ci: upgrade GitHub Actions and fix Dependabot yarn.lock alerts#63
Merged
Conversation
Bumps actions/checkout v4 -> v7, actions/setup-java v4 -> v5, and gradle/actions/setup-gradle v4 -> v6 across ci.yml, codeql.yml, commit-convention.yml, and publish.yml. The checkout and setup-java jumps are Node24 runtime bumps with no input/output changes. gradle/actions v6 defaults setup-gradle's caching to a proprietary "Enhanced Caching" component with its own Terms of Use, separate from this project's MIT license. Every setup-gradle step now sets cache-provider: basic to opt into the newly-added, fully open-source (MIT) caching path instead, keeping the CI toolchain all-OSS.
Enhanced Caching (gradle-actions-caching) is free for public repos like this one, so the earlier switch to cache-provider: basic bought OSS-only tooling at the cost of Basic's known gaps (no restore-keys, no cleanup/dedup). Drop the override and use the default on every setup-gradle call site.
…ascript/diff CVEs kotlin-js-store/yarn.lock pins whatever transitive test-tooling versions the Kotlin/JS Gradle plugin declares (mocha/karma/webpack); those aren't reachable from build.gradle.kts as ordinary dependency declarations. Force Yarn's resolution field for webpack, serialize-javascript, and diff to their first patched release so the lockfile no longer carries the flagged CVEs, without waiting on a Kotlin Gradle plugin bump. Verified jsTest/wasmJsTest (including the Karma/webpack browser legs) still pass against the bumped versions.
OmarAlJarrah
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/checkoutv4 → v7,actions/setup-javav4 → v5, andgradle/actions/setup-gradlev4 → v6 acrossci.yml,codeql.yml,commit-convention.yml, andpublish.yml.checkoutandsetup-javaare Node24 runtime bumps with no input/output changes affecting how this repo uses them (nopull_request_target/workflow_runtriggers, no Docker container actions running authenticated git commands — the areas those release notes flag).setup-gradlestep usesgradle/actionsv6's default Enhanced Caching (gradle-actions-caching) rather than overriding to the MIT-only Basic provider — Enhanced is free for public repos and Basic drops restore-keys/cleanup/dedup, so the default is the better tradeoff here.kotlin-js-store/yarn.lock(1 high, 1 moderate, 3 low —serialize-javascriptCPU-exhaustion DoS and prototype-pollution-adjacent issues,webpackanddiffadvisories). That lockfile pins whatever transitive test-tooling versions (mocha/karma/webpack) the Kotlin/JS Gradle plugin declares internally, which aren't reachable as ordinary Gradle dependency declarations. Rootbuild.gradle.ktsnow forces Yarn'sresolutionfield forwebpack,serialize-javascript, anddiffto their first patched release, andkotlin-js-store/yarn.lockis regenerated accordingly — no Kotlin Gradle plugin bump required.Test plan
python3 -c "import yaml; yaml.safe_load(open(...))")./gradlew jsTest wasmJsTest(Node + Karma/webpack browser legs) green against the bumpedwebpack/serialize-javascript/diff./gradlew :kuri:jvmTest :kuri:detekt :kuri:apiCheck ktlintCheckgreen