petercorke / petercorke/machinevision-toolbox-python
GitHub Actions versions are stale across most workflows
Nessuno ha ancora preso questa issue.
- Lingua principale
- Python
- Stelle
- 219
- Fork
- 30
- Merge medio
- 12g 23h
- PR unite (30g)
- 5
Descrizione
Audited 2026-07-29 (prompted by a similar finding in another toolbox
repo). docs.yml's actions have been bumped to current majors as part of
the same change that fixed the Image sidebar bug (see git history), but
the rest of .github/workflows/ was deliberately left alone — bumping
release.yml touches the real PyPI publish pipeline and deserves its own
careful pass (verify the actual release workflow file, don't just bump
and hope), not a drive-by alongside a docs fix.
| Action | Pinned | Latest (2026-07-29) | Where | Gap |
|---|---|---|---|---|
actions/download-artifact |
v4 | v8 | release.yml |
4 majors |
actions/upload-artifact |
v4 | v7 | release.yml |
3 majors |
actions/checkout |
v6 | v7 | ci.yml, release.yml |
1 major |
actions/setup-python |
v6 | v7 | release.yml |
1 major |
googleapis/release-please-action |
v4 | v5 | release-please.yml |
1 major |
amannn/action-semantic-pull-request |
v5 | v6 | commitlint.yml |
1 major |
mamba-org/setup-micromamba |
v2 | v3 | ci.yml |
1 major |
codecov/codecov-action |
v6 | v7 | ci.yml |
1 major |
pypa/gh-action-pypi-publish |
release/v1 |
— | release.yml |
none — floating tag, already tracks latest v1.x |
download-artifact and upload-artifact are the standouts — 3-4 majors
behind, both used in release.yml's build→publish artifact handoff. Most
of these actions/* majors turned out to be low-risk (mainly Node.js
runtime bumps: v24 requires Actions Runner ≥ v2.327.1, a non-issue on
GitHub-hosted runners), confirmed while bumping docs.yml, but
download-artifact/upload-artifact v4→v7/v8 haven't been checked for
breaking input/output changes yet — do that before bumping release.yml.
Note: the mamba-org/setup-micromamba row is moot once the separate
conda/micromamba-removal work lands — don't bump that one, just delete it.
Fix
For each remaining workflow file, check that action's release notes
between the pinned and latest major for actual breaking changes (not just
Node runtime bumps), then bump. Do release.yml last and most carefully
— it's the one that actually publishes to PyPI. Re-run
.github/workflows/ci.yml on a real PR after bumping it, since it's the
main test gate.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Direzione di ricerca
Inizia ispezionando .github/workflows/ci.yml, release.yml, release-please.yml e commitlint.yml, quindi leggi le note di rilascio per ogni action bloccata tra la relativa major attuale e quella target. Verifica con particolare attenzione il passaggio dell’artefatto in release.yml e il workflow di pubblicazione su PyPI, ed elimina la voce obsoleta setup-micromamba invece di aggiornarla. Il lavoro è completato quando le action applicabili sono state aggiornate in modo sicuro e un PR reale riesegue correttamente .github/workflows/ci.yml.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- github-actions, python
- Ambito
- ci-cd, devops, release
- Tipo di issue
- Refactoring
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Tranquilla
- Chiarezza
- Specificata chiaramente
- Idoneità per principianti
- 68/100