Skip to content

chore: update action versions in workflows and actions #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
omarghatasheh merged 2 commits into from
May 10, 2026
Merged

chore: update action versions in workflows and actions #59

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7dfe7aa
chore: update action versions in workflows and actions
May 10, 2026
f0f2488
fix: fallback to repository name for app name in Helm deployment
May 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/actions/docker-build-push/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,20 +60,20 @@ runs:
using: 'composite'
steps:
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4
with:
platforms: ${{ inputs.platforms }}

- name: Log in to Container Registry
uses: docker/login-action@v3
uses: docker/login-action@v4

@coderabbitai coderabbitai Bot May 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

docker/login-action v4 release notes breaking changes

💡 Result:

Docker/login-action v4 release notes “breaking changes” (most impactful behavior changes) 1) Node runtime change: action now runs on Node.js 24 by default - In v4.0.0, the release notes state “Node 24 as default runtime (requires Actions Runner v2.327.1 or later)” [1]. - The action metadata confirms it uses runs.using: 'node24' and main: dist/index.js [2]. Impact: self-hosted runners must be new enough; older runners may fail to run the action. 2) Packaging/module change: switch to ESM - The v4.0.0 release notes include “Switch to ESM and update config/test wiring” [1]. - The v4.0.0 changes also include upgrading @actions/core to 3.0.0 [1], and @actions/core 3.0.0 is described as “Breaking change: Package is now ESM-only” [3]. Impact: any custom use of internal modules / CommonJS-based assumptions (outside the action’s normal usage) could break. For typical workflow usage (uses: docker/login-action@v4), the bigger externally visible requirement is the Node 24 runtime above. Other notable v4-specific changes (not clearly labeled as “breaking”) - v4.1.0 includes a fix for “scoped Docker Hub cleanup path when registry is omitted” [4]. This could affect behavior if you relied on omitting registry while using scoped login/cleanup, but it’s described as a fix rather than a breaking change [4]. Practical checklist when upgrading to docker/login-action@v4 - Verify your GitHub Actions runners (especially self-hosted) meet the stated requirement for v4’s Node 24 runtime: Actions Runner v2.327.1+ [1]. - If you have any non-standard integrations that depend on the action’s Node module ecosystem, review the ESM-related changes [1][3]. - Optionally retest any workflows that omit registry in combination with scoped/cleanup behavior, since v4.1.0 contains a fix in that area [4].

Citations:

Upgrade to docker/login-action@v4 requires Node.js 24 runtime and breaking changes; verify runner compatibility and module dependencies.

v4 contains breaking changes that require validation:

  • Node 24 runtime: v4.0.0 requires Actions Runner v2.327.1 or later. Self-hosted runners on older versions will fail. Verify all runners meet this requirement.
  • ESM-only packaging: v4 switched to ESM; @actions/core upgraded to 3.0.0 (ESM-only). This breaks CommonJS-based custom integrations if present.
  • Registry cleanup behavior: v4.1.0 changed scoped Docker Hub cleanup when registry is omitted. Retest workflows that use scoped login without explicit registry configuration.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/docker-build-push/action.yml at line 68, The workflow
upgrade to uses: docker/login-action@v4 can break CI — verify all runners meet
the Node/Actions Runner requirement (v2.327.1+ or Node 24 runtime), ensure your
environment and custom actions are ESM-compatible (update any CommonJS
integrations or pin `@actions/core` usage), and explicitly set the registry input
where scoped Docker Hub logins are used to avoid the v4.1.0 registry cleanup
change; if you cannot meet these prerequisites immediately, revert to
docker/login-action@v3 (or pin a known-compatible version) and add tests to the
workflow to validate logins on all runner types.

with:
registry: ${{ inputs.registry != 'docker.io' && inputs.registry || '' }}
username: ${{ inputs.username }}
password: ${{ inputs.password }}

- name: Extract metadata
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@v6

@coderabbitai coderabbitai Bot May 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

docker/metadata-action v6 release notes breaking changes

💡 Result:

docker/metadata-action v6 (latest v6.0.0) breaking-change highlights and what to check when upgrading: 1) Action runtime changes: Node 24 becomes the default runtime - v6.0.0 updates the action to run on Node.js 24 (the GitHub Action metadata shows runs.using: 'node24'). [1] - The release notes state that this requires Actions Runner v2.327.1 or later. [2] What to do: ensure your GitHub Actions runner supports it (self-hosted runner or older enterprise runner), or update/upgrade the runner. 2) ESM migration (dependency/tooling impact) - The v6.0.0 release notes say it “Switch[es] to ESM”. [2] - One of the related dependency bumps notes a “Breaking change: Package is now ESM-only” for @actions/github, requiring dynamic import for CommonJS consumers. [3] What to do: if you consume docker/metadata-action internals via npm packages (custom bundling/scripts) or rely on CommonJS require patterns in related tooling, verify your build/runtime assumptions. For typical “uses: docker/metadata-action@v6” usage, this mainly matters for the action’s own packaging. 3) Output parsing change: input handling of # - v6.0.0 changes how “List inputs” are parsed: it now preserves # inside values while still supporting full-line # comments. [2] What to do: if you previously depended on # being treated as comment markers inside values, re-check your with: tags: / labels: / other list-like inputs. 4) Potential consumer break: interaction change with docker/bake-action using git context - There’s a reported break where v6 behavior “needs some changes in the metadata-action step” because “v6 is now using Git context by default” (for bake definition files); the fix is to use the local bake file by prefixing cwd:// when building with a git context. [4] What to do: if you use docker/bake-action together with docker/metadata-action and you’re using git contexts / remote bake definitions, ensure you’re using the README’s cwd:// guidance for the bake file path. [4] Summary of the key v6.0.0 release-note items with likely upgrade impact - Node.js 24 default runtime + runner requirement [2][1] - Switch to ESM [2] (and related ESM-only dependency behavior) [3] - Input # parsing rules updated (preserve # in values; still treat full-line # as comments) [2] - Bake-action users: may need cwd:// for the generated bake definition when using git contexts [4] If you share your current workflow snippet (the docker/metadata-action uses: line plus your with: inputs and whether you use docker/bake-action), I can map these changes to the exact fields you use.

Citations:

Address breaking changes in docker/metadata-action@v6.

v6.0.0 has multiple breaking changes requiring attention:

  • Node.js 24 runtime: Requires GitHub Actions Runner v2.327.1 or later; verify your runner meets this requirement.
  • Input parsing: The # character is now preserved inside input values (previously treated as a comment marker throughout). Review your tags and labels inputs in the with: section if you use #.
  • Git context default: v6 defaults to Git context; if using docker/bake-action with local bake definitions, prefix the path with cwd://.
  • ESM-only migration: Dependency packages now require ESM; verify if any custom scripts depend on CommonJS imports of the action.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/docker-build-push/action.yml at line 76, Update the action
configuration that specifies "uses: docker/metadata-action@v6" to handle v6
breaking changes: confirm the runner meets Node.js 24 requirement (GitHub
Actions Runner v2.327.1+), review any inputs referenced as tags or labels in the
with: block and escape or remove any '#' usage now preserved instead of
commented, if you use docker/bake-action with local bake files prefix those
paths with "cwd://" to preserve previous behavior, and check any custom scripts
or workflow steps that consume the metadata action for ESM-only compatibility
(or pin to docker/metadata-action@v5 if you cannot migrate immediately).

with:
images: |
${{ inputs.registry != 'docker.io' && format('{0}/{1}', inputs.registry, inputs.image-name) || inputs.image-name }}
Expand All @@ -85,7 +85,7 @@ runs:

- name: Build and push Docker image
id: build
uses: docker/build-push-action@v5
uses: docker/build-push-action@v7

@coderabbitai coderabbitai Bot May 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

docker/build-push-action v7 release notes v6 breaking changes

💡 Result:

docker/build-push-action v7: key v6→v7 breaking changes (per v7.0.0 release notes) 1) Node 24 is now the default runtime for the action - v7.0.0 switches to “Node 24 as default runtime” and notes it requires Actions Runner v2.327.1 or later. [1] 2) Deprecated environment variables removed - The v7.0.0 release removes the deprecated env vars DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS. [1] 3) Legacy “export-build” tool support removed for build summary - v7.0.0 removes legacy export-build tool support for the build summary. [1] 4) Switch to ESM (module system change) - v7.0.0 “Switch[es] to ESM” and updates config/test wiring. [1] 5) Potential behavior/compatibility impact from dependency bumps - v7.0.0 includes dependency changes such as bumping @actions/core (1.11.1 → 3.0.0) and @docker/actions-toolkit (0.62.1 → 0.79.0), plus other library bumps. These aren’t labeled as “breaking” individually in the release highlights, but they can affect runtime behavior. [1] Notes on “v7 release notes v6 breaking changes” - The most direct, authoritative set of “v6→v7” breaking-change indicators is in the v7.0.0 release tag itself (since v7.x releases are incremental from v7.0.0). [1] Actionable upgrade guidance - If your workflow sets DOCKER_BUILD_NO_SUMMARY or DOCKER_BUILD_EXPORT_RETENTION_DAYS, remove those env vars. [1] - If you relied on the legacy export-build tool support for build summary, update your setup to the new behavior (v7.0.0 indicates the legacy support is gone). [1] - Ensure your self-hosted runners are at least Actions Runner v2.327.1 to match the Node 24 runtime requirement. [1]

Citations:

Update to docker/build-push-action@v7 requires verification of breaking changes.

v7.0.0 has been released with significant breaking changes:

  • Node 24 runtime is now default — requires Actions Runner v2.327.1 or later
  • Deprecated environment variables removed — DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS are no longer supported; remove if currently used
  • Legacy export-build tool support removed for build summary
  • Major dependency bumps — @actions/core (1.11.1 → 3.0.0) and @docker/actions-toolkit (0.62.1 → 0.79.0); verify compatibility with build arguments, secrets, provenance, SBOM, and caching behavior

Clarify whether v6 was intentionally skipped or if the version jump was deliberate.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/docker-build-push/action.yml at line 88, Replace or validate
the action version reference "uses: docker/build-push-action@v7" by confirming
whether v7 was intentionally chosen (vs v6); if not intentional, pin back to a
known-working tag (e.g., `@v6`) or explicitly document why v7 is required. If
keeping v7, update CI docs and ensure the runner meets the Node 24 requirement
(Actions Runner v2.327.1+), remove any use of deprecated env vars
DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS from workflow or
scripts, and audit places that interact with build args, secrets, provenance,
SBOM, and caching for compatibility with `@actions/core` v3 and
`@docker/actions-toolkit` v0.79.0; run end-to-end build/push workflows to validate
behavior and adjust inputs or pin dependencies if regressions are found.

with:
context: ${{ inputs.context }}
file: ${{ inputs.dockerfile }}
Expand Down
4 changes: 2 additions & 2 deletions .github/actions/helm-deploy-s9generic/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,12 +119,12 @@ runs:
fi

- name: Set up Helm
uses: azure/setup-helm@v4
uses: azure/setup-helm@v5
with:
version: ${{ inputs.helm-version }}

- name: Set up kubectl
uses: azure/setup-kubectl@v4
uses: azure/setup-kubectl@v5
with:
version: ${{ inputs.kubectl-version }}

Expand Down
4 changes: 2 additions & 2 deletions .github/actions/helm-deploy/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,12 +100,12 @@ runs:
using: 'composite'
steps:
- name: Set up Helm
uses: azure/setup-helm@v4
uses: azure/setup-helm@v5
with:
version: ${{ inputs.helm-version }}

- name: Set up kubectl
uses: azure/setup-kubectl@v4
uses: azure/setup-kubectl@v5
with:
version: ${{ inputs.kubectl-version }}

Expand Down
4 changes: 2 additions & 2 deletions .github/actions/helm-generic/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,12 +123,12 @@ runs:
run: echo "KUBECONFIG=${{ steps.kube.outputs.kubeconfig_path }}" >> "$GITHUB_ENV"

- name: Install Helm
uses: azure/setup-helm@v4
uses: azure/setup-helm@v5
with:
version: v3.14.4

- name: Install kubectl
uses: azure/setup-kubectl@v4
uses: azure/setup-kubectl@v5
with:
version: 'latest'

Expand Down
2 changes: 1 addition & 1 deletion .github/actions/helm-package-push/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ runs:
using: 'composite'
steps:
- name: Set up Helm
uses: azure/setup-helm@v4
uses: azure/setup-helm@v5
with:
version: ${{ inputs.helm-version }}

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-docker.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ jobs:
EFFECTIVE_REGISTRY: ${{ env.EFFECTIVE_REGISTRY }}

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4

- name: Validate and login to container registry
shell: bash
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-helm.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,7 @@ jobs:
run: echo "KUBECONFIG=${{ steps.kube.outputs.kubeconfig_path }}" >> "$GITHUB_ENV"

- name: Install Helm
uses: azure/setup-helm@v4
uses: azure/setup-helm@v5
with:
version: v3.14.4

Expand Down
Loading