From b1adb84ff836d2bb02d2cd811d8f95b88a4f976b Mon Sep 17 00:00:00 2001 From: Thomas Waldmann Date: Wed, 4 Nov 2026 22:43:00 +0100 Subject: [PATCH 1/2] CI: update GitHub actions to Node.js 24 versions The runners force actions targeting Node.js 20 to run on Node.js 24 and warn about it. Update these actions to their current major versions, which target Node.js 24 (same majors as on master): - actions/checkout v4 -> v7 - actions/setup-python v5 -> v7 - actions/cache v4 -> v6 - actions/upload-artifact v4 -> v7 - codecov/codecov-action v4 -> v7 - github/codeql-action v2 -> v4 (v2 is deprecated and errors out) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 20 ++++++++++---------- .github/workflows/codeql-analysis.yml | 10 +++++----- .github/workflows/windows.yml | 4 ++-- 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e0e291f140..58a581ab11 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,7 +39,7 @@ jobs: timeout-minutes: 5 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: chartboost/ruff-action@v1 @@ -50,14 +50,14 @@ jobs: needs: [lint] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # Just fetching one commit is not enough for setuptools-scm, so we fetch all. fetch-depth: 0 fetch-tags: true - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: '3.12' @@ -158,19 +158,19 @@ jobs: timeout-minutes: 360 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # Just fetching one commit is not enough for setuptools-scm, so we fetch all fetch-depth: 0 fetch-tags: true - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.d/development.txt') }} @@ -260,7 +260,7 @@ jobs: - name: Upload binaries (${{ matrix.binary }}) if: ${{ matrix.binary && startsWith(github.ref, 'refs/tags/') }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ matrix.binary }} path: artifacts/* @@ -273,7 +273,7 @@ jobs: tox --skip-missing-interpreters - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@v7 env: OS: ${{ runner.os }} python: ${{ matrix.python-version }} @@ -320,7 +320,7 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 fetch-tags: true @@ -489,7 +489,7 @@ jobs: - name: Upload artifacts if: startsWith(github.ref, 'refs/tags/') && matrix.do_binaries - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ matrix.artifact_prefix }} path: artifacts/* diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 0c8f380de5..1cd5484ae2 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,16 +29,16 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: # just fetching 1 commit is not enough for setuptools-scm, so we fetch all fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: 3.11 - name: Cache pip - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.d/development.txt') }} @@ -52,7 +52,7 @@ jobs: sudo apt-get install -y libssl-dev libacl1-dev libxxhash-dev liblz4-dev libzstd-dev # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -66,4 +66,4 @@ jobs: pip3 install -r requirements.d/development.txt pip3 install -ve . - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@v4 diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 899ba54b81..8a9ba2a903 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -10,7 +10,7 @@ jobs: run: shell: msys2 {0} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 - uses: msys2/setup-msys2@v2 @@ -32,7 +32,7 @@ jobs: ./scripts/msys2-build - name: Test run: ./dist/borg.exe -V - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: borg-windows path: dist/borg.exe From 709579397508188d7ca9a0c7e595fa5f9be06b44 Mon Sep 17 00:00:00 2001 From: Thomas Waldmann Date: Wed, 4 Nov 2026 22:46:18 +0100 Subject: [PATCH 2/2] CI: pin GitHub actions to commit SHAs Like on master, reference each action by its full commit SHA, with the release it corresponds to in a trailing comment. actions/attest-build-provenance is pinned to v3.0.0, which is what the floating v3 tag points to. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 28 +++++++++++++-------------- .github/workflows/codeql-analysis.yml | 10 +++++----- .github/workflows/windows.yml | 6 +++--- 3 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 58a581ab11..75cd27f1f3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,8 +39,8 @@ jobs: timeout-minutes: 5 steps: - - uses: actions/checkout@v7 - - uses: chartboost/ruff-action@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: chartboost/ruff-action@e18ae971ccee1b2d7bbef113930f00c670b78da4 # v1.0.0 asan_ubsan: @@ -50,14 +50,14 @@ jobs: needs: [lint] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Just fetching one commit is not enough for setuptools-scm, so we fetch all. fetch-depth: 0 fetch-tags: true - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.12' @@ -158,19 +158,19 @@ jobs: timeout-minutes: 360 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Just fetching one commit is not enough for setuptools-scm, so we fetch all fetch-depth: 0 fetch-tags: true - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} - name: Cache pip - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.d/development.txt') }} @@ -254,13 +254,13 @@ jobs: - name: Attest binaries provenance (${{ matrix.binary }}) if: ${{ matrix.binary && startsWith(github.ref, 'refs/tags/') }} - uses: actions/attest-build-provenance@v3 + uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0 with: subject-path: 'artifacts/*' - name: Upload binaries (${{ matrix.binary }}) if: ${{ matrix.binary && startsWith(github.ref, 'refs/tags/') }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ matrix.binary }} path: artifacts/* @@ -273,7 +273,7 @@ jobs: tox --skip-missing-interpreters - name: Upload coverage to Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 env: OS: ${{ runner.os }} python: ${{ matrix.python-version }} @@ -320,14 +320,14 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 fetch-tags: true - name: Test on ${{ matrix.display_name }} id: cross_os - uses: cross-platform-actions/action@v1.5.0 + uses: cross-platform-actions/action@faa0c6197e94aacf1c5956460152c8380d3560a5 # v1.5.0 env: DO_BINARIES: ${{ matrix.do_binaries }} with: @@ -489,7 +489,7 @@ jobs: - name: Upload artifacts if: startsWith(github.ref, 'refs/tags/') && matrix.do_binaries - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ matrix.artifact_prefix }} path: artifacts/* @@ -497,6 +497,6 @@ jobs: - name: Attest provenance if: startsWith(github.ref, 'refs/tags/') && matrix.do_binaries - uses: actions/attest-build-provenance@v3 + uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0 with: subject-path: 'artifacts/*' diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 1cd5484ae2..b6de521b2e 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -29,16 +29,16 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # just fetching 1 commit is not enough for setuptools-scm, so we fetch all fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: 3.11 - name: Cache pip - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements.d/development.txt') }} @@ -52,7 +52,7 @@ jobs: sudo apt-get install -y libssl-dev libacl1-dev libxxhash-dev liblz4-dev libzstd-dev # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -66,4 +66,4 @@ jobs: pip3 install -r requirements.d/development.txt pip3 install -ve . - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 8a9ba2a903..1cd2b61eae 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -10,10 +10,10 @@ jobs: run: shell: msys2 {0} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: msys2/setup-msys2@v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2.33.0 with: msystem: UCRT64 update: true @@ -32,7 +32,7 @@ jobs: ./scripts/msys2-build - name: Test run: ./dist/borg.exe -V - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: borg-windows path: dist/borg.exe