Repository navigation
Update GH Actions - #5
renovate[bot] wants to merge 1 commit into
Conversation
f6e35db to
fbd4a96
Compare
fbd4a96 to
cf2c2b2
Compare
cf2c2b2 to
9eda4b6
Compare
9eda4b6 to
c2fd7d2
Compare
c2fd7d2 to
c2b3ce8
Compare
c2b3ce8 to
62e3597
Compare
62e3597 to
1da9aa1
Compare
1da9aa1 to
33b4121
Compare
33b4121 to
59d2d19
Compare
Confidence Score: 5/5 - Safe to MergeSafe to merge — this PR performs straightforward CI infrastructure version bumps across 13 GitHub Actions workflow files with no logic changes to the actual build or test processes. The upgrades to Key Findings:
Files requiring special attention
|
59d2d19 to
e8db317
Compare
EntelligenceAI PR SummaryUpdates GitHub Actions dependencies across 13 workflows, including newer checkout, artifact, cache, and supporting actions. Several CI jobs also move to newer Ubuntu, macOS, and Windows runners, and selected jobs update their installed Crystal version. Review Scorecard
Issues found:
Review recommended before merging; code quality rated Needs Work (3/5): the review found nothing to flag. 4 comments from earlier reviews are still open. Need to merge before these are addressed? Anyone with write access can comment Evaluated against
|
e8db317 to
3275755
Compare
![entelligence-ai-pr-reviews[bot]](https://avatars.githubusercontent.com/in/932812?s=60&v=4){kind=small}
| jobs: | ||
| llvm_test: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-24.04 |
There was a problem hiding this comment.
libtinfo5 (line 51) is not available in Ubuntu 24.04 (noble) — it was replaced by libtinfo6. The Set up LLVM step will fail with a package-not-found error on every matrix job because apt-get install -y libtinfo5 has no candidate in the noble repository.
🤖 AI Agent Prompt for Cursor/Windsurf
📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue
In .github/workflows/llvm.yml at line 51, the command `sudo apt-get install -y libtinfo5` will fail on the newly upgraded `ubuntu-24.04` runner (line 14) because `libtinfo5` does not exist in Ubuntu 24.04's package repositories (it was replaced by `libtinfo6`). Change line 51 from `sudo apt-get install -y libtinfo5` to `sudo apt-get install -y libtinfo6` to match what is available in Ubuntu 24.04 (noble).
| jobs: | ||
| x86_64-darwin-test: | ||
| runs-on: macos-13 | ||
| runs-on: macos-15 |
There was a problem hiding this comment.
macos-13 was an Intel x86_64 runner; macos-15 is ARM (Apple Silicon M-series). The job is explicitly named x86_64-darwin-test, so the architecture switch means x86_64-specific tests are now executed on the wrong ISA. GitHub's own changelog notes that users requiring x86_64 must use a dedicated label (e.g. macos-13-xlarge or a future macos-15-x86_64 label), not macos-15.
🤖 AI Agent Prompt for Cursor/Windsurf
📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue
In `.github/workflows/macos.yml` at line 15, the runner was changed from `macos-13` to `macos-15`. However, `macos-15` is an ARM (Apple Silicon) runner, while the job is named `x86_64-darwin-test` and requires an Intel x86_64 runner. `macos-13` was the x86_64 runner. Since GitHub is closing down macos-13, check the current GitHub-provided label for x86_64 macOS (likely `macos-13-xlarge` or a new x86_64-specific label as documented in https://github.blog/changelog/2025-09-19-github-actions-macos-13-runner-image-is-closing-down/) and use that label instead of `macos-15`.
|
File:
Note: This comment was posted as a general PR comment because the specific line could not be resolved in the diff. |
3275755 to
0291e6e
Compare
ef0e624 to
3fa33e8
Compare
|
|
||
| - name: Install wasmtime | ||
| uses: mwilliamson/setup-wasmtime-action@v2 | ||
| uses: mwilliamson/setup-wasmtime-action@v3 |
There was a problem hiding this comment.
mwilliamson/setup-wasmtime-action was last pushed December 2022 and has only a v1.0 release — no v3 tag exists, so this step will fail with a reference-not-found error on every run.
3fa33e8 to
fea06b2
Compare
WalkthroughRefreshes GitHub Actions dependencies across CI workflows and updates selected runner and toolchain versions. Existing build, test, cache, and installer logic remains unchanged; the updates modernize workflow environments and action versions. ChangesFiles
Updated checkout actions to Files
Updated checkout to v7, artifact upload to v7, and artifact download to v8. The interpreter workflow also moves all three jobs to Ubuntu 26.04; build targets and commands are unchanged. Files
Updated Linux checkout actions to v7 and AWS credential configuration to v6; updated MSBuild checkout to v7 and setup-msbuild to v3.0.0; and updated wasm32 checkout to v7 and setup-wasmtime to v3. Wasmtime remains pinned to 2.0.0, and build behavior is unchanged. Files
Moved the LLVM test job to Ubuntu 26.04, updated checkout to v7 and cache to v6, and upgraded Crystal from 1.11.2 to 1.22.2. Moved macOS CI from macOS 13 to macOS 26 and updated checkout to v7, Nix installation to v31, and Cachix to v17; existing Nix and Cachix settings remain unchanged. Files
Moved Windows CI jobs to Windows Server 2025. Updated checkout, cache/artifact actions, and NASM setup in the Windows workflow; the portable-build workflow also upgrades Crystal to 1.22.2 and updates checkout, cache-restore, and artifact-upload actions. Build, cache-key, test, and installer logic remains unchanged. |
fea06b2 to
572737a
Compare
| jobs: | ||
| llvm_test: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-26.04 |
There was a problem hiding this comment.
Ubuntu 26.04 makes every matrix job fail before tests: the setup step still runs sudo apt-get install -y libtinfo5, but Ubuntu's resolute package index reports "Package not available in this suite" for that package.
| runs-on: ubuntu-26.04 | |
| runs-on: ubuntu-22.04 |
Prompt to fix with AI
Copy this prompt into your AI coding assistant to fix this issue.
In .github/workflows/llvm.yml line 14, restore an Ubuntu runner that provides the legacy libtinfo5 package, or replace the package/setup logic with dependencies supported by Ubuntu 26.04. The current ubuntu-26.04 selection causes the apt-get install at line 51 to fail before tests run.
572737a to
a9f5b62
Compare
| jobs: | ||
| llvm_test: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-26.04 |
There was a problem hiding this comment.
Ubuntu 26.04 makes the unconditional apt-get install -y libtinfo5 step fail: Launchpad's Resolute libtinfo5 package page says “Not published at present.” Every matrix job therefore stops during setup before running the LLVM tests.
Prompt to fix with AI
Copy this prompt into your AI coding assistant to fix this issue.
In .github/workflows/llvm.yml, line 14 selects Ubuntu 26.04 while line 51 unconditionally installs libtinfo5, which is not published for Ubuntu Resolute. Update the runner or the LLVM setup step so the dependency is available and all matrix jobs can proceed to the tests.
a9f5b62 to
c302d9a
Compare
| jobs: | ||
| llvm_test: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-26.04 |
There was a problem hiding this comment.
Ubuntu 26.04 does not publish libtinfo5, so the unconditional install at line 51 fails and every LLVM matrix job stops before testing. Keep a runner whose repositories provide it or update the required compatibility library.
Prompt to fix with AI
Copy this prompt into your AI coding assistant to fix this issue.
In `.github/workflows/llvm.yml` at line 14, changing the runner to Ubuntu 26.04 makes the existing `sudo apt-get install -y libtinfo5` at line 51 fail because that package is absent from Resolute repositories. Select a runner whose repositories provide the needed library, or update the LLVM compatibility dependency and install step so the workflow can proceed.
c302d9a to
daf8c58
Compare
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v4→v6v4→v7v3→v7v4→v8v4→v7v4→v6v14→v17v26→v311.11.2→1.22.2v1.5.1→v1.5.213→26v1.0.2→v3.0.0v2→v322.04→26.042022→2025Release Notes
actions/cache
v6.1.0Compare Source
What's Changed
Full Changelog: actions/cache@v6...v6.1.0
v6.0.0Compare Source
What's Changed
Full Changelog: actions/cache@v5...v6.0.0
v5.1.0Compare Source
What's Changed
Full Changelog: actions/cache@v5...v5.1.0
v5.0.5Compare Source
What's Changed
Full Changelog: actions/cache@v5...v5.0.5
v5.0.4Compare Source
What's Changed
New Contributors
Full Changelog: actions/cache@v5...v5.0.4
v5.0.3Compare Source
What's Changed
@actions/cacheto v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)@actions/coreto v2.0.3Full Changelog: actions/cache@v5...v5.0.3
v5.0.2: v.5.0.2Compare Source
v5.0.2
What's Changed
When creating cache entries, 429s returned from the cache service will not be retried.
v5.0.1Compare Source
v5.0.1
What's Changed
v5.0.0
What's Changed
Full Changelog: actions/cache@v5...v5.0.1
v5.0.0Compare Source
What's Changed
Full Changelog: actions/cache@v4.3.0...v5.0.0
actions/checkout
v7.0.1Compare Source
v7.0.0Compare Source
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v6.0.3...v6.1.0
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v5.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v5 by @aiqiaoy in #2501https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v5.0.1...v5.1.0
v5.0.1Compare Source
v5.0.0Compare Source
actions/download-artifact
v8.0.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/download-artifact@v8.0.1...v8.0.2
v8.0.1Compare Source
What's Changed
Full Changelog: actions/download-artifact@v8...v8.0.1
v8.0.0Compare Source
v8 - What's new
Direct downloads
To support direct uploads in
actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks theContent-Typeheader ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the newskip-decompressparameter totrue.Enforced checks (breaking)
A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the
digest-mismatchparameter. To be secure by default, we are now defaulting the behavior toerrorwhich will fail the workflow run.ESM
To support new versions of the @actions/* packages, we've upgraded the package to ESM.
What's Changed
errorby @danwkennedy in #461Full Changelog: actions/download-artifact@v7...v8.0.0
v7.0.0Compare Source
v7 - What's new
Node.js 24
This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
What's Changed
New Contributors
Full Changelog: actions/download-artifact@v6.0.0...v7.0.0
v6.0.0Compare Source
What's Changed
BREAKING CHANGE: this update supports Node
v24.x. This is not a breaking change per-se but we're treating it as such.@actions/artifacttov4.0.0v6.0.0by @danwkennedy in #438New Contributors
Full Changelog: actions/download-artifact@v5...v6.0.0
v5.0.0Compare Source
What's Changed
v5.0.0
🚨 Breaking Change
This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.
What Changed
Previously, single artifact downloads behaved differently depending on how you specified the artifact:
name: my-artifact→ extracted topath/(direct)artifact-ids: 12345→ extracted topath/my-artifact/(nested)Now both methods are consistent:
name: my-artifact→ extracted topath/(unchanged)artifact-ids: 12345→ extracted topath/(fixed - now direct)Migration Guide
✅ No Action Needed If:
merge-multiple: trueas a workaroundYou download single artifacts by ID and your workflows expect the nested directory structure.
Before v5 (nested structure):
To maintain old behavior (if needed):
New Contributors
Full Changelog: actions/download-artifact@v4...v5.0.0
actions/upload-artifact
v7.0.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
v7.0.0Compare Source
v7 What's new
Direct Uploads
Adds support for uploading single files directly (unzipped). Callers can set the new
archiveparameter tofalseto skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. Thenameparameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.ESM
To support new versions of the
@actions/*packages, we've upgraded the package to ESM.What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v6...v7.0.0
v6.0.0Compare Source
v6 - What's new
Node.js 24
This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
What's Changed
Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0
v5.0.0Compare Source
What's Changed
BREAKING CHANGE: this update supports Node
v24.x. This is not a breaking change per-se but we're treating it as such.@actions/artifacttov4.0.0v5.0.0by @danwkennedy in #734New Contributors
Full Changelog: actions/upload-artifact@v4...v5.0.0
aws-actions/configure-aws-credentials
v6.3.0Compare Source
Features
v6.2.4Compare Source
Bug Fixes
v6.2.3Compare Source
Bug Fixes
v6.2.2Compare Source
Miscellaneous Chores
v6.2.1Compare Source
Bug Fixes
v6.2.0Compare Source
Features
Bug Fixes
v6.1.3Compare Source
Bug Fixes
v6.1.2Compare Source
Bug Fixes
v6.1.1Compare Source
What's Changed
Full Changelog: aws-actions/configure-aws-credentials@v6...v6.1.1
v6.1.0Compare Source
Features
v6.0.0Compare Source
⚠ BREAKING CHANGES
Features
Bug Fixes
aws-account-idandauthenticated-arnwhen using role-chaining (#1633) (7ceaf96)v5.1.1Compare Source
Miscellaneous Chores
v5.1.0Compare Source
Features
Bug Fixes
v5.0.0Compare Source
⚠ BREAKING CHANGES
Features
cachix/cachix-action
v17Compare Source
What's Changed
Breaking changes
https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Bug fixes
Full Changelog: cachix/cachix-action@v16...v17
v16Compare Source
What's Changed
Full Changelog: cachix/cachix-action@v15...v16
v15: cachix-action-v15Compare Source
What's Changed
cachixArgsto the daemon by @sandydoo in #177pathsToPushby @sandydoo in #180Full Changelog: cachix/cachix-action@v14...v15
cachix/install-nix-action
v31.11.3Compare Source
What's Changed
Security: Updates the bundled certificates shipped with the installer to remove the compromised eMudhra certificates.
Re-release of 31.11.3, which was tagged incorrectly.
Full Changelog: cachix/install-nix-action@v31.11.2...v31.11.3
v31.11.2Compare Source
What's Changed
Security: Fixes a number of vulnerabilities that could be combined to achieve root priviledge escalation.
See https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
Full Changelog: cachix/install-nix-action@v31.11.1...v31.11.2
v31.11.1Compare Source
What's Changed
Fixes a crash (
Assertion '!awake.empty()' failed) that could abort builds.Full Changelog: cachix/install-nix-action@v31.11.0...v31.11.1
v31.11.0Compare Source
What's Changed
Release notes: https://discourse.nixos.org/t/nix-2-35-0-released/78914
Full Changelog: cachix/install-nix-action@v31.10.7...v31.11.0
v31.10.7Compare Source
What's Changed
Full Changelog: cachix/install-nix-action@v31.10.6...v31.10.7
v31.10.6Compare Source
What's Changed
GHSA-vh5x-56v6-4368: Fixes a coroutine stack-to-heap overflow via unbounded recursion in the NAR directory parser. Severity: High.
GHSA-gr92-w2r5-qw5p: Fixes an absolute path traversal vulnerability when unpacking archives to disk. Severity: Moderate.
Full Changelog: cachix/install-nix-action@v31...v31.10.6
v31.10.5Compare Source
What's Changed
Full Changelog: cachix/install-nix-action@v31...v31.10.5
v31.10.4Compare Source
What's Changed
[SECURITY] Fixes a root privilege escalation vulnerability via sandbox escape GHSA-g3g9-5vj6-r3gj
Full Changelog: cachix/install-nix-action@v31.10.3...v31.10.4
v31.10.3Compare Source
What's Changed
Full Changelog: cachix/install-nix-action@v31...v31.10.3
v31.10.2Compare Source
What's Changed
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.