chore: update GitHub Actions to use latest versions of actions and Node.js 22 by gene9831 · Pull Request #381 · opentiny/tiny-robot

gene9831 · 2026-07-23T03:03:39Z

Summary by CodeRabbit

Chores
- Updated automated build, testing, publishing, and deployment workflows to newer GitHub Actions tooling.
- Upgraded the Node.js runtime to 22 across CI and deployment workflows.
- Modernized CI caching and adjusted cache key inputs for faster, more reliable installs.
- Improved artifact upload/download handling across CI, preview, and CDN deployment workflows.
- Updated the project’s pnpm version to 10.34.5 and relocated the local patch configuration for the VitePress demo plugin to the workspace setup.

…de.js 22

coderabbitai · 2026-07-23T03:03:56Z

Walkthrough

The PR updates pnpm configuration, moves the workspace to pnpm 10, upgrades CI action versions, switches workflows to Node.js 22, and updates artifact upload/download actions across publishing, testing, and deployment workflows.

Changes

CI Toolchain Updates

Layer / File(s)	Summary
Package manager configuration `package.json`, `pnpm-workspace.yaml`	The repository now uses pnpm 10.34.5, with `patchedDependencies` configured in the workspace file for `vitepress-demo-plugin`.
Workflow runtime and setup upgrades `.github/workflows/auto-publish.yml`, `.github/workflows/deploy-playground-to-cdn.yml`, `.github/workflows/dispatch-publish.yml`, `.github/workflows/pr-ci-build.yml`, `.github/workflows/pr-ci-e2e-test.yml`, `.github/workflows/pr-ci-publish-packages.yml`	Checkout, pnpm setup, Node.js setup, and cache actions are upgraded; configured Node.js versions change from 20 to 22, and cache keys now hash package manifests and the workspace file.
Workflow artifact transfers `.github/workflows/deploy-playground-to-cdn.yml`, `.github/workflows/pr-ci-build.yml`, `.github/workflows/pr-ci-e2e-test.yml`, `.github/workflows/pr-ci-publish-packages.yml`, `.github/workflows/pr-deploy-preview.yml`	Artifact upload actions are upgraded to v6 and download actions to v7 while preserving existing artifact handling logic.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit hops through workflows bright,
With Node twenty-two in flight.
pnpm ten packs the patch with care,
New artifact actions whisk files through air.
CI carrots grow fresh and sweet—
Every build skips on nimble feet!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: upgrading GitHub Actions and Node.js to newer versions, including Node 22.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/auto-publish.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/deploy-playground-to-cdn.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/dispatch-publish.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

3 others

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/auto-publish.yml:
- Around line 20-30: Update all affected GitHub Actions references to the
requested current versions: checkout and setup-node to v7, pnpm/action-setup to
v6, upload-artifact to v7, and download-artifact to v8. Apply these changes in
.github/workflows/auto-publish.yml (20-30),
.github/workflows/deploy-playground-to-cdn.yml (45-57, 124, 135-138),
.github/workflows/dispatch-publish.yml (38-50),
.github/workflows/pr-ci-build.yml (17-25, 56),
.github/workflows/pr-ci-e2e-test.yml (13-21, 39, 53),
.github/workflows/pr-ci-publish-packages.yml (17-25, 44, 67), and
.github/workflows/pr-deploy-preview.yml (23, 41), preserving each workflow’s
existing configuration.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7aee3166-0e62-4a73-867b-641d15395896

📥 Commits

Reviewing files that changed from the base of the PR and between 47f98d6 and 97ff5d6.

📒 Files selected for processing (9)

.github/workflows/auto-publish.yml
.github/workflows/deploy-playground-to-cdn.yml
.github/workflows/dispatch-publish.yml
.github/workflows/pr-ci-build.yml
.github/workflows/pr-ci-e2e-test.yml
.github/workflows/pr-ci-publish-packages.yml
.github/workflows/pr-deploy-preview.yml
package.json
pnpm-workspace.yaml

… package.json for cache keys

github-actions · 2026-07-23T03:46:54Z

✅ Preview build completed successfully!

Click the image above to preview.
Preview will be automatically removed when this PR is closed.

github-actions · 2026-07-23T03:46:55Z

📦 Package Preview

pnpm add https://pkg.pr.new/@opentiny/tiny-robot@4ea8c4d

pnpm add https://pkg.pr.new/@opentiny/tiny-robot-kit@4ea8c4d

pnpm add https://pkg.pr.new/@opentiny/tiny-robot-svgs@4ea8c4d

commit: 4ea8c4d

gene9831 · 2026-07-23T06:20:54Z

@coderabbitai review

coderabbitai · 2026-07-23T06:20:59Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

🧹 Nitpick comments (2)

.github/workflows/deploy-playground-to-cdn.yml (2)
72-73: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Keep pnpm-lock.yaml in the cache key.

Manifest-only hashing leaves the cache key unchanged when dependency resolutions change solely in pnpm-lock.yaml. Because installation uses --no-frozen-lockfile, this can cause repeated downloads of newly resolved packages instead of saving a fresh store cache.
Proposed fix
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/package.json', 'pnpm-workspace.yaml') }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/package.json', 'pnpm-workspace.yaml', 'pnpm-lock.yaml') }}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-playground-to-cdn.yml around lines 72 - 73, Update
the cache key in the workflow’s pnpm store caching step to include
pnpm-lock.yaml in the hashFiles inputs alongside the existing package manifests
and workspace configuration, ensuring lockfile resolution changes invalidate the
cache.
45-58: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Verify the action versions against the “latest versions” objective.

As of July 23, 2026, the official actions document newer majors: checkout v7, pnpm/action-setup v6, setup-node v6, cache v6, upload-artifact v7, and download-artifact v8. (github.com)

Either upgrade these references after compatibility testing or adjust the PR objective to state that it intentionally adopts Node 24-compatible, but not latest, versions. Based on learnings, action-runtime upgrades should use Node 24-compatible releases and defer unrelated breaking-major upgrades until compatibility is verified.

Also applies to: 68-69, 125-125, 136-139
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-playground-to-cdn.yml around lines 45 - 58, Update
the workflow’s referenced GitHub Actions to the documented latest
majors—checkout v7, pnpm/action-setup v6, setup-node v6, cache v6,
upload-artifact v7, and download-artifact v8—after verifying compatibility,
including the additional occurrences noted in the comment; otherwise revise the
PR objective to explicitly state that it intentionally uses Node 24-compatible
non-latest versions.
Sources: Learnings, MCP tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/deploy-playground-to-cdn.yml:
- Around line 72-73: Update the cache key in the workflow’s pnpm store caching
step to include pnpm-lock.yaml in the hashFiles inputs alongside the existing
package manifests and workspace configuration, ensuring lockfile resolution
changes invalidate the cache.
- Around line 45-58: Update the workflow’s referenced GitHub Actions to the
documented latest majors—checkout v7, pnpm/action-setup v6, setup-node v6, cache
v6, upload-artifact v7, and download-artifact v8—after verifying compatibility,
including the additional occurrences noted in the comment; otherwise revise the
PR objective to explicitly state that it intentionally uses Node 24-compatible
non-latest versions.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 497633ad-da73-4b75-b003-c0277ef2b7cb

📥 Commits

Reviewing files that changed from the base of the PR and between 97ff5d6 and 4ea8c4d.

📒 Files selected for processing (6)

.github/workflows/auto-publish.yml
.github/workflows/deploy-playground-to-cdn.yml
.github/workflows/dispatch-publish.yml
.github/workflows/pr-ci-build.yml
.github/workflows/pr-ci-e2e-test.yml
.github/workflows/pr-ci-publish-packages.yml

🚧 Files skipped from review as they are similar to previous changes (5)

.github/workflows/pr-ci-build.yml
.github/workflows/auto-publish.yml
.github/workflows/pr-ci-publish-packages.yml
.github/workflows/dispatch-publish.yml
.github/workflows/pr-ci-e2e-test.yml

github-actions · 2026-07-24T07:09:07Z

🧹 Preview Cleaned Up

The preview deployment has been removed.

chore: update GitHub Actions to use latest versions of actions and No…

97ff5d6

…de.js 22

coderabbitai Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread .github/workflows/auto-publish.yml

chore: update GitHub Actions to disable package manager cache and use…

4ea8c4d

… package.json for cache keys

coderabbitai Bot reviewed Jul 23, 2026

View reviewed changes

SonyLeo approved these changes Jul 24, 2026

View reviewed changes

SonyLeo merged commit 7648e33 into opentiny:develop Jul 24, 2026
4 checks passed

gene9831 deleted the codex/update-actions-node22 branch July 24, 2026 07:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: update GitHub Actions to use latest versions of actions and Node.js 22 - #381

chore: update GitHub Actions to use latest versions of actions and Node.js 22#381
SonyLeo merged 2 commits into
opentiny:developfrom
gene9831:codex/update-actions-node22

gene9831 commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

gene9831 commented Jul 23, 2026

Uh oh!

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

gene9831 commented Jul 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026

📦 Package Preview

Uh oh!

gene9831 commented Jul 23, 2026

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 24, 2026

🧹 Preview Cleaned Up

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gene9831 commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading