github: workflows: updating checkout and upload actions - #11166
Open
tmleman wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
actions/cache is pinned to the same SHA as actions/checkout, which is very likely an invalid ref for the cache action and can break the workflow.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates multiple GitHub Actions workflows to pin actions/checkout (and in a few places actions/upload-artifact) to specific commit SHAs to avoid mutable tags and reduce deprecation warnings from older Node-based action releases.
Changes:
- Pinned
actions/checkoutto a specific commit SHA across the Zephyr, unit test, docs, tooling, and build workflows. - Pinned
actions/upload-artifactto a specific commit SHA in workflows that publish build/fuzzer artifacts. - Updated one
actions/cacheusage to a commit SHA (but the chosen SHA appears to be incorrect for that action repo).
File summaries
| File | Description |
|---|---|
| .github/workflows/zephyr.yml | Pins actions/checkout and actions/upload-artifact; also updates one actions/cache usage (currently looks incorrect). |
| .github/workflows/zephyr-unit-tests.yml | Pins actions/checkout for the Zephyr unit test workflow. |
| .github/workflows/zephyr-shell.yml | Pins actions/checkout for the Zephyr shell workflow. |
| .github/workflows/unit-tests.yml | Pins actions/checkout for the cmocka unit tests workflow. |
| .github/workflows/tools.yml | Pins actions/checkout for tool/build validation workflows. |
| .github/workflows/testbench.yml | Pins actions/checkout for the testbench workflow. |
| .github/workflows/sparse-zephyr.yml | Pins actions/checkout for both sparse and SOF checkouts. |
| .github/workflows/sof-docs.yml | Pins actions/checkout for the sof-docs build workflow. |
| .github/workflows/rimage.yml | Pins actions/checkout for rimage build and cppcheck workflows. |
| .github/workflows/repro-build.yml | Pins actions/checkout for the reproducible build workflow. |
| .github/workflows/pull-request.yml | Pins actions/checkout for the PR validation workflow. |
| .github/workflows/llext.yml | Pins actions/checkout for the llext workflow. |
| .github/workflows/ipc_fuzzer.yml | Pins actions/checkout and actions/upload-artifact for IPC fuzzer runs/log uploads. |
| .github/workflows/codestyle.yml | Pins actions/checkout for yamllint workflow. |
| .github/workflows/build_all.yml | Pins actions/checkout for the build_all workflow. |
Review details
- Files reviewed: 15/15 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
PR 11166: test resultsRun date: 2026-09-04 09:25 UTC Tested commit: 2c7f632a690ebe4f889a72f5552e50d0084919c3
|
tmleman
force-pushed
the
topic/upstream/pr/github/workflows/update_actions
branch
2 times, most recently
from
September 4, 2026 05:14
b904059 to
2c7f632
Compare
These actions use Node.js 20. This version is now deprecated and GitHub is emitting warnings in action workflow logs. Updating following actions: - checkout from v4 to v7.0.1 - upload-artifact from v4 to v7.0.1 - cache from v4 to v6.1.0 Updated to use version SHA instead of tags. Tags can be changed and the current trend is to pin to a specific version. Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>
kv2019i
approved these changes
Sep 4, 2026
kv2019i
left a comment
kv2019i
left a comment
Collaborator
There was a problem hiding this comment.
Not really an expert with the workflow best practises, but I don't think we have many around. Tests are passing and seems reasonably to use up-to-date actions, so +1 from me.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These actions use Node.js 20. This version is now deprecated and GitHub is emitting warnings in action workflow logs.
Updated to use version SHA instead of tags. Tags can be changed and the current trend is to pin to a specific version.