From 70a6efb8fce329bf2b21e94d072850182235ea1a Mon Sep 17 00:00:00 2001 From: Adeeb Shihadeh Date: Thu, 2 Jul 2026 19:00:35 -0700 Subject: [PATCH] ci: update GitHub Actions to latest versions (#38278) * ci: update GitHub Actions to latest versions Bump all workflow actions to their latest releases, including major updates for checkout (v7), upload-artifact (v7), github-script (v9), action-download-artifact (v21), and thollander comment action (v3). * ci: pin third-party actions to commit SHAs Keep official GitHub actions on version tags, but pin community actions to immutable commit hashes for supply-chain safety. --- .github/workflows/auto_pr_review.yaml | 4 ++-- .github/workflows/diff_report.yaml | 14 ++++++------ .github/workflows/docs.yaml | 4 ++-- .github/workflows/jenkins-pr-trigger.yaml | 8 +++---- .github/workflows/model_review.yaml | 6 +++--- .github/workflows/release.yaml | 4 ++-- .github/workflows/repo-maintenance.yaml | 4 ++-- .github/workflows/tests.yaml | 26 +++++++++++------------ .github/workflows/ui_preview.yaml | 20 ++++++++--------- 9 files changed, 45 insertions(+), 45 deletions(-) diff --git a/.github/workflows/auto_pr_review.yaml b/.github/workflows/auto_pr_review.yaml index 99c3a258c6..9b67956484 100644 --- a/.github/workflows/auto_pr_review.yaml +++ b/.github/workflows/auto_pr_review.yaml @@ -11,7 +11,7 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: false @@ -23,7 +23,7 @@ jobs: # Check PR target branch - name: check branch - uses: Vankka/pr-target-branch-action@def32ec9d93514138d6ac0132ee62e120a72aed5 + uses: Vankka/pr-target-branch-action@5da68a42bcb7b43d39104295a876a6f3f8d7908b if: github.repository == 'commaai/openpilot' env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/diff_report.yaml b/.github/workflows/diff_report.yaml index 2ddb850944..5ad7746fda 100644 --- a/.github/workflows/diff_report.yaml +++ b/.github/workflows/diff_report.yaml @@ -17,7 +17,7 @@ jobs: - name: Wait for process replay id: wait continue-on-error: true - uses: lewagon/wait-on-check-action@v1.3.4 + uses: lewagon/wait-on-check-action@1d57e2c51a58d812d2765e036a028b6bdb5a6154 with: ref: ${{ github.event.pull_request.head.sha }} check-name: process replay @@ -26,7 +26,7 @@ jobs: wait-interval: 20 - name: Download diff if: steps.wait.outcome == 'success' - uses: dawidd6/action-download-artifact@v6 + uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 with: github_token: ${{ secrets.GITHUB_TOKEN }} workflow: tests.yaml @@ -37,9 +37,9 @@ jobs: allow_forks: true - name: Comment on PR if: steps.wait.outcome == 'success' - uses: thollander/actions-comment-pull-request@v2 + uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b with: - filePath: diff_report.txt - comment_tag: diff_report - pr_number: ${{ github.event.number }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + file-path: diff_report.txt + comment-tag: diff_report + pr-number: ${{ github.event.number }} + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index d072cd71d1..2d7da672e7 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -22,7 +22,7 @@ jobs: steps: - uses: commaai/timeout@v1 - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true @@ -34,7 +34,7 @@ jobs: python scripts/docs.py build # Push to docs.comma.ai - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 if: github.ref == 'refs/heads/master' && github.repository == 'commaai/openpilot' with: path: openpilot-docs diff --git a/.github/workflows/jenkins-pr-trigger.yaml b/.github/workflows/jenkins-pr-trigger.yaml index fdd26253fa..ebb14d5dba 100644 --- a/.github/workflows/jenkins-pr-trigger.yaml +++ b/.github/workflows/jenkins-pr-trigger.yaml @@ -11,7 +11,7 @@ jobs: contents: write steps: - name: Delete stale Jenkins branches - uses: actions/github-script@v8 + uses: actions/github-script@v9 with: script: | const cutoff = Date.now() - 24 * 60 * 60 * 1000; @@ -52,7 +52,7 @@ jobs: steps: - name: Check for trigger phrase id: check_comment - uses: actions/github-script@v8 + uses: actions/github-script@v9 with: script: | const triggerPhrase = "trigger-jenkins"; @@ -72,7 +72,7 @@ jobs: - name: Checkout repository if: steps.check_comment.outputs.result == 'true' - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: refs/pull/${{ github.event.issue.number }}/head @@ -86,7 +86,7 @@ jobs: - name: Delete trigger comment if: steps.check_comment.outputs.result == 'true' && always() - uses: actions/github-script@v8 + uses: actions/github-script@v9 with: script: | await github.rest.issues.deleteComment({ diff --git a/.github/workflows/model_review.yaml b/.github/workflows/model_review.yaml index 66f0398d09..82c732dc3b 100644 --- a/.github/workflows/model_review.yaml +++ b/.github/workflows/model_review.yaml @@ -16,11 +16,11 @@ jobs: if: github.repository == 'commaai/openpilot' steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: submodules: true - name: Checkout master - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: master path: base @@ -36,7 +36,7 @@ jobs: echo "EOF" >> $GITHUB_OUTPUT - name: Post model report comment - uses: marocchino/sticky-pull-request-comment@baa7203ed60924babbe5dcd0ac8eae3b66ec5e16 + uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 with: header: model-review message: ${{ steps.report.outputs.content }} \ No newline at end of file diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 27faccae6e..02388f689f 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -15,14 +15,14 @@ jobs: steps: - name: Wait for green check mark if: ${{ github.event_name == 'schedule' }} - uses: lewagon/wait-on-check-action@ccfb013c15c8afb7bf2b7c028fb74dc5a068cccc + uses: lewagon/wait-on-check-action@1d57e2c51a58d812d2765e036a028b6bdb5a6154 with: ref: master wait-interval: 30 running-workflow-name: 'build master-ci' repo-token: ${{ secrets.GITHUB_TOKEN }} check-regexp: ^((?!.*(build prebuilt|create badges).*).)*$ - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: submodules: true fetch-depth: 0 diff --git a/.github/workflows/repo-maintenance.yaml b/.github/workflows/repo-maintenance.yaml index 1a99852be1..a821f928ac 100644 --- a/.github/workflows/repo-maintenance.yaml +++ b/.github/workflows/repo-maintenance.yaml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'commaai/openpilot' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true - run: ./tools/op.sh setup @@ -49,7 +49,7 @@ jobs: python openpilot/selfdrive/car/docs.py git add docs/CARS.md - name: Create Pull Request - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 with: author: Vehicle Researcher token: ${{ secrets.ACTIONS_CREATE_PR_PAT }} diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 4fa3af3d5e..0b3d1c0d76 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -35,11 +35,11 @@ jobs: STRIPPED_DIR: /tmp/releasepilot PYTHONPATH: /tmp/releasepilot steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true - name: Getting LFS files - uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 with: timeout_minutes: 2 max_attempts: 3 @@ -65,7 +65,7 @@ jobs: name: build macOS runs-on: ${{ ((github.repository == 'commaai/openpilot') && ((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.full_name == 'commaai/openpilot'))) && 'namespace-profile-macos-8x14' || 'macos-latest' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true - name: Remove Homebrew from environment @@ -85,7 +85,7 @@ jobs: && fromJSON('["namespace-profile-amd64-8x16"]') || fromJSON('["ubuntu-24.04"]') }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true - run: ./tools/op.sh setup @@ -102,7 +102,7 @@ jobs: && fromJSON('["namespace-profile-amd64-8x16"]') || fromJSON('["ubuntu-24.04"]') }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true - run: ./tools/op.sh setup @@ -125,7 +125,7 @@ jobs: && fromJSON('["namespace-profile-amd64-8x16"]') || fromJSON('["ubuntu-24.04"]') }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true - run: ./tools/op.sh setup @@ -142,14 +142,14 @@ jobs: - name: Print diff report if: always() run: cat openpilot/selfdrive/test/process_replay/diff_report.txt - - uses: actions/upload-artifact@v6 + - uses: actions/upload-artifact@v7 if: always() continue-on-error: true with: name: process_replay_diff.txt path: openpilot/selfdrive/test/process_replay/diff.txt - name: Upload diff report - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 if: always() && github.event_name == 'pull_request' continue-on-error: true with: @@ -157,7 +157,7 @@ jobs: path: openpilot/selfdrive/test/process_replay/diff_report.txt - name: Checkout ci-artifacts if: github.repository == 'commaai/openpilot' && github.ref == 'refs/heads/master' - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: commaai/ci-artifacts ssh-key: ${{ secrets.CI_ARTIFACTS_DEPLOY_KEY }} @@ -176,7 +176,7 @@ jobs: git commit -m "process-replay refs for ${{ github.repository }}@${{ github.sha }}" || echo "No changes to commit" - name: Push refs if: github.repository == 'commaai/openpilot' && github.ref == 'refs/heads/master' - uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 with: timeout_minutes: 2 max_attempts: 3 @@ -198,7 +198,7 @@ jobs: || fromJSON('["ubuntu-24.04"]') }} if: false # FIXME: Started to timeout recently steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true - run: ./tools/op.sh setup @@ -219,7 +219,7 @@ jobs: && fromJSON('["namespace-profile-amd64-8x16"]') || fromJSON('["ubuntu-24.04"]') }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true - run: ./tools/op.sh setup @@ -231,7 +231,7 @@ jobs: python3 openpilot/selfdrive/ui/tests/diff/replay.py python3 openpilot/selfdrive/ui/tests/diff/replay.py --big - name: Upload UI Report - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: ui-report-${{ inputs.run_number || '1' }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && 'master' || github.event.number }} path: openpilot/selfdrive/ui/tests/diff/report diff --git a/.github/workflows/ui_preview.yaml b/.github/workflows/ui_preview.yaml index 7bfaea63aa..20927740bb 100644 --- a/.github/workflows/ui_preview.yaml +++ b/.github/workflows/ui_preview.yaml @@ -34,12 +34,12 @@ jobs: pull-requests: write actions: read steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: submodules: true - name: Waiting for ui generation to end - uses: lewagon/wait-on-check-action@v1.3.4 + uses: lewagon/wait-on-check-action@1d57e2c51a58d812d2765e036a028b6bdb5a6154 with: ref: ${{ env.SHA }} check-name: ${{ env.UI_JOB_NAME }} @@ -53,7 +53,7 @@ jobs: echo "run_id=$(curl https://api.github.com/repos/${{ github.repository }}/commits/${{ env.SHA }}/check-runs | jq -r '.check_runs[] | select(.name == "${{ env.UI_JOB_NAME }}") | .html_url | capture("(?[0-9]+)") | .number')" >> $GITHUB_OUTPUT - name: Getting proposed ui - uses: dawidd6/action-download-artifact@v6 + uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 with: github_token: ${{ secrets.GITHUB_TOKEN }} run_id: ${{ steps.get_run_id.outputs.run_id }} @@ -62,7 +62,7 @@ jobs: path: ${{ github.workspace }}/pr_ui - name: Getting mici master ui - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: repository: commaai/ci-artifacts ssh-key: ${{ secrets.CI_ARTIFACTS_DEPLOY_KEY }} @@ -70,7 +70,7 @@ jobs: ref: openpilot_master_ui_mici_raylib - name: Getting big master ui - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: repository: commaai/ci-artifacts ssh-key: ${{ secrets.CI_ARTIFACTS_DEPLOY_KEY }} @@ -97,7 +97,7 @@ jobs: done - name: Setup FFmpeg - uses: AnimMouse/setup-ffmpeg@ae28d57dabbb148eff63170b6bf7f2b60062cbae + uses: AnimMouse/setup-ffmpeg@178e0b4a408f06ce40d896c3cd79f50fa6f8b0c3 - name: Finding diffs if: github.event_name == 'pull_request_target' @@ -164,12 +164,12 @@ jobs: - name: Comment on PR if: github.event_name == 'pull_request_target' - uses: thollander/actions-comment-pull-request@v2 + uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b with: message: | ## UI Preview ${{ steps.find_diff.outputs.COMMENT }} - comment_tag: run_id_ui_preview - pr_number: ${{ github.event.number }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + comment-tag: run_id_ui_preview + pr-number: ${{ github.event.number }} + github-token: ${{ secrets.GITHUB_TOKEN }}