CD workflows: pin GitHub Actions to @v4 instead of @master
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 78/100
- Issue 类型
- 重构
- 描述清晰度
- 描述清楚
- 活跃度
- 冷清
- 技术栈
- github-actions
- 领域
- ci-cd
调研方向
从 .github/workflows/cd_dev.yaml 和 .github/workflows/cd_prod.yaml 开始，然后将其中的 action 引用与 tests.yaml 和 shared_openapi_sync.yaml 进行比较。将列出的 @master 引用替换为 @v4，并确认 .github/workflows/ 下不再有 @master 引用；CI 通过即完成工作。
由索引模型根据 Issue 内容生成。
描述
Summary
Our CD workflows pin GitHub Actions to the moving @master branch instead of a stable major-version tag like @v4. Every workflow run silently picks up whatever HEAD of actions/checkout, actions/setup-node, and actions/cache happens to be — there is no diff in this repo when those upstream branches change, so a green PR yesterday can fail today for reasons we cannot see.
Affected workflows
.github/workflows/cd_dev.yaml— 5 occurrences (3×actions/checkout@master, 1×actions/setup-node@master, 1×actions/cache@master).github/workflows/cd_prod.yaml— 2 occurrences ofactions/checkout@master
Our newer workflows (tests.yaml, shared_openapi_sync.yaml) already pin actions/checkout@v4 and actions/setup-node@v4, so the inconsistency is internal to this repo too.
Why this matters
- Reproducibility — same YAML produces different behavior over time.
- Supply-chain surface — a malicious or accidental commit to
actions/checkout's master branch propagates to every run immediately. - Breaking changes — when
actions/checkout@v5ships,@masterconsumers get the breakage at the next run with no warning. - GitHub's own guidance explicitly recommends pinning to a major version tag or a SHA. Major-version tags (
@v4) still receive patch/security updates automatically.
Cross-repo alignment
- RERUM v1 (
CenterForDigitalHumanities/rerum_server_nodejs) already uses@v4across all CI/CD workflows. - TPEN-services has the same drift — tracked in CenterForDigitalHumanities/TPEN-services#525.
- TinyPEN has the same drift — tracked in CenterForDigitalHumanities/TinyPen#50.
Proposed fix
Normalize the two CD workflows to:
actions/checkout@v4actions/setup-node@v4actions/cache@v4
Small, contained sweep; no behavior changes expected (these are the same versions the existing tests.yaml and shared_openapi_sync.yaml already run on).
Acceptance criteria
- No
@masterreferences remain in.github/workflows/. - All
actions/checkout,actions/setup-node,actions/cachereferences in CD workflows pin to@v4. - CI passes on the sweep PR.
Out of scope
- Pinning to commit SHAs — first-party
actions/*major-version tags are sufficient. - TPEN-services and TinyPEN cleanups — separate issues.
- 主要语言
- JavaScript
- 星标
- 1
- 派生
- 3
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
CenterForDigitalHumanities/TinyNode 的其他 Issue
-
dependencies enhancement
难度 2/5 1-3 小时 新手友好度 90/100
-
bug
难度 4/5 3-5 天 新手友好度 48/100
-
copilot
难度 4/5 3-5 天 新手友好度 35/100
-
copilot
难度 5/5 一周以上 新手友好度 35/100
-
难度 3/5 1-2 天 新手友好度 35/100
查看 CenterForDigitalHumanities/TinyNode 的全部 Issue
相似的 Issue
-
self-driving
难度 1/5 1-3 小时 新手友好度 86/100
维护者通常 1 天内回复
-
kind:bug needs-triage
难度 2/5 1-3 小时 新手友好度 66/100
维护者通常 1 天内回复
-
status: needs triage
难度 2/5 1-3 小时 新手友好度 78/100
mastra-ai/mastra#28500 · 1 条评论 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 82/100
fossasia/scrum_helper#949 ·
维护者通常 2 天内回复
-
难度 1/5 1 小时以内 新手友好度 88/100
Foundryborne/daggerheart#2531 ·
维护者通常 1 天内回复