Back to Details

review-renovate

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Review Renovate GitHub Actions PRs

审核Renovate GitHub Actions PR

You are reviewing a Renovate bot PR that updates GitHub Actions dependencies. Your job is to verify supply chain integrity and ensure the upgrades won't break CI/CD workflows.
你正在审核由Renovate bot提交的、用于更新GitHub Actions依赖的PR。你的任务是验证供应链完整性，并确保升级不会破坏CI/CD工作流。

Inputs

输入信息

You will be given a PR number or URL. Use 
gh
CLI to fetch PR details and diff.
你会收到PR编号或URL。使用
gh
CLI获取PR详情和差异内容。

Steps

步骤

1. Fetch PR metadata and diff

1. 获取PR元数据和差异内容

gh pr view <PR> --json title,body,files,commits,author,headRefName
gh pr diff <PR>
Confirm the PR author is 
app/renovate
. If not, flag this immediately — it may not be an automated dependency update.
gh pr view <PR> --json title,body,files,commits,author,headRefName
gh pr diff <PR>
确认PR作者为
app/renovate
。如果不是，立即标记——这可能不是自动化的依赖更新。

2. Identify all action version changes

2. 识别所有Action版本变更

From the diff, extract each changed action:
  • Full action name (e.g., 
    oven-sh/setup-bun
    )
  • Old version tag and pinned SHA
  • New version tag and pinned SHA
  • Update type (patch, minor, major)
从差异内容中提取每个被修改的Action：
  • 完整Action名称（例如：
    oven-sh/setup-bun
    ）
  • 旧版本标签和固定SHA
  • 新版本标签和固定SHA
  • 更新类型（补丁、次要、主要版本）

3. Verify pinned SHAs against upstream tags

3. 验证固定SHA与上游标签是否匹配

For every action being updated, verify both old and new SHAs match the claimed version tags:
gh api repos/{owner}/{repo}/git/ref/tags/{version} --jq '.object.sha'
Compare each result against the SHA in the workflow file. If any SHA does not match, stop and report a supply chain integrity failure. Do not approve the PR.
对于每个待更新的Action，验证旧版本和新版本的SHA是否与声明的版本标签匹配：
gh api repos/{owner}/{repo}/git/ref/tags/{version} --jq '.object.sha'
将每个结果与工作流文件中的SHA进行对比。如果任何SHA不匹配，立即停止并报告供应链完整性问题。不要批准该PR。

4. Review changelogs for breaking changes

4. 检查变更日志中的破坏性变更

From the PR body (Renovate includes release notes), check each updated action for:
  • Removed inputs or outputs that the workflows currently use
  • Changed default behavior for inputs the workflows rely on
  • New required inputs
  • Major version bumps (these almost always have breaking changes)
从PR正文（Renovate会包含发布说明）中，检查每个更新的Action是否存在以下情况：
  • 工作流当前使用的输入或输出被移除
  • 工作流依赖的输入默认行为发生变更
  • 新增必填输入
  • 主版本号升级（这类更新几乎总会包含破坏性变更）

5. Check workflow compatibility

5. 检查工作流兼容性

Read the affected workflow files and verify:
  • No removed or renamed inputs are being used
  • No changed defaults affect current behavior
  • The action's runtime requirements are still met (e.g., Node.js version compatibility)
阅读受影响的工作流文件并验证：
  • 未使用已被移除或重命名的输入
  • 变更后的默认值不会影响当前行为
  • Action的运行时要求仍能满足（例如：Node.js版本兼容性）

6. Report findings

6. 报告检查结果

Present a summary table:
ActionOldNewTypeSHA verified
.........patch/minor/majoryes/NO
Then state:
  • Whether all SHAs are verified
  • Whether any breaking changes were found
  • Whether the workflows remain compatible
  • A clear safe to merge or do not merge recommendation
呈现汇总表格：
Action旧版本新版本更新类型SHA验证结果
.........补丁/次要/主要版本是/否
然后说明：
  • 所有SHA是否均已验证
  • 是否发现任何破坏性变更
  • 工作流是否仍保持兼容
  • 明确给出可合并或不可合并的建议