Skip to content

chore(deps): update github actions #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
+31 −31
Draft

chore(deps): update github actions #70

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,10 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand Down Expand Up @@ -93,7 +93,7 @@ jobs:

steps:
- name: Install Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
with:
python-version: '3.9'
architecture: 'x64'
Expand Down Expand Up @@ -182,8 +182,8 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: jupyterlab/maintainer-tools/.github/actions/check-links@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1
- uses: jupyterlab/maintainer-tools/.github/actions/check-links@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1
with:
ignore_links: 'https://github.com/deepnote/jupyterlab-deepnote/pull/ https://github.com/deepnote/jupyterlab-deepnote/issues/ https://github.com/deepnote/jupyterlab-deepnote/actions/workflows/ci.yml https://github.com/deepnote/jupyterlab-deepnote/actions/workflows/ci.yml/badge.svg https://www.youtube.com/watch?v=jF0yA-JLQW0'
6 changes: 3 additions & 3 deletions .github/workflows/check-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Setup Node.js
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
Expand All @@ -28,10 +28,10 @@ jobs:
scope: '@deepnote'
always-auth: true
- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Check Release
uses: jupyter-server/jupyter_releaser/.github/actions/check-release@6accaa3c07b69acaa1e14e00ba138133d8cbe879 # v2
uses: jupyter-server/jupyter_releaser/.github/actions/check-release@8a519e3628220eb74ff4c1017d6eb6ae803ae844 # v2
with:
token: ${{ secrets.GITHUB_TOKEN }}
env:
Expand Down
24 changes: 12 additions & 12 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,12 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0

- name: Install qlty
uses: qltysh/qlty-action/install@92420f3093ba65970fed22ce5f162ecb8a5c1700
uses: qltysh/qlty-action/install@c1d9ae56aba737dfb3c83921007a2610f1dad51c
Copy link
Contributor

@coderabbitai coderabbitai bot Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

Script executed:

#!/bin/bash
# Read the CI workflow file to see the full context
cat -n .github/workflows/ci.yml | head -50

Repository: deepnote/jupyterlab-deepnote

<shell_result>
Repository: deepnote/jupyterlab-deepnote
Exit code: 0

stdout:

     1	name: CI
     2	
     3	on:
     4	  push:
     5	    branches:
     6	      - main
     7	  pull_request:
     8	
     9	concurrency:
    10	  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
    11	  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
    12	
    13	permissions:
    14	  contents: read
    15	  pull-requests: read
    16	  packages: read
    17	
    18	jobs:
    19	  qlty:
    20	    name: Qlty Check
    21	    runs-on: ubuntu-latest
    22	    timeout-minutes: 3
    23	
    24	    steps:
    25	      - name: Checkout code
    26	        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
    27	        with:
    28	          fetch-depth: 0
    29	
    30	      - name: Install qlty
    31	        uses: qltysh/qlty-action/install@c1d9ae56aba737dfb3c83921007a2610f1dad51c
    32	
    33	      - name: Run qlty check
    34	        run: qlty check
    35	
    36	      - name: Run qlty code smells analysis
    37	        run: qlty smells
    38	
    39	  lint-and-format:
    40	    name: Lint & Format
    41	    runs-on: ubuntu-latest
    42	    timeout-minutes: 15
    43	    steps:
    44	      - name: Checkout
    45	        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
    46	
    47	      - name: Base Setup
    48	        uses: jupyterlab/maintainer-tools/.github/actions/base-setup@7a3e70473eff6cce4988f449decedc61d1304379 # v1
    49	
    50	      - name: Install dependencies

</shell_result>

qltysh/qlty-action GitHub repository commit c1d9ae56aba737dfb3c83921007a2610f1dad51c

<web_search_result>
I couldn't find any public GitHub commit with hash c1d9ae56aba737dfb3c83921007a2610f1dad51c in the qltysh/qlty-action repository. The repository’s public page (commit history and tags) shows recent activity but that specific commit hash does not appear. [1]

If you want, I can (a) open the repository’s full commit history and look again, (b) check whether that commit exists on another branch or a fork, or (c) fetch the raw commit URL you gave and show the page contents — which one do you prefer? [1]

Sources:
[1] qltysh/qlty-action (GitHub repository).
</web_search_result>

qltysh/qlty-action install action GitHub

<web_search_result>
You can install the Qlty CLI in a GitHub Actions workflow using the reusable install action at qltysh/qlty-action/install. Example (use the latest tag, e.g. v2):

  • uses: qltysh/qlty-action/install@v2

A minimal workflow example:

  • uses: actions/checkout@v3
  • uses: qltysh/qlty-action/install@v2
  • run: qlty --version # verify installation
    (Then run qlty commands like qlty check, qlty fmt, or upload coverage with qltysh/qlty-action/coverage.)

Sources: qlty-action README (actions list and install action). [1] Qlty CI docs (GitHub Actions integration / coverage example). [2]

Sources:
[1] https://github.com/qltysh/qlty-action — README / Actions list.
[2] https://docs.qlty.sh/coverage/ci — CI integration (GitHub Actions example).
</web_search_result>

Based on my verification, I have found that:

  1. Missing version comment is confirmed: Other actions in the same file (lines 26, 45, 48) all have version comments (e.g., # v5, # v1), while line 31 lacks one.

  2. SHA verification issue is real: The SHA c1d9ae56aba737dfb3c83921007a2610f1dad51c does not appear in the public qltysh/qlty-action repository's commit history.

  3. Best practice violation: Official documentation for qltysh/qlty-action recommends using semantic version tags (e.g., @v2) rather than commit SHAs.

The original review comment is valid and identifies genuine issues. Here is the rewritten comment:

Add version tag comment and verify action reference.

Line 31 lacks a version comment unlike other actions in this workflow (see lines 26, 45, 48 with # v5, # v1, etc.). Additionally, the referenced SHA c1d9ae56aba737dfb3c83921007a2610f1dad51c does not appear in the public qltysh/qlty-action repository. Consider using a semantic version tag (e.g., @v2) with a corresponding comment for consistency and maintainability.

🤖 Prompt for AI Agents 
.github/workflows/ci.yml around line 31: the action reference uses a raw SHA
without the version comment used elsewhere and the SHA does not match the public
repo; replace the SHA with the appropriate semantic version tag (e.g., @v2) and
add a trailing inline comment like "# v2" to match the other entries, and verify
the chosen tag exists in the qltysh/qlty-action repository before committing.


- name: Run qlty check
run: qlty check
Expand All @@ -42,10 +42,10 @@ jobs:
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand All @@ -66,10 +66,10 @@ jobs:
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand All @@ -90,10 +90,10 @@ jobs:
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand All @@ -113,9 +113,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Check licenses
run: yarn check-licenses
Expand All @@ -128,10 +128,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install JupyterLab
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/prep-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,11 @@ jobs:
permissions:
contents: write
steps:
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Prep Release
id: prep-release
uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@6accaa3c07b69acaa1e14e00ba138133d8cbe879 # v2
uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@8a519e3628220eb74ff4c1017d6eb6ae803ae844 # v2
with:
token: ${{ secrets.GITHUB_TOKEN }}
version_spec: ${{ github.event.inputs.version_spec }}
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/publish-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

- name: Setup Node.js
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
Expand All @@ -36,17 +36,17 @@ jobs:
scope: '@deepnote'
always-auth: true

- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2
- uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2
id: app-token
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}

- name: Populate Release
id: populate-release
uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@6accaa3c07b69acaa1e14e00ba138133d8cbe879 # v2
uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@8a519e3628220eb74ff4c1017d6eb6ae803ae844 # v2
with:
token: ${{ steps.app-token.outputs.token }}
branch: ${{ github.event.inputs.branch }}
Expand All @@ -57,7 +57,7 @@ jobs:
id: finalize-release
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@6accaa3c07b69acaa1e14e00ba138133d8cbe879 # v2
uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@8a519e3628220eb74ff4c1017d6eb6ae803ae844 # v2
with:
token: ${{ steps.app-token.outputs.token }}
release_url: ${{ steps.populate-release.outputs.release_url }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/update-integration-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
token: ${{ secrets.GITHUB_TOKEN }}

Expand Down Expand Up @@ -69,7 +69,7 @@ jobs:
fi

- name: Base Setup
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
uses: jupyterlab/maintainer-tools/.github/actions/base-setup@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1

- name: Install dependencies
run: python -m pip install -U "jupyterlab>=4.0.0,<5"
Expand All @@ -80,7 +80,7 @@ jobs:
jlpm
python -m pip install .

- uses: jupyterlab/maintainer-tools/.github/actions/update-snapshots@d72f5cb72b472c1e59036840891e918c9bda4dae # v1
- uses: jupyterlab/maintainer-tools/.github/actions/update-snapshots@d734fad2dc3aadbe56a5fd530037656e770e1a8d # v1
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
# Playwright knows how to start JupyterLab server
Expand Down