Skip to content

[MAINT] Bump outdated actions/* references for version consistency #363

@rhoerr

Description

@rhoerr

Background

While auditing the workflows and composite actions in this repo, I noticed wide major-version drift in the first-party actions/* dependencies. Most of these have new majors available with security fixes, smaller bundle sizes, and updated Node runners.

Findings

Action Versions currently in use Latest
actions/cache v3, v4 v4
actions/cache/restore v4 v4
actions/cache/save v3 v4
actions/checkout v3, v4, v6 v6
actions/upload-artifact v4 v4

Files where the older versions appear:

  • cache-magento/action.ymlactions/cache@v3
  • nx-integration-tests-setup/action.ymlactions/cache@v3, actions/cache/save@v3
  • unit-test/action.ymlactions/cache@v3
  • supported-services-matrix-calculator/action.ymlactions/checkout@v3
  • setup-di-compile/action.ymlactions/checkout@v3
  • .github/workflows/_internal-get-composer-version.yamlactions/checkout@v4
  • .github/workflows/_internal-get-magento-version.yamlactions/checkout@v4
  • .github/workflows/_internal-integration.yamlactions/checkout@v4
  • .github/workflows/_internal-semver-compare.yamlactions/checkout@v4
  • .github/workflows/_internal-setup-magento.yamlactions/checkout@v4
  • .github/workflows/_internal-unit.yamlactions/checkout@v4
  • .github/workflows/_internal_test_actions.yamlactions/checkout@v4
  • .github/workflows/full-integration-tests.yamlactions/checkout@v4
  • .github/workflows/integration.yamlactions/checkout@v4, actions/cache@v4, actions/upload-artifact@v4
  • (_internal-coding-standard.yaml and sansec-ecomscan.yml already use actions/checkout@v6)

Proposed change

Standardize on the latest major across the repo:

  • actions/cachev4 everywhere (including the cache/save and cache/restore sub-paths)
  • actions/checkoutv6 everywhere
  • actions/upload-artifact → already on v4

Why

  • Reduces the surface area of the GitHub Actions allowlist consumers need to maintain (one major per action instead of three).
  • Pulls in updated Node runtimes and any security fixes that have shipped in newer majors.
  • Makes future audits (like this one) trivially mechanical.

Out of scope

Third-party actions (shivammathur/setup-php, dorny/paths-filter, tj-actions/changed-files, etc.) — those will be handled in a separate issue covering the Node 20 → Node 24 migration.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions