Skip to content

update GitHub actions in CI workflow #1721

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 9 commits into
base: develop
Choose a base branch
from
Open

update GitHub actions in CI workflow #1721

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2cbf223
Update bridge_history_api.yml
Daulox92 Aug 12, 2025
f641ea2
Update bump_version.yml
Daulox92 Aug 12, 2025
a111052
Update common.yml
Daulox92 Aug 12, 2025
6da8d81
Update coordinator.yml
Daulox92 Aug 12, 2025
6dcf8d4
Update database.yml
Daulox92 Aug 12, 2025
5ef72b4
Update docker-coordinator-api-arm64.yml
Daulox92 Aug 12, 2025
926390d
Update docker.yml
Daulox92 Aug 12, 2025
0af4b61
Update integration.yml
Daulox92 Aug 12, 2025
45ecd14
Update rollup.yml
Daulox92 Aug 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/bridge_history_api.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Lint
run: |
rm -rf $HOME/.cache/golangci-lint
Expand All @@ -48,7 +48,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Test
run: |
make test
Expand All @@ -67,7 +67,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install goimports
run: go install golang.org/x/tools/cmd/goimports
- run: goimports -local scroll-tech/bridge-history-api/ -w .
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/bump_version.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
with:
ref: ${{ github.head_ref }}
- name: check diff
Comment on lines +19 to 22
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

❓ Verification inconclusive

Upgrade to actions/checkout@v5 is fine; consider pinning to a commit SHA.

This job performs git fetch and auto-commit/push, so keep persist-credentials: true (default). Only add pinning.

Apply this pattern after you retrieve the v5.0.0 commit SHA:

-uses: actions/checkout@v5
+uses: actions/checkout@<COMMIT-SHA> # v5.0.0
  with:
    ref: ${{ github.head_ref }}

Also ensure your runners (especially self-hosted, if any) are updated to a version that supports Node 20-based actions, which checkout v5 requires.

Pin checkout action to an immutable commit SHA

To guard against unexpected changes downstream, it’s best to pin actions/checkout v5 to its specific commit SHA while retaining the default persist-credentials: true for your auto-commit/push step:

• File: .github/workflows/bump_version.yml (around lines 19–22)
• Replace:

- uses: actions/checkout@v5
+ uses: actions/checkout@<COMMIT-SHA>  # v5.0.0
  with:
    ref: ${{ github.head_ref }}

• No changes needed for persist-credentials (defaults to true).

Additionally, verify that all runners (especially any self-hosted ones) are on Node 20 or later, as checkout v5 requires Node.js 20+ support.

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
In .github/workflows/bump_version.yml around lines 19 to 22, pin the
actions/checkout@v5 usage to the specific immutable commit SHA instead of the
tag to avoid downstream surprises; update the workflow to reference the exact
commit SHA for actions/checkout while leaving persist-credentials at its default
true for auto-commit/push steps, and verify that all runners (including
self-hosted) run Node.js 20+ since checkout v5 requires Node 20 or newer.

Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Cache cargo
Comment on lines +40 to 41
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Upgrade to actions/checkout@v5 looks good; consider pinning to a commit SHA.

This job doesn’t fetch/push; you can safely disable credential persistence if desired.

-uses: actions/checkout@v5
+uses: actions/checkout@<COMMIT-SHA> # v5.0.0
+with:
+  persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/checkout@v5
- name: Cache cargo
- uses: actions/checkout@<COMMIT-SHA> # v5.0.0
with:
persist-credentials: false
- name: Cache cargo
🤖 Prompt for AI Agents 
.github/workflows/common.yml around lines 40 to 41: the workflow updates
actions/checkout to v5 but should pin to a specific commit SHA to avoid
unexpected breaking changes; update the uses entry to reference the full commit
SHA for actions/checkout@v5, and since this job does not perform fetch/push
operations, set persist-credentials: false in the checkout step to disable
credential persistence.

uses: Swatinem/rust-cache@v2
with:
Expand All @@ -56,7 +56,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install goimports
run: go install golang.org/x/tools/cmd/goimports
- name: Run goimports lint
Expand All @@ -81,7 +81,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install Solc
uses: supplypike/setup-bin@v3
with:
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/coordinator.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Lint
working-directory: 'coordinator'
run: |
Expand All @@ -56,7 +56,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install goimports
run: go install golang.org/x/tools/cmd/goimports
- name: Run goimports lint
Expand All @@ -77,7 +77,7 @@ jobs:
# runs-on: ubuntu-latest
# steps:
# - name: Checkout code
# uses: actions/checkout@v4
# uses: actions/checkout@v5
# - name: Set up Docker Buildx
# uses: docker/setup-buildx-action@v2
# - name: Build and push
Expand All @@ -97,7 +97,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install Solc
uses: supplypike/setup-bin@v3
with:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/database.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Lint
Comment on lines +37 to 38
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Upgrade to actions/checkout@v5 looks good; consider pinning to a commit SHA.

This job runs only local linting; disabling credential persistence is safe.

-uses: actions/checkout@v5
+uses: actions/checkout@<COMMIT-SHA> # v5.0.0
+with:
+  persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/checkout@v5
- name: Lint
uses: actions/checkout@<COMMIT-SHA> # v5.0.0
with:
persist-credentials: false
- name: Lint
🤖 Prompt for AI Agents 
.github/workflows/database.yml lines 37-38: replace the floating tag "uses:
actions/checkout@v5" with a pinned commit reference and disable credential
persistence for this local lint job; specifically, change the checkout action to
use the full commit SHA for the v5 release (e.g., actions/checkout@<commit-sha>)
and add persist-credentials: false under the checkout step so the job is pinned
and does not retain credentials.

working-directory: 'database'
run: |
Expand All @@ -49,7 +49,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install goimports
run: go install golang.org/x/tools/cmd/goimports
- name: Run goimports lint
Expand All @@ -74,7 +74,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install Solc
uses: supplypike/setup-bin@v3
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docker-coordinator-api-arm64.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@v5
- name: Set up QEMU
run: |
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
Expand Down
18 changes: 9 additions & 9 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
group: scroll-reth-runner-group
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Upgrade to actions/checkout@v5 looks good; consider pinning to a commit SHA and (optionally) disabling credential persistence.

  • Pin to a specific SHA for supply-chain hardening (with a trailing comment noting the version).
  • If no git fetch/push occurs later in this job, set persist-credentials: false to avoid leaking the token into git config.

To locate any remaining non-v5 usages and retrieve the recommended pin for v5.0.0, run:

Apply this pattern after obtaining the SHA:

-uses: actions/checkout@v5
+uses: actions/checkout@<COMMIT-SHA> # v5.0.0
+# with:
+#   persist-credentials: false

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Scanning for non-v5 checkout usages..."
rg -n -H $'uses:\\s*actions/checkout@v(1|2|3|4)\\b' || echo "No non-v5 usages found."

echo "Getting commit SHA for actions/checkout v5.0.0..."
gh api repos/actions/checkout/git/refs/tags/v5.0.0 --jq '.object.sha'

Length of output: 434

Pin actions/checkout@v5 to a specific SHA and disable credential persistence

To further harden our supply chain:

  • In .github/workflows/docker.yml (line 17), replace the loose @v5 tag with the concrete commit SHA for v5.0.0.
  • Disable credential persistence unless later steps need to fetch or push.

Suggested patch:

- uses: actions/checkout@v5
+ uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+ with:
+   persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/checkout@v5
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
🤖 Prompt for AI Agents 
.github/workflows/docker.yml around line 17: replace the loose
actions/checkout@v5 reference with the concrete commit SHA corresponding to
v5.0.0 (i.e. actions/checkout@<SHA-of-v5.0.0>) and add persist-credentials:
false to the step to disable credential persistence unless later steps
explicitly need them; ensure the step still uses the v5.0.0 SHA and keep other
step settings unchanged.

- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
Expand Down Expand Up @@ -60,7 +60,7 @@ jobs:
group: scroll-reth-runner-group
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
Expand Down Expand Up @@ -106,7 +106,7 @@ jobs:
group: scroll-reth-runner-group
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
Expand Down Expand Up @@ -152,7 +152,7 @@ jobs:
group: scroll-reth-runner-group
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
Expand Down Expand Up @@ -198,7 +198,7 @@ jobs:
group: scroll-reth-runner-group
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
Expand Down Expand Up @@ -244,7 +244,7 @@ jobs:
group: scroll-reth-runner-group
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
Expand Down Expand Up @@ -290,7 +290,7 @@ jobs:
group: scroll-reth-runner-group
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
Expand Down Expand Up @@ -336,7 +336,7 @@ jobs:
group: scroll-reth-runner-group
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
Expand Down Expand Up @@ -381,7 +381,7 @@ jobs:
group: scroll-reth-runner-group
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Harden checkout usage: pin version and disable credential persistence

To reduce supply-chain risk and avoid persisting tokens in the repo’s .git config during PRs, consider pinning to a fixed version and turning off credential persistence (since no git push happens in this job).

Apply this pattern here (and replicate across workflows):

-      uses: actions/checkout@v5
+      uses: actions/[email protected]
+      with:
+        persist-credentials: false

Run this to confirm all checkouts are migrated and find any remaining v2/v3/v4 (and optionally quantify how many are pinned vs floating majors):

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "All checkout versions found:"
rg -n --no-heading $'uses:\\s*actions/checkout@' -g '.github/workflows/*.yml' || true

echo -e "\nNon-v5 checkout occurrences (should be zero):"
rg -n --no-heading $'uses:\\s*actions/checkout@(v(2|3|4)\\b|main|master)' -g '.github/workflows/*.yml' || true

echo -e "\nUnpinned v5 (floating majors):"
rg -n --no-heading $'uses:\\s*actions/checkout@v5\\b' -g '.github/workflows/*.yml' || true

echo -e "\nPinned to specific v5.x or commit SHA:"
rg -n --no-heading -e $'uses:\\s*actions/checkout@v5\\.[0-9]+' -e $'uses:\\s*actions/checkout@[0-9a-fA-F]{40}' -g '.github/workflows/*.yml' || true

Length of output: 1386

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Workflow files in .github/workflows:"
find .github/workflows -maxdepth 1 -type f -print || true

echo -e "\nOccurrences of actions/checkout in all workflow files:"
rg -Hn 'uses:\s*actions/checkout@' -g '.github/workflows/*' || true

Length of output: 852

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Scanning for actions/checkout usage in workflow YAMLs:"
find .github/workflows -type f -name '*.yml' -print0 \
  | xargs -0 grep -Hn 'uses:\s*actions/checkout@'

Length of output: 2306

Pin checkout action to a fixed v5 minor and disable credential persistence across all workflows

We found one actions/checkout@v4 and 22 floating-major actions/checkout@v5 usages—none are currently pinned to a specific v5.x and none disable credential persistence. Please update all of them to a fixed version (e.g. v5.0.0 or your chosen v5.x.y) and add persist-credentials: false. For example:

-      uses: actions/checkout@v5
+      uses: actions/[email protected]
+      with:
+        persist-credentials: false

Affected locations:

  • .github/workflows/intermediate-docker.yml:77 (v4 → v5.0.0)
  • .github/workflows/bridge_history_api.yml:37, 51, 70
  • .github/workflows/bump_version.yml:19
  • .github/workflows/common.yml:40, 59, 84
  • .github/workflows/coordinator.yml:44, 59, 100
  • .github/workflows/database.yml:37, 52, 77
  • .github/workflows/docker-coordinator-api-arm64.yml:21
  • .github/workflows/docker.yml:17, 63, 109, 155, 201, 247, 293, 339, 384
  • .github/workflows/integration.yml:27
  • .github/workflows/rollup.yml:39, 63, 88
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/checkout@v5
uses: actions/checkout@v5.0.0
with:
persist-credentials: false
🤖 Prompt for AI Agents 
In .github/workflows/integration.yml around line 27, the checkout step uses a
floating major tag; update the step to pin to a fixed v5.x.y (e.g.
actions/[email protected]) and add a with block setting persist-credentials:
false; ensure the new lines are properly indented under the step so the action
uses the pinned version and disables credential persistence.

- name: Install Solc
uses: supplypike/setup-bin@v3
with:
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/rollup.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install Solc
uses: supplypike/setup-bin@v3
with:
Expand All @@ -60,7 +60,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install goimports
run: go install golang.org/x/tools/cmd/goimports
- name: Run goimports lint
Expand All @@ -85,7 +85,7 @@ jobs:
with:
go-version: 1.21.x
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v5
- name: Install Solc
uses: supplypike/setup-bin@v3
with:
Expand Down Expand Up @@ -117,7 +117,7 @@ jobs:
# runs-on: ubuntu-latest
# steps:
# - name: Checkout code
# uses: actions/checkout@v4
# uses: actions/checkout@v5
# - name: Set up Docker Buildx
# uses: docker/setup-buildx-action@v2
# - run: make docker