Pin third-party actions by SHA, add Dependabot, serialize builds, update deprecated node runtimes - #34
Pin third-party actions by SHA, add Dependabot, serialize builds, update deprecated node runtimes#34LunkSnee wants to merge 2 commits into
Conversation
Three actions still declared runtimes GitHub has deprecated, which produces warnings on every run: tyriis/docker-image-tag-exists v2.1.0 -> v2026.6.0 (was node20) actions/checkout v3 -> v6.0.2 (was node16) peter-evans/dockerhub-description v2 -> v5.0.0 (was node12) Inputs and outputs are unchanged for all three as used here: docker-image-tag-exists keeps the same registry/repository/tag inputs and the same `found` / `not found` output, and dockerhub-description v5 is a superset of v2's inputs. No step logic needed changing. Versions use the same exact-pin style already used elsewhere in build-and-publish.yml.
The three third-party actions run in jobs holding DOCKERHUB_TOKEN and GITHUB_TOKEN. A mutable tag can be repointed by its owner, so they are pinned by full commit SHA. Actions from actions/* and docker/* are left on version tags deliberately — pinning those trades away automatic security patches for less benefit. SHA pins never roll forward on their own, so .github/dependabot.yml adds weekly checks for both workflows and the Dockerfile base image. cooldown.default-days: 5 holds a release back until it has been public for five days rather than adopting it the day it ships; security updates bypass cooldown. The trailing "# vX.Y.Z" comments are the form Dependabot reads and rewrites when it bumps a SHA. Adds a concurrency group so a manual dispatch overlapping the daily schedule cannot race to push :latest, with the slower run winning. .gitignore was a Flash/ActionScript template (*.swf, *.air, *.ipa, Flash Builder project files) with nothing relevant to this project; replaced with compose overrides, .env, local container data and editor noise. Verified no currently tracked file becomes ignored.
|
I do not understand, what these changes do. |
|
Happy to explain — sorry, my description was too technical. Here is what each 1. Pinning three actions to a commit IDRight now the workflow says things like:
That matters for these three steps in particular, because the job they run in So I changed them to the commit ID instead: A commit ID cannot be moved. It always means exactly that code. The I only did this for the three actions from individual developers. I left 2. Adding DependabotThe downside of a commit ID is that it never updates by itself, so nobody Dependabot is GitHub's built-in bot. Once a week it checks the actions and the When it updates a commit ID, it also updates the 3. The 5-day "cooldown" in the Dependabot configThis tells Dependabot to wait 5 days after a release before offering it to you. The idea: if a new version turns out to be broken and the author fixes it You can change 4. The
|
3 participants
No description provided.