chore(ci): update reviewed SHA-pinned workflow actions
Draft
MA
20d ago+93+93+01234567890123456789-92-92-01234567890123456789
Update SHA-pinned workflow actions to their latest stable upstream releases after reviewing the exact deltas against this repository's configuration. Update the release templates and regenerate their workflows, with a reflex-release news fragment.
Pin updates
| Action | Previous | Updated |
|---|---|---|
| actions/checkout | v6.0.2 | v7.0.1 |
| astral-sh/setup-uv | v8.1.0 | v10.2.0 |
| actions/setup-node | v6.4.0 | v7.0.0 |
| github/codeql-action | v4.35.4 | v4.38.2 |
| CodSpeedHQ/action | v5.2.1 | v5.4.0 |
| actions/cache | v5.1.0 | v6.1.0 |
| actions/setup-python | v6.2.0 | v7.0.0 |
Safety review
- Checkout's new unsafe-fork guard affects
pull_request_targetandworkflow_run, neither of which is used here. Credential persistence remains disabled. - Setup-uv restricts token forwarding to GitHub and strengthens checksum verification; all existing embedded checksums are unchanged. Cache pruning now defaults to false, which can increase cache size where the input was implicit. The shared build action already explicitly disables pruning.
- Setup-node's registry and custom-mirror authentication changes are inactive with our inputs. Custom mirrors require another review before enabling them because token fallback behavior changed.
- CodeQL's remote-config and registry-proxy changes are inactive with our local configuration; the repository has no CodeQL tool/config overrides. Token boundaries and hosted-runner tool-cache cleanup were reviewed. Both init and analyze use the same commit; the default CLI becomes 2.27.1.
- CodSpeed's native runner delta was reviewed alongside the action. Its new kernel settings apply to memory mode; our benchmarks use simulation. The downloaded installer matches the action's SHA256, binary checksum verification remains in place, and upstream simulation benchmarks passed.
- Cache's old and new stable branches have identical action source; setup-python's packaging changes retain its Node 24 runtime and our Python inputs.
The final workflow/template diff changes only pins and version comments. Triggers, permissions, inputs, and gate dependencies are unchanged. Adversarial review found no blocking issues.
Validation
uv run pytest tests/units/test_workflow_gates.py tests/units/reflex_release -q --tb=short: 526 passed.uv run ruff check .anduv run ruff format --check .: passed.uv run pyright reflex tests: 0 errors, 0 warnings.uv run reflex-release sync --check: all five generated workflows up to date.- All GitHub YAML parses; exact pin-only diff assertions and
git diff --checkpassed. - Verified each release tag's commit, including peeled annotated tags, and reviewed relevant upstream CI results. Checkout's functional/build/dist checks passed; its separate Dependabot updater reported an error.
Repository Actions execution, CodeQL scanning, and CodSpeed benchmark behavior still need end-to-end confirmation in GitHub CI.