Skip to content

ci: modernise GitHub Actions versions and add fork-friendly guards#59

Open
ndandan wants to merge 1 commit into
Shoshuo:mainfrom
ndandan:pr/ci-hardening
Open

ci: modernise GitHub Actions versions and add fork-friendly guards#59
ndandan wants to merge 1 commit into
Shoshuo:mainfrom
ndandan:pr/ci-hardening

Conversation

@ndandan

@ndandan ndandan commented Jun 19, 2026

Copy link
Copy Markdown

What

Modernise the GitHub Actions workflows so builds keep running as older action majors are deprecated, plus two small fork-friendliness fixes.

Action version bumps (across ci, beta, release, dockerhub-readme)

  • actions/checkout v4 → v5
  • docker/setup-qemu-action v3 → v4
  • docker/setup-buildx-action v3 → v4
  • docker/login-action v3 → v4
  • docker/metadata-action v5 → v6
  • docker/build-push-action v6 → v7
  • peter-evans/dockerhub-description v4 → v5
  • softprops/action-gh-release v2 → v3

Behavioural tweaks

  • ci.yml — added a workflow_dispatch trigger so the check suite can be re-run on demand from the Actions tab (handy when a flake needs a re-run without an empty commit).
  • dockerhub-readme.yml — guarded the sync job with if: github.repository == 'Shoshuo/Prismarr'. Forks don't hold the DOCKERHUB_* secrets, so a README change there currently leaves a red ✗ on a missing-secret failure; the guard makes the job a clean no-op on forks while remaining unconditionally active on the canonical repo.

Why

Routine maintenance — pinned actions go stale and start emitting deprecation warnings (and eventually stop running). The fork guard is a courtesy so anyone tracking the repo doesn't get spurious red checks.

Definition of Done

  • Pure CI/workflow change — no application code, so no new tests apply. The make check suite is unchanged and green (verified on a PR run of the updated ci.yml).
  • No credentials, no migrations, no security-surface changes.
  • CHANGELOG.md updated under [Unreleased] → Contributor.

Scoped intentionally: a separate GHCR publish workflow used for self-hosted testing on my fork is not included here, since upstream publishes to Docker Hub.

Bump the pinned actions to current majors (checkout@v5, setup-qemu@v4,
setup-buildx@v4, login@v4, metadata@v6, build-push@v7,
dockerhub-description@v5, action-gh-release@v3) across ci/beta/release/
dockerhub-readme so builds keep running as older majors are deprecated.

Add a workflow_dispatch trigger to ci.yml so the check suite can be run
on demand, and guard the Docker Hub README sync job with
`if: github.repository == 'Shoshuo/Prismarr'` so forks (which lack the
DOCKERHUB_* secrets) skip it instead of failing.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant