From 8ff3fe29d959877fbc881c7df89bc807a295b1ad Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Thu, 17 Sep 2026 11:55:09 +0200 Subject: [PATCH 1/3] ci: pin actions to Node 24-native majors, use commit SHA pinning actions/checkout@v4 and actions/setup-node@v4 still declare node20 in their action metadata, so GitHub Actions runners now force them onto Node 24 with a deprecation warning. actions/upload-artifact@v4 has the same issue. Bump all three to their latest Node 24-native majors (checkout v7.0.1, setup-node v7.0.0, upload-artifact v7.0.1) and pin by commit SHA with a version comment instead of a floating tag. --- .github/workflows/build.yaml | 6 +++--- .github/workflows/publish.yaml | 4 ++-- .github/workflows/test-positron.yaml | 4 ++-- .github/workflows/test.yaml | 8 ++++---- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 0688d69b1..6ff35c7cf 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -22,8 +22,8 @@ jobs: outputs: vsixPath: ${{ steps.package_extension.outputs.vsixPath }} steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: latest - run: yarn install --immutable --immutable-cache --check-cache @@ -39,7 +39,7 @@ jobs: packagePath: apps/vscode - name: Upload extension vsix file as a workflow artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: quarto-vscode-${{ github.sha }} path: ${{ steps.package_extension.outputs.vsixPath }} diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index d1ba4e3f6..ef61dba3b 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -16,8 +16,8 @@ jobs: outputs: vsixPath: ${{ steps.publish_extension.outputs.vsixPath }} steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: latest - run: yarn install --immutable --immutable-cache --check-cache diff --git a/.github/workflows/test-positron.yaml b/.github/workflows/test-positron.yaml index 0b5eba253..f8e785d20 100644 --- a/.github/workflows/test-positron.yaml +++ b/.github/workflows/test-positron.yaml @@ -20,8 +20,8 @@ jobs: runs-on: ubuntu-latest name: Test Positron API steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: latest - uses: quarto-dev/quarto-actions/setup@v2 diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 775d85757..96dd1b7cf 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -14,8 +14,8 @@ jobs: runs-on: ubuntu-latest name: Test packages steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: latest - run: yarn install --immutable --immutable-cache --check-cache @@ -30,8 +30,8 @@ jobs: quarto: [release, pre-release] name: Test (Quarto ${{ matrix.quarto }}) steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: latest - name: Update build environment and install XVFB From ba2cfb1ce805137d45733c37e5a05d8ed051c84d Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Thu, 17 Sep 2026 12:11:48 +0200 Subject: [PATCH 2/3] ci: pin remaining third-party actions to commit SHAs HaaLeo/publish-vscode-extension, euberdeveloper/ga-project-version, softprops/action-gh-release, quarto-dev/quarto-actions/setup, and posit-dev/setup-positron were still referenced by mutable tags or a branch (ga-project-version@main). Pin each to the commit SHA behind its currently-used version, matching the SHA-pinning approach applied to the GitHub-owned actions in the previous commit. --- .github/workflows/build.yaml | 2 +- .github/workflows/publish.yaml | 8 ++++---- .github/workflows/test-positron.yaml | 4 ++-- .github/workflows/test.yaml | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 6ff35c7cf..8dd1521bc 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -29,7 +29,7 @@ jobs: - run: yarn install --immutable --immutable-cache --check-cache - name: Package extension - uses: HaaLeo/publish-vscode-extension@v2 + uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2 id: package_extension with: pat: not-a-real-pat diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index ef61dba3b..322c832cf 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -23,7 +23,7 @@ jobs: - run: yarn install --immutable --immutable-cache --check-cache - name: Publish to Visual Studio Marketplace - uses: HaaLeo/publish-vscode-extension@v2 + uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2 id: publish_extension with: pat: ${{ secrets.VS_MARKETPLACE_TOKEN }} @@ -32,7 +32,7 @@ jobs: packagePath: apps/vscode - name: Publish to Open VSX Registry - uses: HaaLeo/publish-vscode-extension@v2 + uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2 with: pat: ${{ secrets.OPEN_VSX_TOKEN }} yarn: true @@ -40,12 +40,12 @@ jobs: - name: Get version of VS Code extension to publish id: extension-version - uses: 'euberdeveloper/ga-project-version@main' + uses: euberdeveloper/ga-project-version@5ddfd05bca46829074510125c27850b39714d6a9 # main with: path: apps/vscode/package.json - name: Publish GH release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 with: name: VSC extension - v${{ steps.extension-version.outputs.version }} tag_name: v${{ steps.extension-version.outputs.version }}-vsix diff --git a/.github/workflows/test-positron.yaml b/.github/workflows/test-positron.yaml index f8e785d20..ac2291ac2 100644 --- a/.github/workflows/test-positron.yaml +++ b/.github/workflows/test-positron.yaml @@ -24,13 +24,13 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: latest - - uses: quarto-dev/quarto-actions/setup@v2 + - uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2 - name: Build vscode extension run: | yarn install yarn run build-vscode - name: Run Positron API tests - uses: posit-dev/setup-positron@v1 + uses: posit-dev/setup-positron@fe12658acf186daf3c9196a3d04783746704af22 # v1 with: positron-channel: stable # Positron is an Electron app and needs a display server on Linux. diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 96dd1b7cf..cebaf85cd 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -38,7 +38,7 @@ jobs: run: | sudo apt-get -y update sudo apt-get -y install --fix-missing xvfb - - uses: quarto-dev/quarto-actions/setup@v2 + - uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2 with: version: ${{ matrix.quarto }} - name: Build vscode extension From 49e7b30a24dce10dd9d3f8fc09ebb605d814c85d Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Fri, 18 Sep 2026 12:05:03 +0200 Subject: [PATCH 3/3] Use tags and np hash for workflow actions --- .github/workflows/build.yaml | 8 ++++---- .github/workflows/publish.yaml | 12 ++++++------ .github/workflows/test-positron.yaml | 8 ++++---- .github/workflows/test.yaml | 10 +++++----- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 8dd1521bc..16f4aa1a4 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -22,14 +22,14 @@ jobs: outputs: vsixPath: ${{ steps.package_extension.outputs.vsixPath }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: latest - run: yarn install --immutable --immutable-cache --check-cache - name: Package extension - uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2 + uses: HaaLeo/publish-vscode-extension@v2 id: package_extension with: pat: not-a-real-pat @@ -39,7 +39,7 @@ jobs: packagePath: apps/vscode - name: Upload extension vsix file as a workflow artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7 with: name: quarto-vscode-${{ github.sha }} path: ${{ steps.package_extension.outputs.vsixPath }} diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 322c832cf..054c4e998 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -16,14 +16,14 @@ jobs: outputs: vsixPath: ${{ steps.publish_extension.outputs.vsixPath }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: latest - run: yarn install --immutable --immutable-cache --check-cache - name: Publish to Visual Studio Marketplace - uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2 + uses: HaaLeo/publish-vscode-extension@v2 id: publish_extension with: pat: ${{ secrets.VS_MARKETPLACE_TOKEN }} @@ -32,7 +32,7 @@ jobs: packagePath: apps/vscode - name: Publish to Open VSX Registry - uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2 + uses: HaaLeo/publish-vscode-extension@v2 with: pat: ${{ secrets.OPEN_VSX_TOKEN }} yarn: true @@ -40,12 +40,12 @@ jobs: - name: Get version of VS Code extension to publish id: extension-version - uses: euberdeveloper/ga-project-version@5ddfd05bca46829074510125c27850b39714d6a9 # main + uses: euberdeveloper/ga-project-version@v5 with: path: apps/vscode/package.json - name: Publish GH release - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 + uses: softprops/action-gh-release@v2 with: name: VSC extension - v${{ steps.extension-version.outputs.version }} tag_name: v${{ steps.extension-version.outputs.version }}-vsix diff --git a/.github/workflows/test-positron.yaml b/.github/workflows/test-positron.yaml index ac2291ac2..94df29c7d 100644 --- a/.github/workflows/test-positron.yaml +++ b/.github/workflows/test-positron.yaml @@ -20,17 +20,17 @@ jobs: runs-on: ubuntu-latest name: Test Positron API steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: latest - - uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2 + - uses: quarto-dev/quarto-actions/setup@v2 - name: Build vscode extension run: | yarn install yarn run build-vscode - name: Run Positron API tests - uses: posit-dev/setup-positron@fe12658acf186daf3c9196a3d04783746704af22 # v1 + uses: posit-dev/setup-positron@v1 with: positron-channel: stable # Positron is an Electron app and needs a display server on Linux. diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index cebaf85cd..d630bf085 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -14,8 +14,8 @@ jobs: runs-on: ubuntu-latest name: Test packages steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: latest - run: yarn install --immutable --immutable-cache --check-cache @@ -30,15 +30,15 @@ jobs: quarto: [release, pre-release] name: Test (Quarto ${{ matrix.quarto }}) steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: latest - name: Update build environment and install XVFB run: | sudo apt-get -y update sudo apt-get -y install --fix-missing xvfb - - uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2 + - uses: quarto-dev/quarto-actions/setup@v2 with: version: ${{ matrix.quarto }} - name: Build vscode extension