Skip to content

[MAINT] Bump outdated actions/* references for version consistency #363

@rhoerr

Description

@rhoerr

Background

While auditing the workflows and composite actions in this repo, I noticed wide major-version drift in the first-party actions/* dependencies. Most of these have new majors available with security fixes, smaller bundle sizes, and updated Node runners.

Findings

Action Versions currently in use Latest
actions/cache v3, v4 v4
actions/cache/restore v4 v4
actions/cache/save v3 v4
actions/checkout v3, v4, v6 v6
actions/upload-artifact v4 v4

Files where the older versions appear:

  • cache-magento/action.ymlactions/cache@v3
  • nx-integration-tests-setup/action.ymlactions/cache@v3, actions/cache/save@v3
  • unit-test/action.ymlactions/cache@v3
  • supported-services-matrix-calculator/action.ymlactions/checkout@v3
  • setup-di-compile/action.ymlactions/checkout@v3
  • .github/workflows/_internal-get-composer-version.yamlactions/checkout@v4
  • .github/workflows/_internal-get-magento-version.yamlactions/checkout@v4
  • .github/workflows/_internal-integration.yamlactions/checkout@v4
  • .github/workflows/_internal-semver-compare.yamlactions/checkout@v4
  • .github/workflows/_internal-setup-magento.yamlactions/checkout@v4
  • .github/workflows/_internal-unit.yamlactions/checkout@v4
  • .github/workflows/_internal_test_actions.yamlactions/checkout@v4
  • .github/workflows/full-integration-tests.yamlactions/checkout@v4
  • .github/workflows/integration.yamlactions/checkout@v4, actions/cache@v4, actions/upload-artifact@v4
  • (_internal-coding-standard.yaml and sansec-ecomscan.yml already use actions/checkout@v6)

Proposed change

Standardize on the latest major across the repo:

  • actions/cachev4 everywhere (including the cache/save and cache/restore sub-paths)
  • actions/checkoutv6 everywhere
  • actions/upload-artifact → already on v4

Why

  • Reduces the surface area of the GitHub Actions allowlist consumers need to maintain (one major per action instead of three).
  • Pulls in updated Node runtimes and any security fixes that have shipped in newer majors.
  • Makes future audits (like this one) trivially mechanical.

Out of scope

Third-party actions (shivammathur/setup-php, dorny/paths-filter, tj-actions/changed-files, etc.) — those will be handled in a separate issue covering the Node 20 → Node 24 migration.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions