Skip to content

Update Typst setup action to version 5 #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
1195343015 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update Typst setup action to version 5 #50

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
uses: actions/checkout@v6

- name: Setup Typst
uses: typst-community/setup-typst@v4
uses: typst-community/setup-typst@v5

@coderabbitai coderabbitai Bot May 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify setup-typst@v5 exists and check its Typst version

# Check if the v5 tag exists in the repository
gh api repos/typst-community/setup-typst/git/ref/tags/v5 --jq '.ref' 2>/dev/null || echo "Warning: v5 tag not found"

# Fetch the action.yml to see default Typst version
gh api repos/typst-community/setup-typst/contents/action.yml --jq '.content' | base64 -d | grep -A5 'typst-version'

Repository: pku-typst/pkuthss-typst

Length of output: 2348

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/ci.yml"

echo "== typst-community/setup-typst usage =="
rg -n "typst-community/setup-typst@v" "$FILE" -n
# Print the block around the setup-typst usage
line=$(rg -n "typst-community/setup-typst@v" "$FILE" | head -n1 | cut -d: -f1)
start=$((line-6))
end=$((line+20))
sed -n "${start},${end}p" "$FILE" | nl -ba

echo
echo "== actions/upload-artifact usage =="
rg -n "actions/upload-artifact@" "$FILE"
rg -n "actions/configure-pages@" "$FILE"

Repository: pku-typst/pkuthss-typst

Length of output: 217

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/ci.yml"

echo "== setup-typst step context (around line 31) =="
cat -n "$FILE" | sed -n '20,45p'

echo
echo "== typst-version inputs passed in workflow =="
rg -n "typst-versions|typst-version" "$FILE" || true

echo
echo "== other action versions =="
rg -n "actions/upload-artifact@" "$FILE" || true
rg -n "actions/configure-pages@" "$FILE" || true

Repository: pku-typst/pkuthss-typst

Length of output: 1259

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# List candidate typst config files
echo "== typst.toml =="
if [ -f "typst.toml" ]; then
  sed -n '1,120p' typst.toml | cat -n
else
  echo "typst.toml not found at repo root"
  find . -maxdepth 3 -name "typst.toml" -print
fi

echo
echo "== search for compiler 0.14.0 =="
rg -n "compiler\s*=\s*\"0\.14\.0\"|0\.14\.0" -S . || true

echo
echo "== changelog.typ (if present) =="
if [ -f "changelog.typ" ]; then
  rg -n "0\.14\.0|compiler|Typst" changelog.typ || true
  sed -n '1,160p' changelog.typ | cat -n
else
  echo "changelog.typ not found at repo root"
  find . -maxdepth 3 -name "changelog.typ" -print
fi

Repository: pku-typst/pkuthss-typst

Length of output: 8190

Make CI’s Typst toolchain match typst.toml (compiler = "0.14.0")

  • .github/workflows/ci.yml uses typst-community/setup-typst@v5 at line 31, but the step provides no typst-version / typst-versions-* input.
  • The action’s typst-version input defaults to latest, so CI is not guaranteed to install Typst 0.14.0 as required by typst.toml (compiler pin).
  • The typst-community/setup-typst@v5 ref itself isn’t proven to exist from the repo info available here; ensure the workflow targets a valid tag/release.
  • Consider pinning uses: to a commit SHA for supply-chain hardening if your security checks require it.
🧰 Tools
🪛 zizmor (1.25.2)

[error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 31, CI workflow uses
typst-community/setup-typst@v5 without specifying typst-version so the installed
Typst may not match compiler = "0.14.0" in typst.toml; update the
.github/workflows/ci.yml step that uses typst-community/setup-typst@v5 to
explicitly set the typst-version (or typst-versions-*) input to "0.14.0", verify
the action ref (typst-community/setup-typst@v5) exists or replace it with a
valid tag/release, and optionally pin the uses: to a commit SHA for supply-chain
hardening.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check latest versions and Node.js runtime for GitHub Actions

echo "=== Checking actions/upload-artifact ==="
gh api repos/actions/upload-artifact/releases/latest --jq '.tag_name'

echo "=== Checking actions/configure-pages ==="
gh api repos/actions/configure-pages/releases/latest --jq '.tag_name'

echo "=== Checking actions/upload-pages-artifact ==="
gh api repos/actions/upload-pages-artifact/releases/latest --jq '.tag_name'

echo "=== Checking actions/deploy-pages ==="
gh api repos/actions/deploy-pages/releases/latest --jq '.tag_name'

Repository: pku-typst/pkuthss-typst

Length of output: 262

🏁 Script executed:

#!/bin/bash
# Check runs-on/engine Node runtime for the latest tag of each action by reading action.yml

set -euo pipefail

check_action() {
  local repo="$1"
  local ref="$2"
  echo "=== $repo action.yml @ $ref ==="
  gh api "repos/$repo/contents/action.yml?ref=$ref" --jq '.content' \
    | base64 -d 2>/dev/null | rg -n "runs:|node[0-9]+|using:" || true
  echo
}

# Latest tags from the previous run:
UPART="actions/upload-artifact:v7.0.1"
CONF="actions/configure-pages:v6.0.0"
UPPAG="actions/upload-pages-artifact:v5.0.0"
DEP="actions/deploy-pages:v5.0.0"

check_action "$UPART" "${UPART#*:}"
check_action "$CONF" "${CONF#*:}"
check_action "$UPPAG" "${UPPAG#*:}"
check_action "$DEP" "${DEP#*:}"

# Also check the specific currently-used versions from the workflow:
# upload-artifact@v4, configure-pages@v5
check_action "actions/upload-artifact" "v4"
check_action "actions/configure-pages" "v5"

Repository: pku-typst/pkuthss-typst

Length of output: 585

🌐 Web query:

GitHub Actions Node.js 24 mandatory June 2 2026 deprecation date

💡 Result:

GitHub Actions will force JavaScript actions to run on Node.js 24 by default starting June 2, 2026 (i.e., the mandatory transition/deprecation date you’re asking about is June 2, 2026). [1][2][3] In GitHub’s own changelog, the relevant window is described as: - Beginning on June 16, 2026, runners will begin using Node 24 by default (and you can temporarily opt out until Node 20 is removed later in 2026). [1] - The common deprecation warning text shown to action users also states “Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026,” with an additional note that Node.js 20 is removed from the runner later (September 16, 2026 in those warnings). [2] If you want to avoid failures/warnings around the transition, update your workflow to use action major versions that support Node.js 24, or opt into Node 24 early using the documented environment variable (FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true). [1][2]

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== workflow .github/workflows/ci.yml (relevant section) ==="
nl -ba .github/workflows/ci.yml | sed -n '40,160p'

Repository: pku-typst/pkuthss-typst

Length of output: 189

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Try a more robust approach: fetch action.yml via raw GitHub URLs (no gh-API auth issues)
# and grep for the runtime (e.g., "using: node20") for the exact majors referenced in the workflow.
check_raw_runtime() {
  local repo="$1"
  local ref="$2"
  echo "=== $repo action.yml runtime @ $ref ==="
  local url="https://raw.githubusercontent.com/${repo}/${ref}/action.yml"
  # If action.yml isn't present at that tag, fall back to action.yaml (rare).
  local content
  content="$(curl -fsSL "$url" || true)"
  if [[ -z "${content}" ]]; then
    url="https://raw.githubusercontent.com/${repo}/${ref}/action.yaml"
    content="$(curl -fsSL "$url" || true)"
  fi
  if [[ -z "${content}" ]]; then
    echo "No action.yml/action.yaml found at $repo@$ref"
    return
  fi
  echo "$content" | rg -n "runs:|using: 'node|using: \"node|node[0-9]+" || true
  echo
}

check_raw_runtime "actions/upload-artifact" "v4"
check_raw_runtime "actions/configure-pages" "v5"
check_raw_runtime "actions/upload-pages-artifact" "v3"
check_raw_runtime "actions/deploy-pages" "v4"

Repository: pku-typst/pkuthss-typst

Length of output: 393

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "=== .github/workflows/ci.yml (lines 20-160) ==="
cat -n .github/workflows/ci.yml | sed -n '20,160p'

Repository: pku-typst/pkuthss-typst

Length of output: 4744

🏁 Script executed:

#!/bin/bash
set -euo pipefail

show_runtime() {
  local repo="$1"
  local ref="$2"
  echo "=== ${repo}@${ref} runtime lines ==="
  curl -fsSL "https://raw.githubusercontent.com/${repo}/${ref}/action.yml" | rg -n "runs:|using:|node[0-9]+" || true
  echo
}

# Current workflow majors
show_runtime "actions/upload-artifact" "v4"
show_runtime "actions/configure-pages" "v5"
show_runtime "actions/upload-pages-artifact" "v3"
show_runtime "actions/deploy-pages" "v4"

# Latest majors (from earlier `gh api ... releases/latest` results)
show_runtime "actions/upload-artifact" "v7.0.1"
show_runtime "actions/configure-pages" "v6.0.0"
show_runtime "actions/upload-pages-artifact" "v5.0.0"
show_runtime "actions/deploy-pages" "v5.0.0"

Repository: pku-typst/pkuthss-typst

Length of output: 723

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for ref in v4 v5; do
  echo "=== typst-community/setup-typst@${ref} runtime lines ==="
  curl -fsSL "https://raw.githubusercontent.com/typst-community/setup-typst/${ref}/action.yml" \
    | rg -n "runs:|using:|node[0-9]+" || true
  echo
done

Repository: pku-typst/pkuthss-typst

Length of output: 231

Update remaining Node20-based GitHub Actions in ci.yml (Node 24 enforced starting Jun 2, 2026).

  • actions/upload-artifact@v4 (line 54) → Node20
  • actions/configure-pages@v5 (line 119) → Node20
  • actions/deploy-pages@v4 (line 139) → Node20
  • typst-community/setup-typst@v5 (line 31) → Node24 ✅
  • actions/upload-pages-artifact@v3 (line 122) → composite (no Node20 runtime concern)

Bump the remaining Node20 actions to Node24-capable majors: actions/upload-artifact@v7, actions/configure-pages@v6, actions/deploy-pages@v5.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 31, Update the GitHub Actions uses entries
to Node24-capable major versions: change actions/upload-artifact@v4 →
actions/upload-artifact@v7, actions/configure-pages@v5 →
actions/configure-pages@v6, and actions/deploy-pages@v4 →
actions/deploy-pages@v5; keep typst-community/setup-typst@v5 as noted and leave
actions/upload-pages-artifact@v3 (composite) unchanged. Locate the uses lines
for "actions/upload-artifact", "actions/configure-pages", and
"actions/deploy-pages" in the ci.yml workflow and replace the version tags
accordingly, then run the workflow linter/CI to verify no breaking syntax
changes.


- name: Compile thesis.typ
run: |
Expand Down