Skip to content

chore(deps): update github actions #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

chore(deps): update github actions #70

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,10 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand Down Expand Up @@ -93,7 +93,7 @@ jobs:

steps:
- name: Install Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
with:
python-version: '3.9'
architecture: 'x64'
Expand Down Expand Up @@ -182,8 +182,8 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: jupyterlab/maintainer-tools/.github/actions/check-links@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1
- uses: jupyterlab/maintainer-tools/.github/actions/check-links@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1
with:
ignore_links: 'https://github.com/deepnote/jupyterlab-deepnote/pull/ https://github.com/deepnote/jupyterlab-deepnote/issues/ https://github.com/deepnote/jupyterlab-deepnote/actions/workflows/ci.yml https://github.com/deepnote/jupyterlab-deepnote/actions/workflows/ci.yml/badge.svg https://www.youtube.com/watch?v=jF0yA-JLQW0'
8 changes: 4 additions & 4 deletions .github/workflows/check-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,21 +17,21 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Setup Node.js
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
with:
cache: 'npm'
node-version: ${{ env.NODE_VERSION }}
registry-url: 'https://npm.pkg.github.com'
scope: '@deepnote'
always-auth: true
Comment on lines +23 to 29
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Remove always-auth: true — deprecated in actions/setup-node v6.

Line 29 uses the always-auth input, which was removed in v6. This will cause workflow failures. Remove the line; the cache, node-version, registry-url, and scope inputs function correctly in v6.

Apply this diff to remove the deprecated input:

       - name: Setup Node.js
         uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
         with:
           cache: 'npm'
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://npm.pkg.github.com'
           scope: '@deepnote'
-          always-auth: true
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
with:
cache: 'npm'
node-version: ${{ env.NODE_VERSION }}
registry-url: 'https://npm.pkg.github.com'
scope: '@deepnote'
always-auth: true
uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
with:
cache: 'npm'
node-version: ${{ env.NODE_VERSION }}
registry-url: 'https://npm.pkg.github.com'
scope: '@deepnote'
🤖 Prompt for AI Agents 
.github/workflows/check-release.yml around lines 23 to 29: the workflow uses
actions/setup-node v6 but includes the deprecated input always-auth: true which
will cause failures; remove the line containing always-auth: true so the step
only passes cache, node-version, registry-url and scope inputs supported by v6.

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Check Release
uses: jupyter-server/jupyter_releaser/.github/actions/check-release@6accaa3c07b69acaa1e14e00ba138133d8cbe879 # v2
uses: jupyter-server/jupyter_releaser/.github/actions/check-release@8a519e3628220eb74ff4c1017d6eb6ae803ae844 # v2
with:
token: ${{ secrets.GITHUB_TOKEN }}
env:
Expand Down
24 changes: 12 additions & 12 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,12 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0

- name: Install qlty
uses: qltysh/qlty-action/install@92420f3093ba65970fed22ce5f162ecb8a5c1700
uses: qltysh/qlty-action/install@c1d9ae56aba737dfb3c83921007a2610f1dad51c
Copy link
Contributor

@coderabbitai coderabbitai bot Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

Script executed:

#!/bin/bash
# Read the CI workflow file to see the full context
cat -n .github/workflows/ci.yml | head -50

Repository: deepnote/jupyterlab-deepnote

<shell_result>
Repository: deepnote/jupyterlab-deepnote
Exit code: 0

stdout:

     1	name: CI
     2	
     3	on:
     4	  push:
     5	    branches:
     6	      - main
     7	  pull_request:
     8	
     9	concurrency:
    10	  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
    11	  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
    12	
    13	permissions:
    14	  contents: read
    15	  pull-requests: read
    16	  packages: read
    17	
    18	jobs:
    19	  qlty:
    20	    name: Qlty Check
    21	    runs-on: ubuntu-latest
    22	    timeout-minutes: 3
    23	
    24	    steps:
    25	      - name: Checkout code
    26	        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
    27	        with:
    28	          fetch-depth: 0
    29	
    30	      - name: Install qlty
    31	        uses: qltysh/qlty-action/install@c1d9ae56aba737dfb3c83921007a2610f1dad51c
    32	
    33	      - name: Run qlty check
    34	        run: qlty check
    35	
    36	      - name: Run qlty code smells analysis
    37	        run: qlty smells
    38	
    39	  lint-and-format:
    40	    name: Lint & Format
    41	    runs-on: ubuntu-latest
    42	    timeout-minutes: 15
    43	    steps:
    44	      - name: Checkout
    45	        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
    46	
    47	      - name: Base Setup
    48	        uses: jupyterlab/maintainer-tools/.github/actions/base-setup@7a3e70473eff6cce4988f449decedc61d1304379 # v1
    49	
    50	      - name: Install dependencies

</shell_result>

qltysh/qlty-action GitHub repository commit c1d9ae56aba737dfb3c83921007a2610f1dad51c

<web_search_result>
I couldn't find any public GitHub commit with hash c1d9ae56aba737dfb3c83921007a2610f1dad51c in the qltysh/qlty-action repository. The repository’s public page (commit history and tags) shows recent activity but that specific commit hash does not appear. [1]

If you want, I can (a) open the repository’s full commit history and look again, (b) check whether that commit exists on another branch or a fork, or (c) fetch the raw commit URL you gave and show the page contents — which one do you prefer? [1]

Sources:
[1] qltysh/qlty-action (GitHub repository).
</web_search_result>

qltysh/qlty-action install action GitHub

<web_search_result>
You can install the Qlty CLI in a GitHub Actions workflow using the reusable install action at qltysh/qlty-action/install. Example (use the latest tag, e.g. v2):

  • uses: qltysh/qlty-action/install@v2

A minimal workflow example:

  • uses: actions/checkout@v3
  • uses: qltysh/qlty-action/install@v2
  • run: qlty --version # verify installation
    (Then run qlty commands like qlty check, qlty fmt, or upload coverage with qltysh/qlty-action/coverage.)

Sources: qlty-action README (actions list and install action). [1] Qlty CI docs (GitHub Actions integration / coverage example). [2]

Sources:
[1] https://github.com/qltysh/qlty-action — README / Actions list.
[2] https://docs.qlty.sh/coverage/ci — CI integration (GitHub Actions example).
</web_search_result>

Based on my verification, I have found that:

  1. Missing version comment is confirmed: Other actions in the same file (lines 26, 45, 48) all have version comments (e.g., # v5, # v1), while line 31 lacks one.

  2. SHA verification issue is real: The SHA c1d9ae56aba737dfb3c83921007a2610f1dad51c does not appear in the public qltysh/qlty-action repository's commit history.

  3. Best practice violation: Official documentation for qltysh/qlty-action recommends using semantic version tags (e.g., @v2) rather than commit SHAs.

The original review comment is valid and identifies genuine issues. Here is the rewritten comment:

Add version tag comment and verify action reference.

Line 31 lacks a version comment unlike other actions in this workflow (see lines 26, 45, 48 with # v5, # v1, etc.). Additionally, the referenced SHA c1d9ae56aba737dfb3c83921007a2610f1dad51c does not appear in the public qltysh/qlty-action repository. Consider using a semantic version tag (e.g., @v2) with a corresponding comment for consistency and maintainability.

🤖 Prompt for AI Agents 
.github/workflows/ci.yml around line 31: the action reference uses a raw SHA
without the version comment used elsewhere and the SHA does not match the public
repo; replace the SHA with the appropriate semantic version tag (e.g., @v2) and
add a trailing inline comment like "# v2" to match the other entries, and verify
the chosen tag exists in the qltysh/qlty-action repository before committing.


- name: Run qlty check
run: qlty check
Expand All @@ -42,10 +42,10 @@ jobs:
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand All @@ -66,10 +66,10 @@ jobs:
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand All @@ -90,10 +90,10 @@ jobs:
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand All @@ -113,9 +113,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Check licenses
run: yarn check-licenses
Expand All @@ -128,10 +128,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install JupyterLab
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/prep-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,11 @@ jobs:
permissions:
contents: write
steps:
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Prep Release
id: prep-release
uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@6accaa3c07b69acaa1e14e00ba138133d8cbe879 # v2
uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@8a519e3628220eb74ff4c1017d6eb6ae803ae844 # v2
with:
token: ${{ secrets.GITHUB_TOKEN }}
version_spec: ${{ github.event.inputs.version_spec }}
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/publish-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,27 +26,27 @@ jobs:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Setup Node.js
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

actions/setup-node v6 breaking changes compared to v5

💡 Result:

Summary of breaking changes from actions/setup-node v5 → v6:

  • Automatic caching behavior changed:

    • v5: enabled automatic package-manager detection and caching by default when no explicit cache input provided. [1][2]
    • v6: automatic caching is limited to npm only (caching for yarn/pnpm is disabled by default and must be configured explicitly). You can control this with the package-manager-cache input. [1][3]

  • Removal of deprecated input:

    • v6 removes the always-auth input (it was deprecated). Remove any uses of always-auth to avoid warnings/errors. [3]

Sources:

  • Release notes (v5, v6) — actions/setup-node releases. [1][2]
  • README / documentation (caching details and removed inputs). [3]

References:
[1] actions/setup-node release v5.0.0.
[2] actions/setup-node release v6.0.0.
[3] actions/setup-node README / documentation on caching and inputs.

🏁 Script executed:

cat -n .github/workflows/publish-release.yml

Repository: deepnote/jupyterlab-deepnote

Length of output: 3182

Remove always-auth: true — no longer supported in actions/setup-node v6.

Line 37 uses the deprecated always-auth input, which was removed in v6. This will cause the setup-node step to fail or emit errors. Remove line 37. The registry-url and scope inputs (lines 35–36) work correctly in v6, and Node 22.x is fully supported.

🤖 Prompt for AI Agents 
In .github/workflows/publish-release.yml around lines 32–37, the
actions/setup-node step is using the removed always-auth input (line 37); remove
the always-auth: true line so the workflow uses setup-node v6 correctly while
keeping registry-url and scope inputs on lines 35–36 unchanged; ensure no other
references to always-auth remain in the file and commit the updated workflow.

with:
node-version: ${{ env.NODE_VERSION }}
registry-url: 'https://npm.pkg.github.com'
scope: '@deepnote'
always-auth: true

- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
id: app-token
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}

- name: Populate Release
id: populate-release
uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@6accaa3c07b69acaa1e14e00ba138133d8cbe879 # v2
uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@8a519e3628220eb74ff4c1017d6eb6ae803ae844 # v2
with:
token: ${{ steps.app-token.outputs.token }}
branch: ${{ github.event.inputs.branch }}
Expand All @@ -57,7 +57,7 @@ jobs:
id: finalize-release
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@6accaa3c07b69acaa1e14e00ba138133d8cbe879 # v2
uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@8a519e3628220eb74ff4c1017d6eb6ae803ae844 # v2
with:
token: ${{ steps.app-token.outputs.token }}
release_url: ${{ steps.populate-release.outputs.release_url }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/update-integration-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
token: ${{ secrets.GITHUB_TOKEN }}

Expand Down Expand Up @@ -69,7 +69,7 @@ jobs:
fi

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand All @@ -80,7 +80,7 @@ jobs:
jlpm
python -m pip install .

- uses: jupyterlab/maintainer-tools/.github/actions/update-snapshots@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: jupyterlab/maintainer-tools/.github/actions/update-snapshots@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
# Playwright knows how to start JupyterLab server
Expand Down
Loading