Skip to content

Migrate GitHub Actions to Node 24 and tighten release permissions #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sachk merged 3 commits into from
Oct 5, 2026
Merged

Migrate GitHub Actions to Node 24 and tighten release permissions #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5d384df
build: migrate GitHub Actions to Node 24
jpmartins98 Aug 3, 2026
6523619
build: avoid deprecated artifact downloader
jpmartins98 Aug 3, 2026
a028820
build: pin reviewed actions and harden artifact uploads
sachk Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 13 additions & 6 deletions .github/workflows/ci-smoke.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ on:
branches:
- main

permissions:
contents: read

env:
UPX_VERSION: "5.1.0"

Expand All @@ -14,15 +17,17 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.11"

- name: Set up uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand Down Expand Up @@ -74,15 +79,17 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.11"

- name: Set up uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand Down
70 changes: 45 additions & 25 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ on:
workflow_dispatch:

permissions:
contents: write
contents: read

env:
FLATPAK_APP_ID: io.github.sachk.SmartSwitchExplorer
Expand All @@ -21,10 +21,12 @@ jobs:
version: ${{ steps.version.outputs.version }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.11"

Expand Down Expand Up @@ -55,15 +57,17 @@ jobs:
runner: windows-11-arm
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.11"

- name: Set up uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand Down Expand Up @@ -122,26 +126,29 @@ jobs:
run: python scripts/release/size_report.py artifacts/*

- name: Upload Windows artifacts
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: windows-${{ matrix.arch }}
path: artifacts/*
if-no-files-found: error

macos-dmg:
name: macOS DMG (universal2)
needs: validate-version
runs-on: macos-14
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.11"

- name: Set up uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand Down Expand Up @@ -178,10 +185,11 @@ jobs:
run: python scripts/release/size_report.py artifacts/*

- name: Upload macOS artifacts
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: macos-universal2-dmg
path: artifacts/*
if-no-files-found: error

linux-appimage:
name: Linux AppImage (${{ matrix.arch }})
Expand All @@ -197,15 +205,17 @@ jobs:
runner: ubuntu-24.04-arm
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.11"

- name: Set up uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand Down Expand Up @@ -264,10 +274,11 @@ jobs:
run: python scripts/release/size_report.py artifacts/*

- name: Upload AppImage artifacts
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: linux-appimage-${{ matrix.arch }}
path: artifacts/*
if-no-files-found: error

linux-flatpak:
name: Linux Flatpak (${{ matrix.arch }})
Expand All @@ -285,15 +296,17 @@ jobs:
runner: ubuntu-24.04-arm
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.11"

- name: Set up uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand Down Expand Up @@ -364,10 +377,11 @@ jobs:
run: python scripts/release/size_report.py artifacts/*

- name: Upload Flatpak artifacts
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: linux-flatpak-${{ matrix.arch }}
path: artifacts/*
if-no-files-found: error

publish-release:
name: Publish GitHub Release
Expand All @@ -379,16 +393,22 @@ jobs:
- linux-flatpak
runs-on: ubuntu-latest
if: startsWith(github.ref, 'refs/tags/v')
permissions:
actions: read
contents: write
steps:
- name: Download all artifacts
uses: actions/download-artifact@v4
with:
path: release-artifacts
merge-multiple: true
env:
GH_TOKEN: ${{ github.token }}
run: >-
gh run download "$GITHUB_RUN_ID"
--repo "$GITHUB_REPOSITORY"
--dir release-artifacts

- name: Create GitHub release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
with:
fail_on_unmatched_files: true
generate_release_notes: true
files: |
release-artifacts/*
release-artifacts/**/*
8 changes: 8 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,14 @@ uv run smartswitch-explorer
nix run github:sachk/smartswitch-explorer
```

## Release workflow

CI and release actions are pinned to reviewed commits. Build jobs use read-only
repository permissions and do not retain checkout credentials; only the
tag-triggered publishing job can write release assets. Artifact uploads fail
when no files are found. The publisher downloads artifacts from its own workflow
run with GitHub CLI and uploads files from the per-artifact directories.

Additional format docs:

- `docs/calllog_format.md`
Expand Down