-import-gpg@2dc316d… and actions/setup-node@48b55a0… —
both unchanged.
Inputs
plan.md target table + compatibility notes; audit.md.
Output contract
Summary, files changed, exact commands and outcomes, audit output for release.yml, task/plan status updates.
Results
- Applied 2 checkout v4→v6, 4 upload-artifact v5→v7.0.1, 7 download-artifact v4/v5→v8.0.1, 6 login v3→v4.6.0, 6 buildx v3→v4.2.0, 4 build-push v6→v7.3.0, 5 metadata v5→v6.2.0, 1 gh-release v2→v3.0.2 in release.yml (35 uses total).
python3 .github/scripts/lint-action-pinning.py→ all SHA-pinned.python3 .github/scripts/release-workflow-contract_test.py→ 24 tests OK.- Runtime audit: all pins
node24, zeronode20; YAML parse OK;git diff --checkclean. with:blocks untouched (files/body_path/tag_name/tags inputs all preserved in targets). None.