ci: Node 24 for UI jobs and pin Actions to SHAs - #37
Merged
Conversation
Replace moving @v4/@v5 tags with immutable commit SHAs on the Node 24 action line, pin the runner to ubuntu-24.04, and install Node 24.18.0 for ui-check and ui-e2e instead of a floating 20.
PR Review — Loreframe StudioRisk: low Automated review from Findings
Changed files
CONTRIBUTING checklist
Posted by the repo PR review workflow. Re-runs on each push to the PR. |
Owner
Author
|
cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit c132413. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Qué
Quita el aviso de Node 20 en CI y endurece el suministro de las GitHub Actions.
ui-checkyui-e2einstalan Node 24.18.0 (versión exacta,check-latest: false). Compatible: la UI ya pasanpm testy Playwright en esa versión.actions/checkoutv6.1.0d23441a48e516b6c34aea4fa41551a30e30af803actions/setup-nodev6.5.0249970729cb0ef3589644e2896645e5dc5ba9c38actions/setup-pythonv6.3.0ece7cb06caefa5fff74198d8649806c4678c61a1actions/upload-artifactv6.0.0b7c566a772e6b6bfb58ed0dc250532a479d7789fubuntu-latest→ubuntu-24.04.No usa tags móviles (
@v4,@latest,node-version: 24).Relación con #36
Disjunto. #36 solo añade
ui/tests/agentCapabilityPorts.test.mjs. Este PR solo toca.github/workflows/. Se pueden mezclar en cualquier orden.No hace
Dueño del merge: humano. No auto-merge.
Note
Low Risk
Workflow-only changes; supply-chain pinning and a Node major bump in CI with no product runtime impact.
Overview
Hardens CI and PR review workflows by pinning all third-party Actions to immutable commit SHAs (with version comments only for docs) and documenting that moving tags like
@v4must not be used.Runner and Node: All jobs move from
ubuntu-latesttoubuntu-24.04.ui-checkandui-e2einstall Node 24.18.0 withcheck-latest: falseinstead of Node 20. Python guard/review jobs stay on 3.10.Action upgrades:
actions/checkout,setup-node,setup-python, andupload-artifactare bumped to the v6 line at the pinned SHAs listed in the workflow files. No application or UI source changes—only.github/workflows/ci.ymlandpr-review.yml.Reviewed by Cursor Bugbot for commit c132413. Configure here.