Streamlining Releases: Upgrading softprops/action-gh-release to v2 in ERP-1st

The Problem

In our ERP-1st project, maintaining efficient and secure CI/CD pipelines is paramount. We identified that our existing GitHub Actions workflow for creating releases was using an older version of softprops/action-gh-release. While functional, older action versions can pose security risks, lack newer features, and might eventually become deprecated, leading to workflow instability. Ensuring our automation tools are up-to-date is a critical part of a robust development lifecycle.

The Approach

To address potential vulnerabilities and leverage the latest enhancements, we initiated an upgrade of the softprops/action-gh-release action. This simple, yet important, fix moved our release process to version 2, ensuring better security and future compatibility.

Phase 1: Identifying the Need for Upgrade

The primary motivation was to move away from potentially stale dependencies within our CI/CD. Older GitHub Action versions might not receive critical security patches or could rely on deprecated APIs, making them a point of concern for long-term project health. Checking for fix: prefixes in commit messages often highlights such maintenance tasks.

Phase 2: The Upgrade Process

The upgrade itself was straightforward, involving a single line change in our GitHub Actions workflow YAML file. We transitioned from uses: softprops/action-gh-release@v1 to uses: softprops/action-gh-release@v2.

Here's an illustrative example of how a workflow step might look before and after the change:

Before (v1):

- name: Create Release
  uses: softprops/action-gh-release@v1
  if: startsWith(github.ref, 'refs/tags/')
  with:
    files: |
      my-app.zip
      checksums.txt
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

After (v2):

- name: Create Release
  uses: softprops/action-gh-release@v2
  if: startsWith(github.ref, 'refs/tags/')
  with:
    files: |
      my-app.zip
      checksums.txt
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

While the basic usage remained similar in this case, upgrading often brings new input parameters, improved error handling, or performance boosts. Reviewing the action's changelog is always a recommended step to understand any breaking changes or new functionalities.

Key Insight

Regularly updating third-party GitHub Actions is a crucial aspect of maintaining secure, stable, and performant CI/CD pipelines. Even small version bumps can bring important bug fixes and security enhancements, preventing potential issues down the line and ensuring our automated release process for ERP-1st remains robust.

Generated with Gitvlg.com