From 1945cbf3d1e6f433a2b7ed873cccd59ddb80ac40 Mon Sep 17 00:00:00 2001 From: Luis Pabon Date: Wed, 17 Jun 2026 14:02:02 +0100 Subject: [PATCH 1/7] chore: add planning artifacts for actions upgrade and compose example Co-Authored-By: Claude Opus 4.6 --- .../overview.md | 58 ++++++++++++++++++ .../plan.yaml | 59 +++++++++++++++++++ .../research.md | 39 ++++++++++++ 3 files changed, 156 insertions(+) create mode 100644 .project_planning/2026-06-17_actions-upgrade-compose-example/overview.md create mode 100644 .project_planning/2026-06-17_actions-upgrade-compose-example/plan.yaml create mode 100644 .project_planning/2026-06-17_actions-upgrade-compose-example/research.md diff --git a/.project_planning/2026-06-17_actions-upgrade-compose-example/overview.md b/.project_planning/2026-06-17_actions-upgrade-compose-example/overview.md new file mode 100644 index 0000000..d1c68fa --- /dev/null +++ b/.project_planning/2026-06-17_actions-upgrade-compose-example/overview.md @@ -0,0 +1,58 @@ +## Request + +Address two issues: + +1. **#58** — Upgrade all GitHub Actions to latest versions +2. **#54** — Provide a `compose.yaml` example pointing to the container registry image + +## Overview + +Bump 7 GitHub Actions across 2 workflow files to their latest major versions, and add an `examples/compose.yaml` for users to run the service locally via Docker Compose. + +## Key Decisions + +- **Major version tags only** — pin to major version tags (e.g. `@v6`) per GitHub Actions convention, not full SHAs or minor versions. Matches existing style. +- **Compose in `examples/`** — per user request, not repo root. +- **Compose references registry image** — `phpdockerio/readability-js-server:latest`, not a local build. +- **Include env var examples** — per user request, show configurable env vars with defaults commented or shown. + +## Tradeoffs + +- **Major tags vs SHA pinning**: major tags are less secure (mutable) but standard for this repo and simpler to maintain. SHA pinning would be more secure but noisy to update. +- **`latest` tag vs pinned version**: using `latest` in compose example is simplest for users. Pinning a version would be more reproducible but requires manual updates to the example. + +## Scope Boundaries + +**In scope:** +- Upgrade all actions in `build-publish.yaml` and `codeql-analysis.yml` +- Add `examples/compose.yaml` +- Update README to reference compose example + +**Out of scope:** +- Changing CI logic or workflow structure +- Adding dev-mode compose for local development +- Modifying Dockerfile +- Changing any application code + +## Verification Strategy + +From AGENTS.md and CI: + +| Check | Command | Cost | +|-------|---------|------| +| Lint | `pnpm lint` | Cheap | +| Test | `pnpm test` | Cheap | + +For this task specifically: +- Lint and test confirm no regressions (these changes don't touch app code, but good hygiene) +- Manual review of YAML syntax correctness +- `docker compose -f examples/compose.yaml config` to validate compose file syntax + +## Decision Log + +| # | Decision | Rationale | +|---|----------|-----------| +| 1 | Upgrade to major version tags | Matches existing convention | +| 2 | Compose in `examples/` | User preference | +| 3 | Include env var examples in compose | User preference | +| 4 | Reference `latest` tag in compose | Simplest for end users | diff --git a/.project_planning/2026-06-17_actions-upgrade-compose-example/plan.yaml b/.project_planning/2026-06-17_actions-upgrade-compose-example/plan.yaml new file mode 100644 index 0000000..8e667bd --- /dev/null +++ b/.project_planning/2026-06-17_actions-upgrade-compose-example/plan.yaml @@ -0,0 +1,59 @@ +steps: + - id: step-1 + title: Upgrade GitHub Actions versions + scope: > + Bump all action version tags in both workflow files to latest major versions. + build-publish.yaml: checkout v4→v6, setup-node v4→v5, setup-qemu-action v3→v4, + setup-buildx-action v3→v4, login-action v3→v4, build-push-action v6→v7. + codeql-analysis.yml: checkout v4→v6, codeql-action/*@v3→v4. + files: + - .github/workflows/build-publish.yaml + - .github/workflows/codeql-analysis.yml + constraints: + - Only change version tags, no workflow logic changes + - Keep tj-actions/changed-files@v46 as-is (already latest) + acceptance: + - All action references use latest major version tags + - YAML remains valid + - No workflow logic changed + verification: + - Visual diff review of version tags only + - Lint passes (pnpm lint) + + - id: step-2 + title: Add compose example + scope: > + Create examples/compose.yaml with phpdockerio/readability-js-server:latest, + port mapping 3000:3000, and commented env var examples from config.js. + files: + - examples/compose.yaml + constraints: + - Use image from registry, not local build + - Include all env vars from README config table with sensible defaults + - Follow compose spec (compose.yaml not docker-compose.yml) + acceptance: + - File exists at examples/compose.yaml + - References phpdockerio/readability-js-server:latest + - Exposes port 3000 + - Shows configurable env vars + - Passes docker compose config validation + verification: + - docker compose -f examples/compose.yaml config + + - id: step-3 + title: Update README with compose reference + depends_on: [step-2] + scope: > + Add a short section or line in README.md pointing users to examples/compose.yaml + for running via Docker Compose. + files: + - README.md + constraints: + - Keep it brief — reference the file, don't duplicate its contents + - Place near existing Docker section + acceptance: + - README mentions examples/compose.yaml + - No unrelated README changes + verification: + - pnpm lint + - pnpm test diff --git a/.project_planning/2026-06-17_actions-upgrade-compose-example/research.md b/.project_planning/2026-06-17_actions-upgrade-compose-example/research.md new file mode 100644 index 0000000..67f7b75 --- /dev/null +++ b/.project_planning/2026-06-17_actions-upgrade-compose-example/research.md @@ -0,0 +1,39 @@ +## Question + +What are the current latest major versions of all GitHub Actions used in this repository's workflows? + +## Findings + +| Action | Current | Latest | Status | +|--------|---------|--------|--------| +| actions/checkout | @v4 | @v6 | Upgrade needed | +| actions/setup-node | @v4 | @v5 | Upgrade needed | +| docker/setup-qemu-action | @v3 | @v4 | Upgrade needed | +| docker/setup-buildx-action | @v3 | @v4 | Upgrade needed | +| docker/login-action | @v3 | @v4 | Upgrade needed | +| docker/build-push-action | @v6 | @v7 | Upgrade needed | +| tj-actions/changed-files | @v46 | @v46 | Up-to-date | +| github/codeql-action | @v3 | @v4 | Upgrade needed | + +7 of 8 actions need upgrades. + +## Implications + +- Docker actions (qemu, buildx, login) moved to Node 24 runtime and ESM — requires Actions Runner v2.327.1+. GitHub-hosted runners already meet this. +- `actions/checkout` jumped two major versions (v4 → v6). +- `actions/setup-node` is one major version behind (v4 → v5). +- `github/codeql-action` is one major version behind (v3 → v4). + +## Risks and Uncertainties + +- Docker action v4 breaking changes: deprecated inputs removed, ESM switch. Need to verify no deprecated inputs are used in current workflows. +- `actions/checkout@v6` and `actions/setup-node@v5` breaking changes not fully enumerated — need to check changelogs if issues arise. +- `github/codeql-action@v4` may have changed default language detection or analysis behavior. + +## Sources + +- GitHub releases pages for each action repository + +## Open Questions + +- None blocking — current workflow usage is straightforward and unlikely to hit breaking changes. From b8aee7cd4ed6dd68270408b9aff70d8d6c0f2ebf Mon Sep 17 00:00:00 2001 From: Luis Pabon Date: Wed, 17 Jun 2026 14:06:09 +0100 Subject: [PATCH 2/7] chore: upgrade GitHub Actions to latest major versions Co-Authored-By: Claude Opus 4.6 --- .github/workflows/build-publish.yaml | 14 +++++++------- .github/workflows/codeql-analysis.yml | 8 ++++---- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/build-publish.yaml b/.github/workflows/build-publish.yaml index 59c7338..5df5355 100644 --- a/.github/workflows/build-publish.yaml +++ b/.github/workflows/build-publish.yaml @@ -16,13 +16,13 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Enable corepack run: corepack enable - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: 24 cache: pnpm @@ -43,17 +43,17 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Login to DockerHub if: github.event_name == 'push' - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -73,7 +73,7 @@ jobs: release - name: Build & push container image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . platforms: linux/amd64,linux/arm64 diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 170df58..0e4b4dd 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -22,11 +22,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 # Override language selection by uncommenting this and choosing your languages # with: # languages: go, javascript, csharp, python, cpp, java, ruby @@ -34,7 +34,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). # If this step fails, then you should remove it and run the build manually (see below). - name: Autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@v4 # ℹ️ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -48,4 +48,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 From f20e8cd55b897ffea37de67bc248462473ba33aa Mon Sep 17 00:00:00 2001 From: Luis Pabon Date: Wed, 17 Jun 2026 14:06:49 +0100 Subject: [PATCH 3/7] feat: add Docker Compose example --- examples/compose.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 examples/compose.yaml diff --git a/examples/compose.yaml b/examples/compose.yaml new file mode 100644 index 0000000..120daec --- /dev/null +++ b/examples/compose.yaml @@ -0,0 +1,14 @@ +services: + readability-js-server: + image: phpdockerio/readability-js-server:latest + ports: + - "3000:3000" + environment: + # PORT: 3000 + # REQUEST_BODY_LIMIT: 16kb + # FETCH_TIMEOUT_MS: 10000 + # FETCH_MAX_BYTES: 5242880 + # FETCH_MAX_REDIRECTS: 5 + # BLOCK_PRIVATE_NETWORKS: "true" + # READABILITY_MAX_ELEMS: (unset by default) + # MAX_CONCURRENT_REQUESTS: 10 From d917b003f5db7d8336a423b835ef40e5810ae7d9 Mon Sep 17 00:00:00 2001 From: Luis Pabon Date: Wed, 17 Jun 2026 14:07:32 +0100 Subject: [PATCH 4/7] fix: move environment vars to comments to keep compose.yaml valid --- examples/compose.yaml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/examples/compose.yaml b/examples/compose.yaml index 120daec..7b9a52d 100644 --- a/examples/compose.yaml +++ b/examples/compose.yaml @@ -3,12 +3,13 @@ services: image: phpdockerio/readability-js-server:latest ports: - "3000:3000" - environment: - # PORT: 3000 - # REQUEST_BODY_LIMIT: 16kb - # FETCH_TIMEOUT_MS: 10000 - # FETCH_MAX_BYTES: 5242880 - # FETCH_MAX_REDIRECTS: 5 - # BLOCK_PRIVATE_NETWORKS: "true" - # READABILITY_MAX_ELEMS: (unset by default) - # MAX_CONCURRENT_REQUESTS: 10 + # Uncomment and set any of the following environment variables to override defaults: + # environment: + # PORT: 3000 + # REQUEST_BODY_LIMIT: 16kb + # FETCH_TIMEOUT_MS: 10000 + # FETCH_MAX_BYTES: 5242880 + # FETCH_MAX_REDIRECTS: 5 + # BLOCK_PRIVATE_NETWORKS: "true" + # READABILITY_MAX_ELEMS: "" + # MAX_CONCURRENT_REQUESTS: 10 From 60a7e006f0ed1eb7ea109e1bc02e02bd5ab17e1c Mon Sep 17 00:00:00 2001 From: Luis Pabon Date: Wed, 17 Jun 2026 14:07:59 +0100 Subject: [PATCH 5/7] docs: add Docker Compose example reference to README --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index e2d78e4..1eb0596 100644 --- a/README.md +++ b/README.md @@ -158,6 +158,8 @@ docker run --rm -p 3000:3000 readability-js The image is based on `node:24-alpine`, installs production dependencies only, and runs the service as a non-root user. +For Docker Compose setup, see [`examples/compose.yaml`](examples/compose.yaml). + ## Security posture - Only absolute `http:` and `https:` URLs are accepted. From 6e34cd67a50faa2768aadac1b6ef5c62537999c5 Mon Sep 17 00:00:00 2001 From: Luis Pabon Date: Wed, 17 Jun 2026 14:08:39 +0100 Subject: [PATCH 6/7] chore: add execution state for actions upgrade and compose example --- .../execution.md | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .project_planning/2026-06-17_actions-upgrade-compose-example/execution.md diff --git a/.project_planning/2026-06-17_actions-upgrade-compose-example/execution.md b/.project_planning/2026-06-17_actions-upgrade-compose-example/execution.md new file mode 100644 index 0000000..d86837c --- /dev/null +++ b/.project_planning/2026-06-17_actions-upgrade-compose-example/execution.md @@ -0,0 +1,40 @@ +# Execution State + +## Branch +`cl/2026-06-17_actions-upgrade-compose-example` + +## Verification Strategy +- `pnpm lint` — lint check +- `pnpm test` — test suite +- `docker compose -f examples/compose.yaml config` — compose syntax validation +- Deferred until all steps implemented + +## Steps + +| id | title | status | +|----|-------|--------| +| step-1 | Upgrade GitHub Actions versions | complete | +| step-2 | Add compose example | complete | +| step-3 | Update README with compose reference | complete | + +## Sub-Agents + +| step | model | worktree | sha | +|------|-------|----------|-----| +| step-1 | haiku | /tmp/wt-step-1 | b8aee7c | +| step-2 | haiku | /tmp/wt-step-2 | f20e8cd (+ fix d917b00) | +| step-3 | haiku | /tmp/wt-step-3 | 60a7e00 | + +## Deviations / Blockers + +- step-2: sub-agent used `environment:` with all-commented values → invalid YAML. Executor fixed directly (moved env block to comment above `environment:` key). Compose validation passed after fix. + +## Verification Results + +- `prettier -c src/ test/ scripts/` → All matched files use Prettier code style! +- `node --test` → 19 pass, 0 fail +- `docker compose -f examples/compose.yaml config` → valid + +## Reviewer Handoff + +Ready. All steps complete, verification passing, worktrees cleaned up. From 36b43049195cdae174a8a815c2fbf33bd9508960 Mon Sep 17 00:00:00 2001 From: Luis Pabon Date: Wed, 17 Jun 2026 14:13:54 +0100 Subject: [PATCH 7/7] chore: remove planning artifacts for actions upgrade and compose example Co-Authored-By: Claude Sonnet 4.6 --- .../execution.md | 40 ------------- .../overview.md | 58 ------------------ .../plan.yaml | 59 ------------------- .../research.md | 39 ------------ 4 files changed, 196 deletions(-) delete mode 100644 .project_planning/2026-06-17_actions-upgrade-compose-example/execution.md delete mode 100644 .project_planning/2026-06-17_actions-upgrade-compose-example/overview.md delete mode 100644 .project_planning/2026-06-17_actions-upgrade-compose-example/plan.yaml delete mode 100644 .project_planning/2026-06-17_actions-upgrade-compose-example/research.md diff --git a/.project_planning/2026-06-17_actions-upgrade-compose-example/execution.md b/.project_planning/2026-06-17_actions-upgrade-compose-example/execution.md deleted file mode 100644 index d86837c..0000000 --- a/.project_planning/2026-06-17_actions-upgrade-compose-example/execution.md +++ /dev/null @@ -1,40 +0,0 @@ -# Execution State - -## Branch -`cl/2026-06-17_actions-upgrade-compose-example` - -## Verification Strategy -- `pnpm lint` — lint check -- `pnpm test` — test suite -- `docker compose -f examples/compose.yaml config` — compose syntax validation -- Deferred until all steps implemented - -## Steps - -| id | title | status | -|----|-------|--------| -| step-1 | Upgrade GitHub Actions versions | complete | -| step-2 | Add compose example | complete | -| step-3 | Update README with compose reference | complete | - -## Sub-Agents - -| step | model | worktree | sha | -|------|-------|----------|-----| -| step-1 | haiku | /tmp/wt-step-1 | b8aee7c | -| step-2 | haiku | /tmp/wt-step-2 | f20e8cd (+ fix d917b00) | -| step-3 | haiku | /tmp/wt-step-3 | 60a7e00 | - -## Deviations / Blockers - -- step-2: sub-agent used `environment:` with all-commented values → invalid YAML. Executor fixed directly (moved env block to comment above `environment:` key). Compose validation passed after fix. - -## Verification Results - -- `prettier -c src/ test/ scripts/` → All matched files use Prettier code style! -- `node --test` → 19 pass, 0 fail -- `docker compose -f examples/compose.yaml config` → valid - -## Reviewer Handoff - -Ready. All steps complete, verification passing, worktrees cleaned up. diff --git a/.project_planning/2026-06-17_actions-upgrade-compose-example/overview.md b/.project_planning/2026-06-17_actions-upgrade-compose-example/overview.md deleted file mode 100644 index d1c68fa..0000000 --- a/.project_planning/2026-06-17_actions-upgrade-compose-example/overview.md +++ /dev/null @@ -1,58 +0,0 @@ -## Request - -Address two issues: - -1. **#58** — Upgrade all GitHub Actions to latest versions -2. **#54** — Provide a `compose.yaml` example pointing to the container registry image - -## Overview - -Bump 7 GitHub Actions across 2 workflow files to their latest major versions, and add an `examples/compose.yaml` for users to run the service locally via Docker Compose. - -## Key Decisions - -- **Major version tags only** — pin to major version tags (e.g. `@v6`) per GitHub Actions convention, not full SHAs or minor versions. Matches existing style. -- **Compose in `examples/`** — per user request, not repo root. -- **Compose references registry image** — `phpdockerio/readability-js-server:latest`, not a local build. -- **Include env var examples** — per user request, show configurable env vars with defaults commented or shown. - -## Tradeoffs - -- **Major tags vs SHA pinning**: major tags are less secure (mutable) but standard for this repo and simpler to maintain. SHA pinning would be more secure but noisy to update. -- **`latest` tag vs pinned version**: using `latest` in compose example is simplest for users. Pinning a version would be more reproducible but requires manual updates to the example. - -## Scope Boundaries - -**In scope:** -- Upgrade all actions in `build-publish.yaml` and `codeql-analysis.yml` -- Add `examples/compose.yaml` -- Update README to reference compose example - -**Out of scope:** -- Changing CI logic or workflow structure -- Adding dev-mode compose for local development -- Modifying Dockerfile -- Changing any application code - -## Verification Strategy - -From AGENTS.md and CI: - -| Check | Command | Cost | -|-------|---------|------| -| Lint | `pnpm lint` | Cheap | -| Test | `pnpm test` | Cheap | - -For this task specifically: -- Lint and test confirm no regressions (these changes don't touch app code, but good hygiene) -- Manual review of YAML syntax correctness -- `docker compose -f examples/compose.yaml config` to validate compose file syntax - -## Decision Log - -| # | Decision | Rationale | -|---|----------|-----------| -| 1 | Upgrade to major version tags | Matches existing convention | -| 2 | Compose in `examples/` | User preference | -| 3 | Include env var examples in compose | User preference | -| 4 | Reference `latest` tag in compose | Simplest for end users | diff --git a/.project_planning/2026-06-17_actions-upgrade-compose-example/plan.yaml b/.project_planning/2026-06-17_actions-upgrade-compose-example/plan.yaml deleted file mode 100644 index 8e667bd..0000000 --- a/.project_planning/2026-06-17_actions-upgrade-compose-example/plan.yaml +++ /dev/null @@ -1,59 +0,0 @@ -steps: - - id: step-1 - title: Upgrade GitHub Actions versions - scope: > - Bump all action version tags in both workflow files to latest major versions. - build-publish.yaml: checkout v4→v6, setup-node v4→v5, setup-qemu-action v3→v4, - setup-buildx-action v3→v4, login-action v3→v4, build-push-action v6→v7. - codeql-analysis.yml: checkout v4→v6, codeql-action/*@v3→v4. - files: - - .github/workflows/build-publish.yaml - - .github/workflows/codeql-analysis.yml - constraints: - - Only change version tags, no workflow logic changes - - Keep tj-actions/changed-files@v46 as-is (already latest) - acceptance: - - All action references use latest major version tags - - YAML remains valid - - No workflow logic changed - verification: - - Visual diff review of version tags only - - Lint passes (pnpm lint) - - - id: step-2 - title: Add compose example - scope: > - Create examples/compose.yaml with phpdockerio/readability-js-server:latest, - port mapping 3000:3000, and commented env var examples from config.js. - files: - - examples/compose.yaml - constraints: - - Use image from registry, not local build - - Include all env vars from README config table with sensible defaults - - Follow compose spec (compose.yaml not docker-compose.yml) - acceptance: - - File exists at examples/compose.yaml - - References phpdockerio/readability-js-server:latest - - Exposes port 3000 - - Shows configurable env vars - - Passes docker compose config validation - verification: - - docker compose -f examples/compose.yaml config - - - id: step-3 - title: Update README with compose reference - depends_on: [step-2] - scope: > - Add a short section or line in README.md pointing users to examples/compose.yaml - for running via Docker Compose. - files: - - README.md - constraints: - - Keep it brief — reference the file, don't duplicate its contents - - Place near existing Docker section - acceptance: - - README mentions examples/compose.yaml - - No unrelated README changes - verification: - - pnpm lint - - pnpm test diff --git a/.project_planning/2026-06-17_actions-upgrade-compose-example/research.md b/.project_planning/2026-06-17_actions-upgrade-compose-example/research.md deleted file mode 100644 index 67f7b75..0000000 --- a/.project_planning/2026-06-17_actions-upgrade-compose-example/research.md +++ /dev/null @@ -1,39 +0,0 @@ -## Question - -What are the current latest major versions of all GitHub Actions used in this repository's workflows? - -## Findings - -| Action | Current | Latest | Status | -|--------|---------|--------|--------| -| actions/checkout | @v4 | @v6 | Upgrade needed | -| actions/setup-node | @v4 | @v5 | Upgrade needed | -| docker/setup-qemu-action | @v3 | @v4 | Upgrade needed | -| docker/setup-buildx-action | @v3 | @v4 | Upgrade needed | -| docker/login-action | @v3 | @v4 | Upgrade needed | -| docker/build-push-action | @v6 | @v7 | Upgrade needed | -| tj-actions/changed-files | @v46 | @v46 | Up-to-date | -| github/codeql-action | @v3 | @v4 | Upgrade needed | - -7 of 8 actions need upgrades. - -## Implications - -- Docker actions (qemu, buildx, login) moved to Node 24 runtime and ESM — requires Actions Runner v2.327.1+. GitHub-hosted runners already meet this. -- `actions/checkout` jumped two major versions (v4 → v6). -- `actions/setup-node` is one major version behind (v4 → v5). -- `github/codeql-action` is one major version behind (v3 → v4). - -## Risks and Uncertainties - -- Docker action v4 breaking changes: deprecated inputs removed, ESM switch. Need to verify no deprecated inputs are used in current workflows. -- `actions/checkout@v6` and `actions/setup-node@v5` breaking changes not fully enumerated — need to check changelogs if issues arise. -- `github/codeql-action@v4` may have changed default language detection or analysis behavior. - -## Sources - -- GitHub releases pages for each action repository - -## Open Questions - -- None blocking — current workflow usage is straightforward and unlikely to hit breaking changes.