Repository navigation
ci: bump actions versions and don't persist credentials - #585
Merged
Merged
Conversation
Kanti
reviewed
Oct 21, 2026
Co-authored-by: Matthias Vogel <git@kanti.de>
Collaborator
|
Thanks for the PR and for quickly addressing the feedback! I'll wait until the upcoming PHP security release is out, then run the pipelines. If everything is green, I'll merge the PR. Thanks again for your contribution! |
Contributor
Author
|
Yep, busy day today 😆 It's the security release that brought me here to the repo. Thanks for jumping on it so quickly! 👍 |
Brings in the CI changes from upstream webdevops/Dockerfile: - Optimize BuildKit cache scopes: per image/arch `type=gha,scope=...` instead of one shared scope, plus `no-cache` on schedule and rerun attempts so a fresh full image chain is built - `overwrite: true` on upload-artifact so a rerun replaces the previous attempt's parent image - Drop PHP 8.1 image builds and support - Replace PECL installs with PIE and upstream source builds - Enforce minimum PHP security patch versions - Disable session upload progress by default Conflict in `ci/src/GithubJobBuilder.php` (the "Export image (OCI layout)" step) resolved by keeping the v7 build-push-action bump alongside upstream's new comment. `.github/workflows/build.yaml` was regenerated from the merged generator rather than hand-merged. Action versions bumped on this branch, all still in place after the merge: - actions/checkout v6 -> v7 (with `persist-credentials: false`) - actions/upload-artifact v4 -> v7 - actions/download-artifact v4.1.9 -> v8 - docker/build-push-action v6 -> v7 - docker/setup-buildx-action v3 -> v4 - docker/login-action v3 -> v4
|
Contributor
Author
|
Merge conflicts fixed |
Collaborator
|
Thank you @luc122c |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR bumps all actions to their latest major release. I've checked each one to make sure the parameters and behaviour are compatible. The only one that was a 'breaking' change was
actions/download-artifact@v8which errors if the hash doesn't match.I've set it back to the old behaviour;however, I'd say that the default is probably better.I've also added
persist-credentials: falseto the checkout step since none of the steps need to commit anything back to the repo.