Update Typst setup action to version 5 - #50
Conversation
📝 WalkthroughWalkthroughThe CI workflow in ChangesCI Workflow Typst Setup Action Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
31-31: ⚡ Quick winConsider pinning the action to a commit SHA for enhanced security.
Using tag references (e.g.,
@v5) is more maintainable, but pinning to a commit SHA provides stronger supply-chain security by preventing tag manipulation. If your security policy requires it, consider pinning like this:uses: typst-community/setup-typst@<commit-sha> # v5.As per static analysis tool zizmor: "action is not pinned to a hash (required by blanket policy)".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 31, Update the GitHub Action reference to pin the typst setup action to a specific commit SHA instead of the loose tag used in uses: typst-community/setup-typst@v5; replace the tag with the full commit SHA for typst-community/setup-typst and optionally keep a trailing comment with the human-readable tag (e.g., "# v5") to preserve readability while ensuring supply-chain integrity.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 31: CI workflow uses typst-community/setup-typst@v5 without specifying
typst-version so the installed Typst may not match compiler = "0.14.0" in
typst.toml; update the .github/workflows/ci.yml step that uses
typst-community/setup-typst@v5 to explicitly set the typst-version (or
typst-versions-*) input to "0.14.0", verify the action ref
(typst-community/setup-typst@v5) exists or replace it with a valid tag/release,
and optionally pin the uses: to a commit SHA for supply-chain hardening.
- Line 31: Update the GitHub Actions uses entries to Node24-capable major
versions: change actions/upload-artifact@v4 → actions/upload-artifact@v7,
actions/configure-pages@v5 → actions/configure-pages@v6, and
actions/deploy-pages@v4 → actions/deploy-pages@v5; keep
typst-community/setup-typst@v5 as noted and leave
actions/upload-pages-artifact@v3 (composite) unchanged. Locate the uses lines
for "actions/upload-artifact", "actions/configure-pages", and
"actions/deploy-pages" in the ci.yml workflow and replace the version tags
accordingly, then run the workflow linter/CI to verify no breaking syntax
changes.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Line 31: Update the GitHub Action reference to pin the typst setup action to a
specific commit SHA instead of the loose tag used in uses:
typst-community/setup-typst@v5; replace the tag with the full commit SHA for
typst-community/setup-typst and optionally keep a trailing comment with the
human-readable tag (e.g., "# v5") to preserve readability while ensuring
supply-chain integrity.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
|
|
||
| - name: Setup Typst | ||
| uses: typst-community/setup-typst@v4 | ||
| uses: typst-community/setup-typst@v5 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify setup-typst@v5 exists and check its Typst version
# Check if the v5 tag exists in the repository
gh api repos/typst-community/setup-typst/git/ref/tags/v5 --jq '.ref' 2>/dev/null || echo "Warning: v5 tag not found"
# Fetch the action.yml to see default Typst version
gh api repos/typst-community/setup-typst/contents/action.yml --jq '.content' | base64 -d | grep -A5 'typst-version'Repository: pku-typst/pkuthss-typst
Length of output: 2348
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
echo "== typst-community/setup-typst usage =="
rg -n "typst-community/setup-typst@v" "$FILE" -n
# Print the block around the setup-typst usage
line=$(rg -n "typst-community/setup-typst@v" "$FILE" | head -n1 | cut -d: -f1)
start=$((line-6))
end=$((line+20))
sed -n "${start},${end}p" "$FILE" | nl -ba
echo
echo "== actions/upload-artifact usage =="
rg -n "actions/upload-artifact@" "$FILE"
rg -n "actions/configure-pages@" "$FILE"Repository: pku-typst/pkuthss-typst
Length of output: 217
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
echo "== setup-typst step context (around line 31) =="
cat -n "$FILE" | sed -n '20,45p'
echo
echo "== typst-version inputs passed in workflow =="
rg -n "typst-versions|typst-version" "$FILE" || true
echo
echo "== other action versions =="
rg -n "actions/upload-artifact@" "$FILE" || true
rg -n "actions/configure-pages@" "$FILE" || trueRepository: pku-typst/pkuthss-typst
Length of output: 1259
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# List candidate typst config files
echo "== typst.toml =="
if [ -f "typst.toml" ]; then
sed -n '1,120p' typst.toml | cat -n
else
echo "typst.toml not found at repo root"
find . -maxdepth 3 -name "typst.toml" -print
fi
echo
echo "== search for compiler 0.14.0 =="
rg -n "compiler\s*=\s*\"0\.14\.0\"|0\.14\.0" -S . || true
echo
echo "== changelog.typ (if present) =="
if [ -f "changelog.typ" ]; then
rg -n "0\.14\.0|compiler|Typst" changelog.typ || true
sed -n '1,160p' changelog.typ | cat -n
else
echo "changelog.typ not found at repo root"
find . -maxdepth 3 -name "changelog.typ" -print
fiRepository: pku-typst/pkuthss-typst
Length of output: 8190
Make CI’s Typst toolchain match typst.toml (compiler = "0.14.0")
.github/workflows/ci.ymlusestypst-community/setup-typst@v5at line 31, but the step provides notypst-version/typst-versions-*input.- The action’s
typst-versioninput defaults tolatest, so CI is not guaranteed to install Typst0.14.0as required bytypst.toml(compiler pin). - The
typst-community/setup-typst@v5ref itself isn’t proven to exist from the repo info available here; ensure the workflow targets a valid tag/release. - Consider pinning
uses:to a commit SHA for supply-chain hardening if your security checks require it.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 31, CI workflow uses
typst-community/setup-typst@v5 without specifying typst-version so the installed
Typst may not match compiler = "0.14.0" in typst.toml; update the
.github/workflows/ci.yml step that uses typst-community/setup-typst@v5 to
explicitly set the typst-version (or typst-versions-*) input to "0.14.0", verify
the action ref (typst-community/setup-typst@v5) exists or replace it with a
valid tag/release, and optionally pin the uses: to a commit SHA for supply-chain
hardening.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check latest versions and Node.js runtime for GitHub Actions
echo "=== Checking actions/upload-artifact ==="
gh api repos/actions/upload-artifact/releases/latest --jq '.tag_name'
echo "=== Checking actions/configure-pages ==="
gh api repos/actions/configure-pages/releases/latest --jq '.tag_name'
echo "=== Checking actions/upload-pages-artifact ==="
gh api repos/actions/upload-pages-artifact/releases/latest --jq '.tag_name'
echo "=== Checking actions/deploy-pages ==="
gh api repos/actions/deploy-pages/releases/latest --jq '.tag_name'Repository: pku-typst/pkuthss-typst
Length of output: 262
🏁 Script executed:
#!/bin/bash
# Check runs-on/engine Node runtime for the latest tag of each action by reading action.yml
set -euo pipefail
check_action() {
local repo="$1"
local ref="$2"
echo "=== $repo action.yml @ $ref ==="
gh api "repos/$repo/contents/action.yml?ref=$ref" --jq '.content' \
| base64 -d 2>/dev/null | rg -n "runs:|node[0-9]+|using:" || true
echo
}
# Latest tags from the previous run:
UPART="actions/upload-artifact:v7.0.1"
CONF="actions/configure-pages:v6.0.0"
UPPAG="actions/upload-pages-artifact:v5.0.0"
DEP="actions/deploy-pages:v5.0.0"
check_action "$UPART" "${UPART#*:}"
check_action "$CONF" "${CONF#*:}"
check_action "$UPPAG" "${UPPAG#*:}"
check_action "$DEP" "${DEP#*:}"
# Also check the specific currently-used versions from the workflow:
# upload-artifact@v4, configure-pages@v5
check_action "actions/upload-artifact" "v4"
check_action "actions/configure-pages" "v5"Repository: pku-typst/pkuthss-typst
Length of output: 585
🌐 Web query:
GitHub Actions Node.js 24 mandatory June 2 2026 deprecation date
💡 Result:
GitHub Actions will force JavaScript actions to run on Node.js 24 by default starting June 2, 2026 (i.e., the mandatory transition/deprecation date you’re asking about is June 2, 2026). [1][2][3] In GitHub’s own changelog, the relevant window is described as: - Beginning on June 16, 2026, runners will begin using Node 24 by default (and you can temporarily opt out until Node 20 is removed later in 2026). [1] - The common deprecation warning text shown to action users also states “Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026,” with an additional note that Node.js 20 is removed from the runner later (September 16, 2026 in those warnings). [2] If you want to avoid failures/warnings around the transition, update your workflow to use action major versions that support Node.js 24, or opt into Node 24 early using the documented environment variable (FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true). [1][2]
Citations:
- 1: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
- 2: CI: Update GitHub Actions to support Node.js 24 (deprecate Node.js 20) mandiant/capa#2983
- 3: Update actions to use Node.js 24 r-lib/actions#1044
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== workflow .github/workflows/ci.yml (relevant section) ==="
nl -ba .github/workflows/ci.yml | sed -n '40,160p'Repository: pku-typst/pkuthss-typst
Length of output: 189
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Try a more robust approach: fetch action.yml via raw GitHub URLs (no gh-API auth issues)
# and grep for the runtime (e.g., "using: node20") for the exact majors referenced in the workflow.
check_raw_runtime() {
local repo="$1"
local ref="$2"
echo "=== $repo action.yml runtime @ $ref ==="
local url="https://raw.githubusercontent.com/${repo}/${ref}/action.yml"
# If action.yml isn't present at that tag, fall back to action.yaml (rare).
local content
content="$(curl -fsSL "$url" || true)"
if [[ -z "${content}" ]]; then
url="https://raw.githubusercontent.com/${repo}/${ref}/action.yaml"
content="$(curl -fsSL "$url" || true)"
fi
if [[ -z "${content}" ]]; then
echo "No action.yml/action.yaml found at $repo@$ref"
return
fi
echo "$content" | rg -n "runs:|using: 'node|using: \"node|node[0-9]+" || true
echo
}
check_raw_runtime "actions/upload-artifact" "v4"
check_raw_runtime "actions/configure-pages" "v5"
check_raw_runtime "actions/upload-pages-artifact" "v3"
check_raw_runtime "actions/deploy-pages" "v4"Repository: pku-typst/pkuthss-typst
Length of output: 393
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== .github/workflows/ci.yml (lines 20-160) ==="
cat -n .github/workflows/ci.yml | sed -n '20,160p'Repository: pku-typst/pkuthss-typst
Length of output: 4744
🏁 Script executed:
#!/bin/bash
set -euo pipefail
show_runtime() {
local repo="$1"
local ref="$2"
echo "=== ${repo}@${ref} runtime lines ==="
curl -fsSL "https://raw.githubusercontent.com/${repo}/${ref}/action.yml" | rg -n "runs:|using:|node[0-9]+" || true
echo
}
# Current workflow majors
show_runtime "actions/upload-artifact" "v4"
show_runtime "actions/configure-pages" "v5"
show_runtime "actions/upload-pages-artifact" "v3"
show_runtime "actions/deploy-pages" "v4"
# Latest majors (from earlier `gh api ... releases/latest` results)
show_runtime "actions/upload-artifact" "v7.0.1"
show_runtime "actions/configure-pages" "v6.0.0"
show_runtime "actions/upload-pages-artifact" "v5.0.0"
show_runtime "actions/deploy-pages" "v5.0.0"Repository: pku-typst/pkuthss-typst
Length of output: 723
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for ref in v4 v5; do
echo "=== typst-community/setup-typst@${ref} runtime lines ==="
curl -fsSL "https://raw.githubusercontent.com/typst-community/setup-typst/${ref}/action.yml" \
| rg -n "runs:|using:|node[0-9]+" || true
echo
doneRepository: pku-typst/pkuthss-typst
Length of output: 231
Update remaining Node20-based GitHub Actions in ci.yml (Node 24 enforced starting Jun 2, 2026).
actions/upload-artifact@v4(line 54) → Node20actions/configure-pages@v5(line 119) → Node20actions/deploy-pages@v4(line 139) → Node20typst-community/setup-typst@v5(line 31) → Node24 ✅actions/upload-pages-artifact@v3(line 122) → composite (no Node20 runtime concern)
Bump the remaining Node20 actions to Node24-capable majors: actions/upload-artifact@v7, actions/configure-pages@v6, actions/deploy-pages@v5.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 31, Update the GitHub Actions uses entries
to Node24-capable major versions: change actions/upload-artifact@v4 →
actions/upload-artifact@v7, actions/configure-pages@v5 →
actions/configure-pages@v6, and actions/deploy-pages@v4 →
actions/deploy-pages@v5; keep typst-community/setup-typst@v5 as noted and leave
actions/upload-pages-artifact@v3 (composite) unchanged. Locate the uses lines
for "actions/upload-artifact", "actions/configure-pages", and
"actions/deploy-pages" in the ci.yml workflow and replace the version tags
accordingly, then run the workflow linter/CI to verify no breaking syntax
changes.
1 participant
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/configure-pages@v5, actions/upload-artifact@v4, typst-community/setup-typst@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Summary by CodeRabbit