ci(release): Switch from action-prepare-release to Craft #5527
Conversation
This PR migrates from the deprecated action-prepare-release to the new Craft GitHub Actions (reusable workflow or composite action). Changes: - Migrate .github/workflows/release_library.yml to Craft reusable workflow
BYK
force-pushed
the
ci/migrate-to-craft-action
branch
from
64b9e3e to
1736a75
Compare
Semver Impact of This PR🟢 Patch (bug fixes) 📋 Changelog PreviewThis is how your changes will appear in the changelog. New Features ✨
Build / dependencies / internal 🔧
🤖 This preview updates automatically when you update the PR. |
The previous migration incorrectly removed the GitHub App token authentication step. This commit restores it by switching to the composite action pattern which preserves the auth flow.
The previous migration incorrectly removed the GitHub App token authentication step. This commit restores it by switching to the composite action pattern which preserves the auth flow.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
.github/workflows/beta.yml
Outdated
|
|
||
| steps: | ||
| - uses: actions/checkout@v6.0.1 | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v2.0.1 |
There was a problem hiding this comment.
Checkout action downgraded from v6 to v2
High Severity
The actions/checkout action is being downgraded from @v6.0.1 to SHA 34e114876b0b11c390a56381ad16ebd13914f8d5 with a comment indicating it's v2.0.1. This is a major version downgrade across all workflow files. Version 2.x is deprecated, uses end-of-life Node.js 12, and lacks critical security improvements from v6 including improved credential persistence. The version comment appears incorrect for a migration that should maintain functionality.
🔬 Verification Test
Why verification test was not possible: This is a GitHub Actions configuration issue that cannot be verified through local testing. The SHA 34e114876b0b11c390a56381ad16ebd13914f8d5 with comment # v2.0.1 can only be verified by checking the actions/checkout repository tags directly, but the comment in the code explicitly indicates v2.0.1 which represents a downgrade from the original v6.0.1.
Additional Locations (2)
| name: Changelog Preview | ||
| on: | ||
| pull_request: | ||
| types: | ||
| - opened | ||
| - synchronize | ||
| - reopened | ||
| - edited | ||
| - labeled | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
|
|
||
| jobs: | ||
| changelog-preview: | ||
| uses: getsentry/craft/.github/workflows/changelog-preview.yml@v2 | ||
| secrets: inherit |
There was a problem hiding this comment.
I don't think we want this, also it does not use the changelog.md we actually curate.
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6.0.1 | ||
| - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 # v6 # v2.0.1 |
Summary
This PR migrates from the deprecated
action-prepare-releaseto the new Craft GitHub Actions.Changes
.github/workflows/release_binary.ymlto Craft reusable workflow.craft.ymlwithversioning.policy: calverDocumentation
See https://getsentry.github.io/craft/github-actions/ for more information.