ci: pin GitHub Actions to Node 24 releases by SHA - #190
Merged
Merged
Conversation
Every workflow logged Node 20 deprecation warnings (checkout@v4, setup-python@v5, cache@v4, upload-artifact@v4, github-script@v7), and release.yml's SHA pins still pointed at Node 20 releases. Pin all actions to their current Node 24 releases by commit SHA with the exact version in a trailing comment: checkout v7.0.1, setup-python v7.0.0, cache v6.1.0, upload-artifact v7.0.1, download-artifact v8.0.1, github-script v9.0.0, attest-build-provenance v4.2.2, gh-action-pypi-publish v1.14.2, action-gh-release v3.0.3. Release notes were reviewed against every usage; none of the breaking changes affect these workflows. benchmark.yml now grants pull-requests: write only to its job instead of the whole workflow.
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
FreshData benchmark report —
|
| fixture | n_rows | n_cols | p50 s | p95 s | peak MB | repair % | false-repair % | preserve % | trust | monotonic | export % |
|---|
Authored-code reduction (Metric 6)
kevincostner17
added a commit
that referenced
this pull request
Sep 14, 2026
test-matrix (3.9) has failed on main since #187: with pandas 1.5, the streaming state converted numeric columns via pd.to_numeric(s).to_numpy(dtype="float64"), which raises "cannot convert to 'float64'-dtype NumPy array with missing values" for nullable (masked) integer columns with NA. fd.clean_timeseries and StreamingCleaner hit it on any Int*/UInt* column with gaps. Pass na_value=np.nan there and in the time-series interpolation helper, which has the same conversion. Also pin the alert step #188 added to fetch-fixtures.yml, which #190's SHA sweep predated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every workflow run currently logs:
release.ymlwas already SHA-pinned, but its pins point at Node 20 releases. This PR pins every action in all 15 workflows to its current Node 24 release by commit SHA, with the exact version in a trailing comment:3d3c42e5fda3b955cc834043fb463e5f45b3a2844b4d10147dc37677efb3536It also moves
pull-requests: writeinbenchmark.ymlfrom workflow level down to the benchmark job, the only job that posts the PR comment.Breaking-change review
I checked each major release's notes against how these workflows use the action. None require workflow edits:
$RUNNER_TEMPviaincludeIf. The steps that push with saved credentials (release.ymltag push,docs.ymlgh-deploy) run inside the workspace, so they still work.pull_request_target/workflow_run, which no workflow uses.archiveinput defaults totrue, and no job uploads from a matrix, so artifact names can't collide.release.ymldownloads byname: dist.require('@actions/github')and reservesgetOctokit. We use neither; onlyrequire('fs')andgithub.rest.issues.*.subject-pathare unchanged. The new permission is only needed withpush-to-registry, which isn't used.ubuntu-latest, so the new minimum runner versions don't apply.Verification
grep uses:shows only the SHA-pinned versions listed above.release.ymlchanges take effect on the next tag.