IBX-11778: Updated GitHub Actions to latest versions by alongosz · Pull Request #3345 · ibexa/documentation-developer

alongosz · 2026-08-07T14:32:23Z

🎫 Issue	IBX-11778

Related PRs:

IBX-11778: Updated deprecated GitHub Actions in tag-triggered workflows commerce-skeleton#11

Description:

Bumped all uses: action references in .github/workflows/ to their latest versions, and standardized runs-on: to ubuntu-26.04 (the current standard derived from the ibexa/bundle-generator ibexa-oss skeleton).

Most bumps are MAJOR version jumps (repos hadn't been touched in a while):

actions/checkout v3/v4 → v7
actions/setup-python v3/v5 → v7
stefanzweifel/git-auto-commit-action v4 → v7
DavidAnson/markdownlint-cli2-action v20 → v24
vale-cli/vale-action v2 → v3
actions/create-github-app-token v2 → v3
actions/upload-artifact v4 → v7
peter-evans/find-comment v3 → v4
actions/github-script v6 → v9
peter-evans/create-or-update-comment v4 → v5
actions/setup-node v4 → v7
peter-evans/create-pull-request v7 → v8
actions/cache v4 → v6

Pin styles were preserved, not changed:

ramsey/composer-install and marocchino/sticky-pull-request-comment are pinned to version branches (v3/v2 → v4/v3) in most files — kept as branch pins per that convention.
ramsey/composer-install in release_composer_package.yaml is SHA-pinned separately — bumped the SHA to the 4.0.0 tag, kept the SHA-pin style.
shivammathur/setup-php (SHA pin) and lycheeverse/lychee-action (SHA pin) were already current, no change.
ibexa/gh-workflows/...@main (reviewers.yaml) is a deliberate trunk-tracking pin, left untouched.

For QA:

No functional changes expected; this only bumps CI tooling versions and the runner image.

Documentation:

Review

🤖 Generated with Claude Code

Bumped uses: refs to their latest release across all workflows, and standardized runs-on to ubuntu-26.04 per the bundle-generator skeleton. Kept existing pin styles (branch aliases and SHA pins) unchanged.

github-actions · 2026-08-07T14:32:39Z

Preview of modified files: no change to preview.


            - name: Create Pull Request
-              uses: peter-evans/create-pull-request@v7
+              uses: peter-evans/create-pull-request@v8


                  python-version: ${{ matrix.python-version }}

-            - uses: "ramsey/composer-install@v3"
+            - uses: "ramsey/composer-install@v4"



            - name: Commit changes
-              uses: stefanzweifel/git-auto-commit-action@v4
+              uses: stefanzweifel/git-auto-commit-action@v7



            - name: Run markdownlint
-              uses: DavidAnson/markdownlint-cli2-action@v20
+              uses: DavidAnson/markdownlint-cli2-action@v24



            - name: Run Vale.sh
-              uses: vale-cli/vale-action@v2
+              uses: vale-cli/vale-action@v3


            -   name: Find Comment
                id: find-comment
-                uses: peter-evans/find-comment@v3
+                uses: peter-evans/find-comment@v4


            -   name: Create comment
                if: steps.list.outputs.CODE_SAMPLES_CHANGE != '' && steps.diff.outputs.CODE_SAMPLES_DIFF != '0'
-                uses: peter-evans/create-or-update-comment@v4
+                uses: peter-evans/create-or-update-comment@v5


            - name: Comment broken links
              if: always() && github.event_name == 'pull_request'
-              uses: marocchino/sticky-pull-request-comment@v2
+              uses: marocchino/sticky-pull-request-comment@v3


            -   name: Find comment
                id: find-comment
-                uses: peter-evans/find-comment@v3
+                uses: peter-evans/find-comment@v4



            -   name: Create or update comment
-                uses: peter-evans/create-or-update-comment@v4
+                uses: peter-evans/create-or-update-comment@v5


github-actions · 2026-08-07T14:41:54Z

Summary

Status	Count
🔍 Total	736658
🔗 Unique	14773
✅ Successful	6198
⏳ Timeouts	0
🔀 Redirected	0
👻 Excluded	730460
❓ Unknown	0
🚫 Errors	0
⛔ Unsupported	0

Full Github Actions output

mnocon · 2026-08-07T14:50:34Z

I guess you're doing it for other repos as well, and it would make sense to have a consistent approach for all Engineering repos - we're ignoring the Use full commit SHA hash for this dependency. advice?

alongosz · 2026-08-07T15:21:21Z

I guess you're doing it for other repos as well, and it would make sense to have a consistent approach for all Engineering repos - we're ignoring the Use full commit SHA hash for this dependency. advice?

@mnocon my rules are:

if repo used commit SHA, use commit SHA
if it's actions/* GHA, use @v notation (doesn't matter if it's tag or branch)
if it's ibexa/* GHA feel free to use @main, it's safe
if it's anything else, use commit SHA

Here 4) got intentionally violated, keeping rather your convention, to avoid confusing y'all and producing maintenance cost.
BUT if you prefer SHAs everwhere, it's easy to change.

I'm not going to do SHA everywhere for all other packages, because it's a huge maintenance cost. Every time a bug-fix comes out for that action, it requires updating. For instance GHSA-5wxr-w449-57cm on shivammathur/setup-php - fixed in v2.37.1. @v2 "floating" tag satisfies that fix without touching repos using it. Using SHA everywhere instead requires to update all workflows using this action in all repos.

It's not an ideal situation because malicious actor can force-push a tag, especially a floating one. For that reason gh-workflows will use SHA pinning instead of tags or branches for all non-ibexa actions. If it's in one place, it's manageable.

If we find good way to bulk update these, with Claude, then we might change the approach and use SHA everywhere. Or explicit tag, as long as action maintainer enabled immutable releases.

@mnocon do you want me to switch here to SHAs? It could be one of the exceptional packages, along with gh-workflows and AFAIR archive-maker too, actually.

The build job relied on the runner's default PHP, which was compatible under ubuntu-latest but ubuntu-26.04 ships PHP 8.5, exceeding PHP CS Fixer's supported max of 8.3.

Updated GitHub Actions to latest versions

f564d0f

Bumped uses: refs to their latest release across all workflows, and standardized runs-on to ubuntu-26.04 per the bundle-generator skeleton. Kept existing pin styles (branch aliases and SHA pins) unchanged.

alongosz mentioned this pull request Aug 7, 2026

IBX-11778: Updated deprecated GitHub Actions in tag-triggered workflows ibexa/commerce-skeleton#11

Open

1 task

github-advanced-security AI found potential problems Aug 7, 2026

View reviewed changes

Fixed PHP CS Fixer failure on ubuntu-26.04 by pinning PHP 8.3

af8ecde

The build job relied on the runner's default PHP, which was compatible under ubuntu-latest but ubuntu-26.04 ships PHP 8.5, exceeding PHP CS Fixer's supported max of 8.3.

Navigation Menu

Uh oh!

IBX-11778: Updated GitHub Actions to latest versions - #3345

IBX-11778: Updated GitHub Actions to latest versions#3345
alongosz wants to merge 2 commits into
5.0from
ibx-11778-update-gha-workflows

alongosz commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

mnocon commented Aug 7, 2026

Uh oh!

alongosz commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

alongosz commented Aug 7, 2026

Related PRs:

Description:

For QA:

Documentation:

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

mnocon commented Aug 7, 2026

Uh oh!

alongosz commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Aug 7, 2026 •

edited

Loading