Carlos Florêncio
2.9 KiB
2.9 KiB
id, title, status, wave, depends_on, plan
| id | title | status | wave | depends_on | plan |
|---|---|---|---|---|---|
| 02-container-workflows | Upgrade Node-20 docker actions in container workflows | done | 1 | plan.md |
Task 02: Upgrade Node-20 docker actions in container workflows
- Acceptance: every
uses:pin inuniversal-rebuild.ymlandci-base-image.ymlruns on Node 24; the docker v3/v6 pins (login, setup-buildx, build-push) move to the v4/v7 lines with Node 24 runtime. - Verification:
python3 .github/scripts/lint-action-pinning.py- runtime audit per
audit.mdfor the two files python3 -c "import yaml,sys; [yaml.safe_load(open(f)) for f in sys.argv[1:]]" .github/workflows/universal-rebuild.yml .github/workflows/ci-base-image.yml
- Files likely touched:
.github/workflows/universal-rebuild.yml(setup-buildx:55 → v4.2.0; login:58 → v4.6.0; build-push:69 → v7.3.0).github/workflows/ci-base-image.yml(setup-buildx:40 → v4.2.0; login:51 → v4.6.0; build-push:102,120 → v7.3.0)
- Dependencies: None.
- Parallelism: sequential by default; parallel-safe if run alongside tasks 01, 03, 04 (all files disjoint).
Changes
| File:line | From | To |
|---|---|---|
| universal-rebuild.yml:55 | docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 |
docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 |
| universal-rebuild.yml:58 | docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 |
docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 |
| universal-rebuild.yml:69 | docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 |
docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 |
| ci-base-image.yml:40 | docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 |
docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 |
| ci-base-image.yml:51 | docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 |
docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 |
| ci-base-image.yml:102,120 | docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 |
docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 |
Line numbers are 2026-08-07 snapshots; match by uses: string if they moved.
Do not change with: blocks — none use inputs removed by docker v4/v7
(deprecated buildx inputs, DOCKER_BUILD_NO_SUMMARY).
Inputs
plan.md target table + docker compatibility notes; audit.md.
Output contract
Summary, files changed, exact commands and outcomes, audit output for the two files, task/plan status updates.
Results
- Applied 2 setup-buildx, 2 login-action, 3 build-push replacements across universal-rebuild.yml / ci-base-image.yml.
python3 .github/scripts/lint-action-pinning.py→ all 18 workflows SHA-pinned.- Runtime audit: all pins in the two files
node24, zeronode20. - YAML parse OK;
git diff --checkclean. None.