[skip changelog] Migrate workflows from deprecated `set-output` commands #1940

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merged

per1234 merged 1 commit into arduino:master from per1234:migrate-set-output

Oct 24, 2022

Merged

[skip changelog] Migrate workflows from deprecated `set-output` commands #1940

per1234 merged 1 commit into arduino:master from per1234:migrate-set-output

Oct 24, 2022

Conversation

per1234

Copy link

Contributor

@per1234 per1234 commented Oct 24, 2022

Please check if the PR fulfills these requirements

See how to contribute

The PR has no duplicates (please search among the Pull Requests
before creating one)
The PR follows
our contributing guidelines
[N/A] Tests for the changes have been added (for bug fixes / features)
[N/A] Docs have been added / updated (for bug fixes / features)
[N/A] UPGRADING.md has been updated with a migration guide (for breaking changes)

What kind of change does this PR introduce?

Infrastructure fix

What is the current behavior?

GitHub Actions provides the capability for workflow authors to use the capabilities of the GitHub Actions ToolKit package directly in the run keys of workflows via "workflow commands". One such command is set-output, which allows data to be passed out of a workflow step as an output.

It has been determined that this command has potential to be a security risk in some applications. For this reason, GitHub has deprecated the command and a warning of this is shown in the workflow run summary page of any workflow using it:

The set-output command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

What is the new behavior?

The identical capability is now provided in a safer form via the GitHub Actions "environment files" system. Migrating the use of the deprecated workflow commands to use the GITHUB_OUTPUT environment file instead fixes any potential vulnerabilities in the workflows, resolves the warnings, and avoids the eventual complete breakage of the workflows that would result from GitHub's planned removal of the set-output workflow command 2023年05月31日.

Does this PR introduce a breaking change, and is titled accordingly?

No breaking change.

@per1234


 [skip changelog] Migrate workflows from deprecated set-output commands

617be8d

GitHub Actions provides the capability for workflow authors to use the capabilities of the GitHub Actions ToolKit
package directly in the `run` keys of workflows via "workflow commands". One such command is `set-output`, which allows
data to be passed out of a workflow step as an output.
It has been determined that this command has potential to be a security risk in some applications. For this reason,
GitHub has deprecated the command and a warning of this is shown in the workflow run summary page of any workflow using
it:
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more
information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
The identical capability is now provided in a safer form via the GitHub Actions "environment files" system. Migrating
the use of the deprecated workflow commands to use the `GITHUB_OUTPUT` environment file instead fixes any potential
vulnerabilities in the workflows, resolves the warnings, and avoids the eventual complete breakage of the workflows that
would result from GitHub's planned removal of the `set-output` workflow command 2023年05月31日.