feat(references): GitHub Actions upgrade guide with verified breaking changes - #164
Merged
Conversation
… changes New references/actions-upgrade-guide.md: the Node-runtime wave (runners default to Node 24 since 2026-06-16, Node 20 removed 2026-09-23, every recent major requires Actions Runner >= 2.327.1 — self-hosted must update first), the SHA-pin upgrade procedure (resolve majors from the tag list, never a latest-release endpoint, which hands back backport releases like download-artifact v3.1.0-node20; read every crossed major's notes; keep the # vX.Y.Z comment in sync), and a breaking-changes table verified against release notes on 2026-08-26 — checkout v6 credential isolation and v7 fork-PR checkout block, the download-artifact v5 path change and v8 hash-mismatch errors, upload-artifact v7 archive:false, and the runner-floor majors of cache, composer-install, buildx and login-action. The issue's original table (2026-03) had aged: checkout is at v7, not v6, composer-install at v4, and the Node timeline dates were revised upstream — everything in the guide is re-sourced, not copied. Also pins the remaining bare checkout tags in the examples (actionlint-guide.md 4x @v4, tag-validation.md 1x @v6) to the current v7.0.1 SHA, matching the skill's own Pinned-Dependencies rule, and moves the skill-repo-skill pre-commit pin v1.22.0 -> v1.36.0: the old copy still enforced the withdrawn 500-word SKILL.md cap and rejected the one-row References addition at 506 words, while CI validates against main, which counts body lines (112 here). Second repo hit by netresearch/skill-repo-skill#252 today — despite the config's comment that Renovate bumps these revs. Closes #35. Assisted-by: claude-code:claude-fable-5 Agent-Session: https://claude.ai/code/session_01C7S9rbgu5giqCwnzwafrHA Agent-Host: 0493f0 Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
github-actions
Bot
added
documentation
Member
Author
|
Self-review: ab6e135 The review this pull request demands is unsatisfiable (Copilot quota wall or repeated bot failures on this head). Per the documented fallback, the diff on this head was reviewed by the PR author; this comment is the on-the-record attestation the merge gate reads back. It stops matching on the next push. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #35.
New
references/actions-upgrade-guide.md, wired into the SKILL.md References table. Three parts: the Node-runtime wave (runners default to Node 24 since 2026-06-16, Node 20 removal 2026-09-23 — four weeks out — and every recent major requiring Actions Runner ≥ 2.327.1, so self-hosted runners must update first), the SHA-pin upgrade procedure (resolve majors from the tag list, never a latest-release endpoint — that hands back backports likedownload-artifact v3.1.0-node20; read every crossed major's notes; keep the# vX.Y.Zcomment in sync; verify with actionlint/zizmor), and a breaking-changes table re-verified against release notes today — checkout v6 credential isolation and v7's fork-PR checkout block onpull_request_target/workflow_run, download-artifact v5 path change and v8 hash-mismatch errors, upload-artifact v7archive: false, and the runner-floor majors of cache, composer-install, buildx and login-action.The issue's March table had aged in every row that names a version (checkout is at v7, composer-install at v4, the Node dates were revised upstream) — nothing was copied, everything re-sourced, and the guide says so about itself: the procedure is durable, the table is a dated snapshot.
Also fixes the issue's two side findings: the five remaining bare
actions/checkouttags in example snippets (4×@v4in actionlint-guide.md, 1×@v6in tag-validation.md) are now pinned to the current v7.0.1 SHA per the skill's own Pinned-Dependencies rule. And the skill-repo-skill pre-commit pin moves v1.22.0 → v1.36.0 — the old copy rejected this PR locally on the withdrawn 500-word cap while CI counts body lines (112); second repo hit by skill-repo-skill#252 today, despite the config's claim that Renovate bumps these revs.Assisted by claude-code:claude-fable-5 — Session