chore: bump github actions#1126
Conversation
bump actions/checkout to v4 bump actions/setup-go to v5 Signed-off-by: adrianc <adrianc@nvidia.com>
WalkthroughUpdated GitHub Actions workflow versions in .github/workflows/main.yml: actions/checkout moved from v2 to v4 and actions/setup-go from v2 to v5 in both ubuntu-latest and macos-latest jobs. The go-version remains 1.23. No other workflow logic changes. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~7 minutes Poem
✨ Finishing Touches🧪 Generate unit tests
Comment |
|
this one is the same as #1033 but does it in a single commit as required for PRs in this repo. |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/workflows/main.yml (2)
14-14: Checkout v4 bump: consider pinning to commit SHA and (optionally) full history
- Security: pin actions to an exact commit SHA instead of a moving tag.
- If any step needs tags or full history (e.g., git describe, release tooling), set fetch-depth: 0.
- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 # consider pinning to the v4 commit SHA + with: + # set to 0 only if you need tags/full history + fetch-depth: 0Apply similarly to the macOS job.
Also applies to: 33-33
17-19: Enable module caching and optional go.mod version sourcingCI is already using Go v1.23, which matches the project’s
go.mod. To speed up module downloads and lock the Go version to yourgo.mod, consider this update:- name: Set up Go uses: actions/setup-go@v5 # consider pinning to the v5 commit SHA with: go-version: 1.23 + cache: true + cache-dependency-path: | + **/go.sum + # Optional: uncomment to source the version from go.mod + # go-version-file: go.mod
bump actions/checkout to v4
bump actions/setup-go to v5
Summary by CodeRabbit