ci(release): Switch from action-prepare-release to Craft #707
Conversation
This PR migrates from the deprecated action-prepare-release to the new Craft GitHub Actions (reusable workflow or composite action). Changes: - Migrate .github/workflows/release.yml to Craft reusable workflow
Semver Impact of This PR🟢 Patch (bug fixes) 📋 Changelog PreviewThis is how your changes will appear in the changelog. New Features ✨Cloudflare
Other
Bug Fixes 🐛Cloudflare
Other
Build / dependencies / internal 🔧
Other
🤖 This preview updates automatically when you update the PR. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The previous migration incorrectly removed the GitHub App token authentication step. This commit restores it by switching to the composite action pattern which preserves the auth flow.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
will defer to you on this one, try the fix-bugs etc flows we added to the sentry skill tho migh be helpful (also deslop is helpful potentially) |
.github/workflows/deploy.yml
Outdated
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v2 |
There was a problem hiding this comment.
Checkout action downgraded from v4 to v2
High Severity
The actions/checkout action is being changed from @v4 to a SHA with comment # v2 across multiple workflow files. This represents a significant version downgrade. Version 2 uses deprecated Node.js 12 (EOL since 2022), which may cause deprecation warnings or failures in GitHub Actions runners. The correct SHA for v4 (or newer) should be used instead. This affects deploy.yml, eval.yml, merge-jobs.yml, release.yml, smoke-tests.yml, test.yml, and token-cost.yml.
🔬 Verification Test
Why verification test was not possible: This is a GitHub Actions workflow configuration issue that cannot be verified through local testing. The bug is evident from the diff itself - the comment # v2 explicitly indicates the SHA corresponds to actions/checkout version 2, while the previous configuration used @v4. The impact would only be visible when the workflows run on GitHub's infrastructure, where Node 12 deprecation warnings or errors would occur.
Summary
This PR migrates from the deprecated
action-prepare-releaseto the new Craft GitHub Actions.Changes
.github/workflows/release.ymlto Craft reusable workflowDocumentation
See https://getsentry.github.io/craft/github-actions/ for more information.