mirror of
https://github.com/apple/container.git
synced 2026-07-13 13:07:06 +00:00
Salman Chishti
637c8f11a9
## Summary Upgrade GitHub Actions to their latest versions to ensure compatibility with Node 24, as Node 20 will reach end-of-life in April 2026. ## Changes | Action | Old Version(s) | New Version | SHA | |--------|---------------|-------------|-----| | `actions/checkout` | v4 | v6 | `8e8c483` | | `actions/download-artifact` | v4 | v7 | `37930b1` | | `actions/upload-artifact` | v4 | v6 | `b7c566a` | | `actions/labeler` | v5 | v6 | `634933e` | | `actions/configure-pages` | v5 | v5 | `983d773` | | `actions/upload-pages-artifact` | v3 | v3 | `56afc60` | | `softprops/action-gh-release` | v2 | v2 | `a06a81a` | ## Context Per [GitHub's announcement](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/), Node 20 is being deprecated and runners will begin using Node 24 by default starting March 4th, 2026. ### Why this matters - **Node 20 EOL**: April 2026 - **Node 24 default**: March 4th, 2026 - **Action**: Update to latest action versions that support Node 24 ### Security All actions are now **pinned to commit SHAs** instead of mutable version tags. This provides: - Protection against tag hijacking attacks - Immutable, reproducible builds - Version comments for readability ### Automated Updates A follow-up PR (#960) adds Dependabot configuration to automatically keep these actions updated with new SHA-pinned versions. ### Testing These changes only affect CI/CD workflow configurations and should not impact application functionality. The workflows should be tested by running them on a branch before merging. Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com>
58 lines
1.4 KiB
YAML
58 lines
1.4 KiB
YAML
name: container project - release build
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "[0-9]+\\.[0-9]+\\.[0-9]+"
|
|
|
|
jobs:
|
|
build:
|
|
name: Invoke build and release
|
|
uses: ./.github/workflows/common.yml
|
|
with:
|
|
release: true
|
|
secrets: inherit
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
pages: write
|
|
|
|
release:
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
name: Publish release
|
|
timeout-minutes: 30
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
packages: read
|
|
pages: write
|
|
steps:
|
|
- name: Download artifacts
|
|
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
|
|
with:
|
|
path: outputs
|
|
|
|
- name: Verify artifacts exist
|
|
run: |
|
|
echo "Checking for expected artifacts..."
|
|
ls -la outputs/container-package/
|
|
test -e outputs/container-package/*.zip || (echo "Missing .zip file!" && exit 1)
|
|
test -e outputs/container-package/*.pkg || (echo "Missing .pkg file!" && exit 1)
|
|
|
|
- name: Create release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
token: ${{ github.token }}
|
|
name: ${{ github.ref_name }}-prerelease
|
|
draft: true
|
|
make_latest: false
|
|
prerelease: true
|
|
fail_on_unmatched_files: true
|
|
files: |
|
|
outputs/container-package/*.zip
|
|
outputs/container-package/*.pkg
|