From 548077d77991c2c66c41f22e46a74260a0b6490c Mon Sep 17 00:00:00 2001 From: Phiroze Noble Date: Thu, 27 Aug 2026 20:00:46 -0400 Subject: [PATCH 1/3] Upgrade GitHub Actions to Node 24 runtimes Assisted-By: devx/51da43b4-7970-4354-82a7-7bffdd9dd987 --- .github/workflows/actions/prepare/action.yml | 2 +- .github/workflows/changesets-reminder.yml | 2 +- .github/workflows/ci.yml | 8 ++++---- .github/workflows/deploy.yml | 4 ++-- .github/workflows/internal-snapshot.yml | 2 +- .github/workflows/unstable-snapshot.yml | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/actions/prepare/action.yml b/.github/workflows/actions/prepare/action.yml index 442ca6f403..289b10fd0c 100644 --- a/.github/workflows/actions/prepare/action.yml +++ b/.github/workflows/actions/prepare/action.yml @@ -2,7 +2,7 @@ name: Prepare repo runs: using: 'composite' steps: - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v5 name: Setup node.js and yarn with: registry-url: 'https://registry.npmjs.org' # Required for OIDC diff --git a/.github/workflows/changesets-reminder.yml b/.github/workflows/changesets-reminder.yml index bf70be3653..0da64e9b9d 100644 --- a/.github/workflows/changesets-reminder.yml +++ b/.github/workflows/changesets-reminder.yml @@ -30,7 +30,7 @@ jobs: timeout-minutes: 2 if: ${{ !github.event.pull_request.draft && !startsWith(github.head_ref, 'changeset-release/') }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v5 - uses: mskelton/changelog-reminder-action@7039cd14fb784c0a2b37f6e7a6ade2c9148c2245 # v2.0.0 with: changelogRegex: "\\.changeset" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9c15bed9cc..d43c313900 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,7 @@ jobs: type-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - uses: ./.github/workflows/actions/prepare - id: typescript-cache @@ -27,7 +27,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - uses: ./.github/workflows/actions/prepare - id: eslint-cache @@ -46,7 +46,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - uses: ./.github/workflows/actions/prepare - name: Build packages @@ -89,7 +89,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - uses: ./.github/workflows/actions/prepare - id: test-build diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index e80befdd62..84ac65e507 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -34,7 +34,7 @@ jobs: steps: # WARNING: DO NOT RUN ANY CUSTOM LOCAL SCRIPT BEFORE RUNNING THE SNAPIT ACTION # This action can be executed by 3rd party users and it should not be able to run arbitrary code from a PR. - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 with: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} @@ -62,7 +62,7 @@ jobs: contents: read id-token: write # Required for OIDC steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v5 with: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} diff --git a/.github/workflows/internal-snapshot.yml b/.github/workflows/internal-snapshot.yml index 564ee60ab6..4be84f3008 100644 --- a/.github/workflows/internal-snapshot.yml +++ b/.github/workflows/internal-snapshot.yml @@ -13,7 +13,7 @@ jobs: name: Internal Snapshot runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v5 with: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} diff --git a/.github/workflows/unstable-snapshot.yml b/.github/workflows/unstable-snapshot.yml index bc1a57536f..6985a33fca 100644 --- a/.github/workflows/unstable-snapshot.yml +++ b/.github/workflows/unstable-snapshot.yml @@ -13,7 +13,7 @@ jobs: name: Unstable Snapshot runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v5 with: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} From 822aafd75e5bbe8e435d90a3cac4f426259bcb44 Mon Sep 17 00:00:00 2001 From: Phiroze Noble Date: Thu, 27 Aug 2026 20:41:35 -0400 Subject: [PATCH 2/3] Pin GitHub Actions to v7 commits Assisted-By: devx/51da43b4-7970-4354-82a7-7bffdd9dd987 --- .github/workflows/actions/prepare/action.yml | 2 +- .github/workflows/changesets-reminder.yml | 2 +- .github/workflows/ci.yml | 8 ++++---- .github/workflows/deploy.yml | 4 ++-- .github/workflows/internal-snapshot.yml | 2 +- .github/workflows/unstable-snapshot.yml | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/actions/prepare/action.yml b/.github/workflows/actions/prepare/action.yml index 289b10fd0c..9e9b34eb07 100644 --- a/.github/workflows/actions/prepare/action.yml +++ b/.github/workflows/actions/prepare/action.yml @@ -2,7 +2,7 @@ name: Prepare repo runs: using: 'composite' steps: - - uses: actions/setup-node@v5 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 name: Setup node.js and yarn with: registry-url: 'https://registry.npmjs.org' # Required for OIDC diff --git a/.github/workflows/changesets-reminder.yml b/.github/workflows/changesets-reminder.yml index 0da64e9b9d..58f0453266 100644 --- a/.github/workflows/changesets-reminder.yml +++ b/.github/workflows/changesets-reminder.yml @@ -30,7 +30,7 @@ jobs: timeout-minutes: 2 if: ${{ !github.event.pull_request.draft && !startsWith(github.head_ref, 'changeset-release/') }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: mskelton/changelog-reminder-action@7039cd14fb784c0a2b37f6e7a6ade2c9148c2245 # v2.0.0 with: changelogRegex: "\\.changeset" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d43c313900..10731b9ca7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,7 @@ jobs: type-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: ./.github/workflows/actions/prepare - id: typescript-cache @@ -27,7 +27,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: ./.github/workflows/actions/prepare - id: eslint-cache @@ -46,7 +46,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: ./.github/workflows/actions/prepare - name: Build packages @@ -89,7 +89,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: ./.github/workflows/actions/prepare - id: test-build diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 84ac65e507..2da9777f98 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -34,7 +34,7 @@ jobs: steps: # WARNING: DO NOT RUN ANY CUSTOM LOCAL SCRIPT BEFORE RUNNING THE SNAPIT ACTION # This action can be executed by 3rd party users and it should not be able to run arbitrary code from a PR. - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} @@ -62,7 +62,7 @@ jobs: contents: read id-token: write # Required for OIDC steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} diff --git a/.github/workflows/internal-snapshot.yml b/.github/workflows/internal-snapshot.yml index 4be84f3008..45a3b36347 100644 --- a/.github/workflows/internal-snapshot.yml +++ b/.github/workflows/internal-snapshot.yml @@ -13,7 +13,7 @@ jobs: name: Internal Snapshot runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} diff --git a/.github/workflows/unstable-snapshot.yml b/.github/workflows/unstable-snapshot.yml index 6985a33fca..d3a3db55ef 100644 --- a/.github/workflows/unstable-snapshot.yml +++ b/.github/workflows/unstable-snapshot.yml @@ -13,7 +13,7 @@ jobs: name: Unstable Snapshot runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} From 16f577c78ff56f4ec791fc174012e608a6960d3c Mon Sep 17 00:00:00 2001 From: Phiroze Noble Date: Thu, 27 Aug 2026 20:44:50 -0400 Subject: [PATCH 3/3] Define token for setup-node v7 cache lookup Assisted-By: devx/51da43b4-7970-4354-82a7-7bffdd9dd987 --- .github/workflows/actions/prepare/action.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/actions/prepare/action.yml b/.github/workflows/actions/prepare/action.yml index 9e9b34eb07..56a2def66b 100644 --- a/.github/workflows/actions/prepare/action.yml +++ b/.github/workflows/actions/prepare/action.yml @@ -4,6 +4,8 @@ runs: steps: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 name: Setup node.js and yarn + env: + NODE_AUTH_TOKEN: '' with: registry-url: 'https://registry.npmjs.org' # Required for OIDC cache: yarn