From ead6870690491e0a16182e3e99e6975cd28308e4 Mon Sep 17 00:00:00 2001 From: IamPekka058 <59747867+IamPekka058@users.noreply.github.com> Date: Mon, 7 Sep 2026 21:08:47 +0200 Subject: [PATCH 1/2] ci: bump GitHub Actions to latest major versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit actions/checkout v4→v7, upload-artifact v4→v7, download-artifact v4→v8, setup-java v4→v6, setup-go v5→v7, cache v4→v6, action-gh-release v1→v3. setup-java@v6 drops the legacy "adopt" distribution, so build-debug.yml's two direct Setup Java steps move to "temurin" like build-android/action.yml already does. --- .github/actions/build-android/action.yml | 8 ++++---- .github/workflows/build-debug.yml | 22 +++++++++++----------- .github/workflows/build-release.yml | 4 ++-- .github/workflows/build-snapshot.yml | 4 ++-- .github/workflows/bump-netbird.yml | 2 +- 5 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/actions/build-android/action.yml b/.github/actions/build-android/action.yml index 09745676..f6b62ecc 100644 --- a/.github/actions/build-android/action.yml +++ b/.github/actions/build-android/action.yml @@ -53,7 +53,7 @@ runs: run: echo "version=$(sed -n 's/^toolchainVersion=//p' gradle/gradle-daemon-jvm.properties)" >> "$GITHUB_OUTPUT" - name: Setup Java - uses: actions/setup-java@v4 + uses: actions/setup-java@v6 with: java-version: ${{ steps.jdk.outputs.version }} # AdoptOpenJDK became Eclipse Temurin; resolving "adopt" now fails @@ -62,7 +62,7 @@ runs: cache: "gradle" - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version-file: "netbird/go.mod" cache-dependency-path: "netbird/go.sum" @@ -74,7 +74,7 @@ runs: - name: Cache Android NDK id: ndk-cache - uses: actions/cache@v4 + uses: actions/cache@v6 with: # ANDROID_HOME is set by the runner image but not visible to ${{ env.X }} # in composite actions; the ubuntu-latest image pins it to this path. @@ -107,7 +107,7 @@ runs: # hit the cache, skip the install and leave the build without a generator. - name: Cache gomobile and gobind id: gomobile-cache - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: | ~/go/bin/gomobile diff --git a/.github/workflows/build-debug.yml b/.github/workflows/build-debug.yml index 61d46089..58856408 100644 --- a/.github/workflows/build-debug.yml +++ b/.github/workflows/build-debug.yml @@ -17,7 +17,7 @@ jobs: bundle_path: ${{ steps.build.outputs.bundle_path }} steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: submodules: recursive @@ -35,7 +35,7 @@ jobs: build_type: debug - name: Upload build artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: debug-artifacts-${{ steps.version.outputs.version_name }} path: | @@ -44,7 +44,7 @@ jobs: retention-days: 3 - name: Upload AAR artifact for tests - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: netbird-aar path: ${{ steps.build.outputs.aar_path }} @@ -55,7 +55,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: submodules: recursive @@ -65,14 +65,14 @@ jobs: run: echo "version=$(sed -n 's/^toolchainVersion=//p' gradle/gradle-daemon-jvm.properties)" >> "$GITHUB_OUTPUT" - name: Setup Java - uses: actions/setup-java@v4 + uses: actions/setup-java@v6 with: java-version: ${{ steps.jdk.outputs.version }} distribution: "temurin" cache: "gradle" - name: Download AAR artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: netbird-aar path: gomobile @@ -82,7 +82,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: unit-test-results path: | @@ -95,7 +95,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: submodules: recursive @@ -105,14 +105,14 @@ jobs: run: echo "version=$(sed -n 's/^toolchainVersion=//p' gradle/gradle-daemon-jvm.properties)" >> "$GITHUB_OUTPUT" - name: Setup Java - uses: actions/setup-java@v4 + uses: actions/setup-java@v6 with: java-version: ${{ steps.jdk.outputs.version }} distribution: "temurin" cache: "gradle" - name: Download AAR artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: netbird-aar path: gomobile @@ -140,7 +140,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: instrumented-test-results path: | diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index ec7d146a..1e65ba94 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -26,7 +26,7 @@ jobs: bundle_path: ${{ steps.build.outputs.bundle_path }} steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: submodules: recursive @@ -91,7 +91,7 @@ jobs: build_type: release - name: Upload files to existing release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@v3 with: files: | ${{ steps.build.outputs.apk_path }} diff --git a/.github/workflows/build-snapshot.yml b/.github/workflows/build-snapshot.yml index 5358b967..48448885 100644 --- a/.github/workflows/build-snapshot.yml +++ b/.github/workflows/build-snapshot.yml @@ -21,7 +21,7 @@ jobs: NETBIRD_UPLOAD_STORE_PASSWORD: ${{ secrets.NETBIRD_UPLOAD_STORE_PASSWORD }} steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: # git describe below needs the tags and the history down to the # nearest release tag; the default shallow clone carries neither. @@ -100,7 +100,7 @@ jobs: build_type: release - name: Upload build artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ steps.version.outputs.version_name }} path: | diff --git a/.github/workflows/bump-netbird.yml b/.github/workflows/bump-netbird.yml index a7a7b175..25878143 100644 --- a/.github/workflows/bump-netbird.yml +++ b/.github/workflows/bump-netbird.yml @@ -20,7 +20,7 @@ jobs: pull-requests: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: submodules: recursive token: ${{ secrets.NETBIRD_DEV_BOT_GITHUB_TOKEN }} From 717e448b04d6cd84789fbae8d049c3e80ce8b032 Mon Sep 17 00:00:00 2001 From: IamPekka058 <59747867+IamPekka058@users.noreply.github.com> Date: Mon, 7 Sep 2026 22:02:36 +0200 Subject: [PATCH 2/2] ci: ensure credentials are not persisted during checkout in workflows --- .github/workflows/build-debug.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build-debug.yml b/.github/workflows/build-debug.yml index 58856408..6084429a 100644 --- a/.github/workflows/build-debug.yml +++ b/.github/workflows/build-debug.yml @@ -20,6 +20,7 @@ jobs: uses: actions/checkout@v7 with: submodules: recursive + persist-credentials: false - name: Get short Git hash id: version @@ -58,6 +59,7 @@ jobs: uses: actions/checkout@v7 with: submodules: recursive + persist-credentials: false - name: Read the daemon JDK version id: jdk @@ -98,6 +100,7 @@ jobs: uses: actions/checkout@v7 with: submodules: recursive + persist-credentials: false - name: Read the daemon JDK version id: jdk