Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Bump actions/checkout to v5 across devops, devops-security and incubator

Offen
  • Stimmt etwas nicht?
#183 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
68/100
Issue-Typ
Refactoring
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
aws, git, github-actions
Bereich
ci-cd, cloud, devops, infrastructure

Rechercherichtung

Beginne damit, die aufgeführten Verwendungen zu finden: Zeilen in .github/workflows/add-update-label-weekly.yml, terraform-apply.yaml und terraform-plan.yaml in den drei Repositories, und lies anschließend die Migrationshinweise für github-script v7-to-v8. Aktualisiere nur die angegebenen Action-Pins, überprüfe incubator's Plan und den Push-back von terraform-docs und verwende git grep, um zu bestätigen, dass keine der gezielten alten Pins mehr vorhanden sind; beachte, dass devops nicht ausgeführt werden kann und devops-security für die Verifizierung einen späteren Terraform-auslösenden PR benötigt.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

complexity: medium feature: maintenance role: DevOps Engineer size: 2pt
Overview

We need to move the remaining six actions/checkout pins in devops, devops-security and incubator to @v5, and devops's actions/github-script to @v8, because all of them target Node.js 20 — GitHub has deprecated it and is force-running these on Node 24 today, so the workflows break when that fallback is withdrawn.

This is one decision and one pass across three repos, so it is one issue and three small PRs for one assignee, following the pattern of #174. The bot repo's four pins are already covered by #182 and are not part of this.

Action Items

Applies to all three repos: bump to v5, not v6 or v7, even though v7 is current. v5 is the pure Node 24 bump with no behaviour change. v6 moved the persisted git credential into a separate file, which matters wherever a workflow pushes after checkout — incubator's terraform-docs job does exactly that. v7 additionally blocks fork checkouts for pull_request_target/workflow_run. Going fully current is a real upgrade needing a real test; keep it a separate decision.

hackforla/devops — 1 PR, 2 lines in .github/workflows/add-update-label-weekly.yml:

  • Line 11: actions/checkout@v4 to @v5.
  • Line 12: actions/github-script@v7 to @v8. v8 is the Node 24 bump (current is v9). Read the v7 to v8 migration notes before assuming it is a version bump: this step's script does require('./github-actions/trigger-schedule/add-update-label-weekly/add-label.js'), i.e. it loads a local CommonJS module, which is the part most likely to be affected.
  • Expect not to be able to verify this one, and say so in the PR. The workflow is currently disabled_inactivity — GitHub disabled it for repository inactivity, the same failure that took the bot down in #180 — and its only trigger is schedule: (Sundays 07:00 UTC), with no workflow_dispatch, so it cannot be run manually either. gh api repos/hackforla/devops/actions/workflows/add-update-label-weekly.yml/runs returns total_count: 0.
  • Do not re-enable it, add a workflow_dispatch trigger, or add a keepalive as part of this ticket. That is separate work of the same shape as #180 and needs its own decision about whether this automation should still run at all. Flag it in the PR and move on.

hackforla/devops-security — 1 PR, 2 lines:

  • terraform-apply.yaml:23 and terraform-plan.yaml:23: actions/checkout@v4 to @v5.
  • Both workflows filter on paths: '**/*.tf', so a PR that only edits .github/workflows/*.yaml will not trigger either of them and the PR will show no checks at all. That is expected, not a failure. To exercise the plan workflow in the same PR, include a no-op change to a .tf file (a comment line); otherwise leave it and verify after merge.
  • After the PR merges, confirm the next PR that touches a .tf file runs Write Terraform Plan to Pull Request successfully with no "Node.js 20 is deprecated" annotation. terraform-apply.yaml only runs on push to main and performs a real apply, so it is verified by that same merge, not by anything on a branch.

hackforla/incubator — 1 PR, 3 lines:

  • terraform-apply.yaml:31 and terraform-plan.yaml:31: actions/checkout@v4 to @v5.
  • terraform-plan.yaml:55: actions/checkout@v3 to @v5 — this is the terraform-docs job and it is two major versions behind, the furthest behind anything in the org.
  • Unlike devops-security, incubator's path filter includes **/*.yaml, so this PR triggers Terraform plan (OIDC) on itself. Both of its jobs should run on the PR — use that.
  • Watch the terraform-docs job specifically. It checks out ref: ${{ github.event.pull_request.head.ref }} and runs terraform-docs/gh-actions with git-push: "true", pushing a commit back to the PR branch. It is the only job in any of these repos that writes to git after checkout, so it is the one place a checkout change could plausibly break something. Confirm the push-back still happens.
  • Confirm the terraform-plan job still assumes arn:aws:iam::035866691871:role/incubator-tf-plan via OIDC and produces a plan.

All three:

  • Do not touch third-party actions in this pass, even though several are further behind: aws-actions/configure-aws-credentials is on v1 in incubator's bastion.yml:34 and v3 in its two terraform workflows against v4 in devops-security, hmarr/[email protected] has not been released against in years, and terraform-docs/gh-actions is pinned at v1.4.1. Each of those is a real upgrade rather than a version bump and deserves its own ticket.
  • After all three PRs merge, re-run the sweep to confirm nothing was missed: git grep -n "uses: actions/" -- .github/workflows in each repo should show no checkout@v3, no checkout@v4, and no github-script@v7.
Resources/Instructions
  • Line numbers were accurate 2026-08-24 and may drift — locate each pin by its uses: line rather than by position.
  • The full inventory this ticket came from, for cross-checking: devops add-update-label-weekly.yml:11,12; devops-security terraform-apply.yaml:23, terraform-plan.yaml:23; incubator terraform-apply.yaml:31, terraform-plan.yaml:31,55.
  • Release notes, for the version reasoning above: checkout v5.0.0, v6.0.0, v7.0.0; github-script v8.0.0. Both v5 and v8 require runner v2.327.1 or newer, which GitHub-hosted runners are well past.
  • Related: #182, the same bump for the four pins in hackforla/check-ghpages-versions. Doing that one first is not required, but it is the lowest-risk of the set.
  • Related: #180, for what happens when a scheduled workflow is left disabled — the devops workflow above is in that state now.
Vorherrschende Sprache
PowerShell
Sterne
8
Forks
10
Ø Merge
2 Std. 9 Min.
Gemergte PRs (30 T.)
9

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus hackforla/devops

Alle Issues in hackforla/devops

Ähnliche Issues

Weitere Issues zu DevOps

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.