Unpushed commits (local main ahead of origin/main) - #45
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates GitHub Actions workflows (likely via an automation script) to pin action versions more tightly, add timeouts, and refine when workflows run.
Changes:
- Pin/upgrade action versions across workflows (e.g., checkout, dependency-review, tagging, auto-commit, composer install, setup-php).
- Add job timeouts (release/phpstan) and introduce concurrency + path filters for the PHPStan workflow.
- Remove the Nova license/auth step from the PHPStan workflow.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .github/workflows/release.yml | Adds a timeout and pins checkout + tag action versions for the release job. |
| .github/workflows/phpstan.yml | Narrows triggers via path filters, adds concurrency + timeout, pins actions, and removes Nova auth step. |
| .github/workflows/fix-php-code-style-issues.yml | Bumps the git auto-commit action version used for Pint fixes. |
| .github/workflows/dependency-review.yml | Pins checkout and dependency-review action versions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Bump version and push tag | ||
| uses: anothrNick/github-tag-action@master | ||
| uses: anothrNick/github-tag-action@1.75.0 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.MY_GITHUB_TOKEN }} | ||
| WITH_V: true |
There was a problem hiding this comment.
The workflow runs on pull_request closed, which also triggers when a PR is closed without being merged. That can create release tags for abandoned PRs. Add a guard (e.g., if: github.event.pull_request.merged == true) at the job or tag step level, or change the trigger to a push on main (or tag) so releases only happen after merge.
| with: | ||
| php-version: '8.4' | ||
| coverage: none | ||
|
|
There was a problem hiding this comment.
composer.json requires laravel/nova from https://nova.laravel.com (private repo). With the Nova auth step removed, the composer-install step is likely to fail due to missing credentials. Re-add the Nova license/auth configuration (or set COMPOSER_AUTH / composer config http-basic.nova.laravel.com ...) before installing dependencies in this workflow.
| - name: Configure Nova auth for Composer | |
| run: composer config http-basic.nova.laravel.com "${{ secrets.NOVA_USERNAME }}" "${{ secrets.NOVA_PASSWORD }}" |
| - name: Setup PHP | ||
| uses: shivammathur/setup-php@v2 | ||
| uses: shivammathur/setup-php@2.37.0 | ||
| with: | ||
| php-version: '8.4' | ||
| coverage: none | ||
|
|
||
| - name: Apply Nova license | ||
| run: composer config http-basic.nova.laravel.com ${{ secrets.NOVA_USERNAME }} ${{ secrets.NOVA_LICENSE_KEY }} | ||
|
|
||
| - name: Install composer dependencies | ||
| uses: ramsey/composer-install@v3 | ||
| uses: ramsey/composer-install@4.0.0 |
There was a problem hiding this comment.
The action refs here drop the usual v-prefixed tag format used elsewhere in the repo (e.g. shivammathur/setup-php@v2). If these tags are meant to be version tags, verify they exist and consider switching to the consistent tag naming (@v2.x.y / @v4.x.y) to avoid pointing at an unintended or non-existent ref.
| - name: 'Checkout Repository' | ||
| uses: actions/checkout@v6 | ||
| uses: actions/checkout@v6.0.2 |
There was a problem hiding this comment.
actions/checkout is now pinned to v6.0.2 here (and in some other workflows), but .github/workflows/run-tests.yml still uses actions/checkout@v4. Consider standardizing on a single pinned version across workflows to reduce drift and unexpected differences between CI jobs.
Local main was 7 commit(s) ahead of origin/main. Opened from update-opensource-active.sh for review.