From e45a4d32bc287a6ac8a06713a288a72e46b8d590 Mon Sep 17 00:00:00 2001 From: Denis Arnst Date: Thu, 30 Jul 2026 14:01:25 +0200 Subject: [PATCH 1/3] ci: update all actions to Node 24 runtimes Every run logged "Node 20 is being deprecated. This workflow is running with Node 24 by default." Nothing was broken -- the runner already forces Node 24 -- but 13 of the 14 pinned actions still declared runs.using: node20. All pinned actions now declare node24 (or composite). Checked each bump's release notes against how this repo actually calls the action: - actions/checkout v4.2.2 -> v6.1.0 (deliberately NOT v7, see below) - actions/upload-artifact v4.6.2 -> v7.0.1 - actions/download-artifact v4.3.0 -> v8.0.1 - actions/cache v5.0.1 -> v6.1.0 (already node24; bumped for currency) - actions/github-script v7.0.1 -> v9.0.0 - actions/stale v9.1.0 -> v11.0.0 - lukka/get-cmake v4.2.1 -> v4.4.0 - lukka/run-cmake v10.8 -> v10.9 - lukka/run-vcpkg v11.5 -> v11.6 - msys2/setup-msys2 v2.30.0 -> v2.32.0 - ncipollo/release-action v1.20.0 -> v1.21.0 - peter-evans/create-or-update-comment v4.0.0 -> v5.0.0 - peter-evans/find-comment v3.1.0 -> v4.0.0 - cpp-linter/cpp-linter-action v2.16.7 -> v2.20.0 (composite either way) Three findings worth recording: checkout is held at v6, not v7, on purpose. v7 blocks checking out a fork PR under pull_request_target and workflow_run (actions/checkout#2454). Code Style Check is pull_request_target and checks out github.event.pull_request.head.sha from head.repo.full_name, so v7 would break it. v6.1.0 is node24 and keeps that working. upload-artifact v5 was not sufficient: it shipped "preliminary" Node 24 support but still defaulted to node20. v6 is the first release that actually runs on node24. download-artifact v5 changed the output path for single downloads by ID, and github-script v9 removed require('@actions/github'). Neither applies here: the two download sites use merge-multiple with no artifact-ids, and the one github-script uses the injected github/context globals. Also pins the single floating actions/checkout@v6 in build-artifacts.yml to a SHA, matching the convention used everywhere else. --- .github/workflows/build-artifacts.yml | 24 ++++++++++----------- .github/workflows/build.yml | 10 ++++----- .github/workflows/bump-homebrew.yml | 2 +- .github/workflows/check-whitespace.yml | 8 +++---- .github/workflows/clang-format.yml | 4 ++-- .github/workflows/claude-code-review.yml | 2 +- .github/workflows/continuos-release.yml | 6 +++--- .github/workflows/copr-build.yml | 2 +- .github/workflows/ppa-upload.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/repo-device-requested.yml | 2 +- .github/workflows/repo-stale.yml | 2 +- 12 files changed, 35 insertions(+), 35 deletions(-) diff --git a/.github/workflows/build-artifacts.yml b/.github/workflows/build-artifacts.yml index 3dac4633..8c336374 100644 --- a/.github/workflows/build-artifacts.yml +++ b/.github/workflows/build-artifacts.yml @@ -44,7 +44,7 @@ jobs: build_type: unix steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 ref: ${{ inputs.ref }} @@ -61,7 +61,7 @@ jobs: - name: Cache ccache (Linux) if: matrix.os_name == 'linux' - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/ccache key: ${{ matrix.os_name }}-ccache-${{ github.sha }} @@ -77,7 +77,7 @@ jobs: - name: Cache linuxdeploy (Linux) if: matrix.os_name == 'linux' - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: /tmp/linuxdeploy key: linuxdeploy-x86_64-continuous @@ -85,7 +85,7 @@ jobs: # =========== macOS Setup =========== - name: Cache Homebrew if: matrix.os_name == 'macos' - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/Library/Caches/Homebrew @@ -104,14 +104,14 @@ jobs: # =========== Windows Setup =========== - name: Setup vcpkg (Windows) if: matrix.build_type == 'msvc' - uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 + uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11.6 with: vcpkgGitCommitId: '84bab45d415d22042bd0b9081aea57f362da3f35' # 2025.12.12 vcpkgJsonGlob: 'vcpkg.json' - name: Setup CMake and Ninja (Windows) if: matrix.build_type == 'msvc' - uses: lukka/get-cmake@9e07ecdcee1b12e5037e42f410b67f03e2f626e1 # v4.2.1 + uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0 - name: Install NSIS with Large Strings (Windows) if: matrix.build_type == 'msvc' @@ -147,12 +147,12 @@ jobs: # =========== Unix Setup =========== - name: Setup CMake and Ninja (Unix) if: matrix.build_type == 'unix' - uses: lukka/get-cmake@9e07ecdcee1b12e5037e42f410b67f03e2f626e1 # v4.2.1 + uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0 # =========== Build =========== - name: Build and test (Windows) if: matrix.build_type == 'msvc' - uses: lukka/run-cmake@af1be47fd7c933593f687731bc6fdbee024d3ff4 # v10.8 + uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9 with: configurePreset: 'windows-msvc' buildPreset: 'windows-msvc' @@ -160,7 +160,7 @@ jobs: - name: Build and test (Unix) if: matrix.build_type == 'unix' - uses: lukka/run-cmake@af1be47fd7c933593f687731bc6fdbee024d3ff4 # v10.8 + uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9 with: configurePreset: 'default' buildPreset: 'default' @@ -257,7 +257,7 @@ jobs: # =========== Upload =========== - name: Upload artifacts (Linux) if: matrix.os_name == 'linux' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: headsetcontrol-${{ matrix.os_name }} path: | @@ -273,7 +273,7 @@ jobs: - name: Upload artifacts (macOS) if: matrix.os_name == 'macos' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: headsetcontrol-${{ matrix.os_name }} path: | @@ -283,7 +283,7 @@ jobs: - name: Upload artifacts (Windows) if: matrix.build_type == 'msvc' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: headsetcontrol-${{ matrix.os_name }} path: | diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 18f30ac7..edc46db2 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -33,14 +33,14 @@ jobs: shell: msys2 {0} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 # Windows: Setup MSYS2 - name: Setup MSYS2 if: runner.os == 'Windows' - uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: msystem: MINGW64 update: true @@ -52,7 +52,7 @@ jobs: # Linux/macOS: Setup CMake and Ninja - name: Setup CMake and Ninja if: runner.os != 'Windows' - uses: lukka/get-cmake@9e07ecdcee1b12e5037e42f410b67f03e2f626e1 # v4.2.1 + uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0 # Linux: Install GCC 13 for C++20 support - name: Install GCC 13 (Ubuntu) @@ -72,7 +72,7 @@ jobs: # Linux/macOS: Build with CMake Presets - name: Build and test (Unix) if: runner.os != 'Windows' - uses: lukka/run-cmake@af1be47fd7c933593f687731bc6fdbee024d3ff4 # v10.8 + uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9 with: configurePreset: 'default' buildPreset: 'default' @@ -95,7 +95,7 @@ jobs: # Upload Windows artifact for testing - name: Upload Windows artifact if: runner.os == 'Windows' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: headsetcontrol-windows-mingw path: build/headsetcontrol.exe diff --git a/.github/workflows/bump-homebrew.yml b/.github/workflows/bump-homebrew.yml index 0c3b7ee2..4d5f1309 100644 --- a/.github/workflows/bump-homebrew.yml +++ b/.github/workflows/bump-homebrew.yml @@ -35,7 +35,7 @@ jobs: echo "Bumping to $TAG ($sha)" - name: Checkout tap - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: repository: Sapd/homebrew-headsetcontrol ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }} diff --git a/.github/workflows/check-whitespace.yml b/.github/workflows/check-whitespace.yml index 4d7afbc2..b40e10b6 100644 --- a/.github/workflows/check-whitespace.yml +++ b/.github/workflows/check-whitespace.yml @@ -11,7 +11,7 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 @@ -55,7 +55,7 @@ jobs: # Always look for existing comment (to update or delete) - name: Find existing comment - uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0 + uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 id: find-comment with: issue-number: ${{ github.event.pull_request.number }} @@ -65,7 +65,7 @@ jobs: # Delete old failure comment when check passes - name: Delete old comment if check passes if: steps.check.outputs.has_errors == 'false' && steps.find-comment.outputs.comment-id != '' - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | await github.rest.issues.deleteComment({ @@ -77,7 +77,7 @@ jobs: # Create or update failure comment - name: Create or update PR comment if: steps.check.outputs.has_errors == 'true' - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 with: comment-id: ${{ steps.find-comment.outputs.comment-id }} issue-number: ${{ github.event.pull_request.number }} diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml index 8ea6891f..e17e070a 100644 --- a/.github/workflows/clang-format.yml +++ b/.github/workflows/clang-format.yml @@ -19,14 +19,14 @@ jobs: # Security note: Checking out fork code with pull_request_target is safe here # because clang-format only parses source files for formatting, it does not # execute any code. No build scripts or PR code are run. - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 ref: ${{ github.event.pull_request.head.sha }} repository: ${{ github.event.pull_request.head.repo.full_name }} - name: Run cpp-linter - uses: cpp-linter/cpp-linter-action@b6edc0625e3941baa1797f4b4326adeab6890c97 # v2.16.7 + uses: cpp-linter/cpp-linter-action@8e85cd02c8c3fe3ae527c94b5683fe2366b144ed # v2.20.0 id: linter env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index e9a5881d..af3bb8e9 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -24,7 +24,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 1 ref: ${{ github.event.pull_request.head.sha || format('refs/pull/{0}/merge', inputs.pr_number) }} diff --git a/.github/workflows/continuos-release.yml b/.github/workflows/continuos-release.yml index 8c8efd9e..6c875255 100644 --- a/.github/workflows/continuos-release.yml +++ b/.github/workflows/continuos-release.yml @@ -32,12 +32,12 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Download all artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: merge-multiple: true path: ./artifacts @@ -95,7 +95,7 @@ jobs: echo "*Built from [\`${GITHUB_SHA:0:7}\`](https://github.com/${{ github.repository }}/commit/${{ github.sha }})*" >> CHANGELOG.md - name: Create/Update release - uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: tag: continuous name: 'Continuous Build' diff --git a/.github/workflows/copr-build.yml b/.github/workflows/copr-build.yml index e603fe4d..c4b8e9c5 100644 --- a/.github/workflows/copr-build.yml +++ b/.github/workflows/copr-build.yml @@ -26,7 +26,7 @@ jobs: env: TAG: ${{ github.event.release.tag_name || inputs.tag }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 ref: ${{ github.event.release.tag_name || inputs.tag }} diff --git a/.github/workflows/ppa-upload.yml b/.github/workflows/ppa-upload.yml index b31da99b..66601138 100644 --- a/.github/workflows/ppa-upload.yml +++ b/.github/workflows/ppa-upload.yml @@ -36,7 +36,7 @@ jobs: DEBFULLNAME: Denis Arnst SIGN_KEY: 893E9C96C0E1A0CE52CF88FD12C8E71EC92CF077 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 ref: ${{ github.event.inputs.tag || github.ref }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a18f663d..5b06bf0d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,13 +38,13 @@ jobs: env: TAG: ${{ github.event.inputs.tag || github.ref_name }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 ref: ${{ env.TAG }} - name: Download all artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: merge-multiple: true path: ./artifacts @@ -86,7 +86,7 @@ jobs: echo "Signed artifacts:"; ls -1 - name: Create release - uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: tag: ${{ env.TAG }} name: ${{ env.TAG }} diff --git a/.github/workflows/repo-device-requested.yml b/.github/workflows/repo-device-requested.yml index 32cad406..5dfed40c 100644 --- a/.github/workflows/repo-device-requested.yml +++ b/.github/workflows/repo-device-requested.yml @@ -12,7 +12,7 @@ jobs: issues: write steps: - name: Add helpful comment - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 with: issue-number: ${{ github.event.issue.number }} body: | diff --git a/.github/workflows/repo-stale.yml b/.github/workflows/repo-stale.yml index 4885aa96..3532a116 100644 --- a/.github/workflows/repo-stale.yml +++ b/.github/workflows/repo-stale.yml @@ -12,7 +12,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: stale-issue-message: > This issue has been automatically marked as stale because it has been From be928990c3a893e3d981b8f226de13a2a8cb1956 Mon Sep 17 00:00:00 2001 From: Denis Arnst Date: Thu, 30 Jul 2026 14:06:05 +0200 Subject: [PATCH 2/3] ci: make the code style check actually enforce, and drop pull_request_target Two defects, and they compound: the job took on the risk of pull_request_target while enforcing nothing. 1. The gate never fired. The step read steps.linter.outputs.format-checks-failed, which is not an output cpp-linter exposes -- it publishes checks-failed, clang-tidy-checks-failed and clang-format-checks-failed. Verified against both the old pin (v2.16.7) and the current one (v2.20.0), so this is not fallout from the version bump. The expression resolved to empty, '' > 0 is false, and the failure step was always skipped: the job annotated the offending lines and then exited 0. The last 40 runs are all green. 2. pull_request_target was unnecessary. Nothing in the job calls a write API: thread-comments is explicitly false, while step-summary writes a file and file-annotations emits workflow commands, neither of which needs a permission. So pull-requests: write was never used, and checking out fork code under the base-repo token bought nothing. Switching to pull_request keeps both feedback channels working -- fork PRs get a read-only token, which is all this job ever needed -- and removes the privileged context entirely. The `repository:` input goes away because GitHub replicates the PR head into the base repo, so the head SHA is fetchable without it; check-whitespace.yml already relies on this. Expect this to turn red on any open PR that has real formatting violations. That is the point, but it surfaces all at once rather than gradually. --- .github/workflows/clang-format.yml | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml index e17e070a..c321ac6e 100644 --- a/.github/workflows/clang-format.yml +++ b/.github/workflows/clang-format.yml @@ -1,7 +1,7 @@ name: Code Style Check on: - pull_request_target: + pull_request: paths: - '**.c' - '**.cpp' @@ -14,16 +14,19 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - pull-requests: write steps: - # Security note: Checking out fork code with pull_request_target is safe here - # because clang-format only parses source files for formatting, it does not - # execute any code. No build scripts or PR code are run. + # Runs on pull_request, not pull_request_target: this job needs no write + # access, so it does not need the base-repo token. Feedback goes out via + # the step summary and file annotations, neither of which touches an API. + # Fork PRs therefore work with the read-only token they are granted, and + # untrusted PR code cannot reach anything privileged. + # + # No `repository:` input is needed -- GitHub replicates the PR head into + # the base repo, so the head SHA is fetchable from here. - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 ref: ${{ github.event.pull_request.head.sha }} - repository: ${{ github.event.pull_request.head.repo.full_name }} - name: Run cpp-linter uses: cpp-linter/cpp-linter-action@8e85cd02c8c3fe3ae527c94b5683fe2366b144ed # v2.20.0 @@ -36,16 +39,16 @@ jobs: version: '18' files-changed-only: true lines-changed-only: false - # Disable thread-comments to avoid 403 errors - # The commits comments API requires contents:write which is unsafe with pull_request_target - # Use step-summary and file-annotations for feedback instead + # Thread comments need the commits API (contents:write), which a fork + # PR's read-only token cannot use. Feedback goes via step-summary and + # file-annotations instead, which need no permissions at all. thread-comments: false step-summary: true file-annotations: true extensions: 'c,cpp,h,hpp' - name: Fail if formatting issues found - if: steps.linter.outputs.format-checks-failed > 0 + if: steps.linter.outputs.clang-format-checks-failed > 0 run: | - echo "::error::Found ${{ steps.linter.outputs.format-checks-failed }} formatting issues" + echo "::error::Found ${{ steps.linter.outputs.clang-format-checks-failed }} formatting issues" exit 1 From f19dd48240398f854fcf9199411390d62916e29f Mon Sep 17 00:00:00 2001 From: Denis Arnst Date: Thu, 30 Jul 2026 14:06:35 +0200 Subject: [PATCH 3/3] ci: move actions/checkout to v7 Held back at v6 in the first commit of this branch because v7 blocks checking out a fork PR under pull_request_target and workflow_run (actions/checkout#2454), which the code style check relied on. That job now runs on plain pull_request, so nothing in the repo trips the guard: - no workflow uses pull_request_target or workflow_run any more - the only cross-repository checkout left is the Homebrew tap in bump-homebrew.yml, which runs on release/workflow_dispatch against a trusted repo with a deploy key, not on a fork PR 10 pins updated, v6.1.0 -> v7.0.1. --- .github/workflows/build-artifacts.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/bump-homebrew.yml | 2 +- .github/workflows/check-whitespace.yml | 2 +- .github/workflows/clang-format.yml | 2 +- .github/workflows/claude-code-review.yml | 2 +- .github/workflows/continuos-release.yml | 2 +- .github/workflows/copr-build.yml | 2 +- .github/workflows/ppa-upload.yml | 2 +- .github/workflows/release.yml | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-artifacts.yml b/.github/workflows/build-artifacts.yml index 8c336374..db4273fc 100644 --- a/.github/workflows/build-artifacts.yml +++ b/.github/workflows/build-artifacts.yml @@ -44,7 +44,7 @@ jobs: build_type: unix steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ inputs.ref }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index edc46db2..852c574e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -33,7 +33,7 @@ jobs: shell: msys2 {0} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/bump-homebrew.yml b/.github/workflows/bump-homebrew.yml index 4d5f1309..6d46832e 100644 --- a/.github/workflows/bump-homebrew.yml +++ b/.github/workflows/bump-homebrew.yml @@ -35,7 +35,7 @@ jobs: echo "Bumping to $TAG ($sha)" - name: Checkout tap - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Sapd/homebrew-headsetcontrol ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }} diff --git a/.github/workflows/check-whitespace.yml b/.github/workflows/check-whitespace.yml index b40e10b6..0b634621 100644 --- a/.github/workflows/check-whitespace.yml +++ b/.github/workflows/check-whitespace.yml @@ -11,7 +11,7 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml index c321ac6e..16f4ddc8 100644 --- a/.github/workflows/clang-format.yml +++ b/.github/workflows/clang-format.yml @@ -23,7 +23,7 @@ jobs: # # No `repository:` input is needed -- GitHub replicates the PR head into # the base repo, so the head SHA is fetchable from here. - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ github.event.pull_request.head.sha }} diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index af3bb8e9..f98ea7ff 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -24,7 +24,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 ref: ${{ github.event.pull_request.head.sha || format('refs/pull/{0}/merge', inputs.pr_number) }} diff --git a/.github/workflows/continuos-release.yml b/.github/workflows/continuos-release.yml index 6c875255..5c1e003a 100644 --- a/.github/workflows/continuos-release.yml +++ b/.github/workflows/continuos-release.yml @@ -32,7 +32,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/copr-build.yml b/.github/workflows/copr-build.yml index c4b8e9c5..43a883e6 100644 --- a/.github/workflows/copr-build.yml +++ b/.github/workflows/copr-build.yml @@ -26,7 +26,7 @@ jobs: env: TAG: ${{ github.event.release.tag_name || inputs.tag }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ github.event.release.tag_name || inputs.tag }} diff --git a/.github/workflows/ppa-upload.yml b/.github/workflows/ppa-upload.yml index 66601138..446f15b1 100644 --- a/.github/workflows/ppa-upload.yml +++ b/.github/workflows/ppa-upload.yml @@ -36,7 +36,7 @@ jobs: DEBFULLNAME: Denis Arnst SIGN_KEY: 893E9C96C0E1A0CE52CF88FD12C8E71EC92CF077 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ github.event.inputs.tag || github.ref }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5b06bf0d..fc89ac95 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,7 +38,7 @@ jobs: env: TAG: ${{ github.event.inputs.tag || github.ref_name }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ env.TAG }}