IBX-11778: [GHA] Updated deprecated versions of GitHub actions

.github/workflows/browser-tests.yml

@@ -143,12 +143,11 @@ jobs:
                 \"}}]}" >> $GITHUB_ENV
             - if: always() && github.event_name != 'pull_request' && job.status != 'success' && job.status != 'skipped'
               name: Send notification about workflow result
-              uses: slackapi/slack-github-action@v1.23.0
+              uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
               with:
+                webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
+                webhook-type: incoming-webhook
                 payload: ${{ env.SLACK_PAYLOAD }}
-              env:
-                SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-                SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
 
     browser-tests:
         needs: setup-jobs
@@ -162,7 +161,7 @@ jobs:
               name: "[Varnish] Set the URL the tests should access"
               run: echo "WEB_HOST=http://varnish" >> $GITHUB_ENV
 
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Set up project version
               id: project-version
@@ -179,7 +178,7 @@ jobs:
                 version: ${{ inputs.project-version }}
 
             - name: Setup PHP Action
-              uses: shivammathur/setup-php@v2
+              uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
               with:
                   php-version: 8.3
                   coverage: none
@@ -189,7 +188,7 @@ jobs:
               run: composer --version
 
             - name: Cache dependencies
-              uses: actions/cache@v4
+              uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
               with:
                   path: ${{ env.COMPOSER_CACHE_DIR }}
                   key: ${{ inputs.project-edition }}-${{ steps.project-version.outputs.version }}-${{ inputs.php-image }}-${{ github.sha }}
@@ -198,9 +197,9 @@ jobs:
 
             - name: Generate token
               id: generate_token
-              uses: actions/create-github-app-token@v2
+              uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
               with:
-                  app-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
+                  client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
                   private-key: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
                   owner: ${{ !contains(steps.project-version.outputs.version, '3.3') && 'ibexa' || 'ezsystems' }}
 
@@ -366,9 +365,8 @@ jobs:
 
             - if: always() && github.event_name != 'pull_request' && (job.status != 'success' || inputs.send-success-notification)
               name: Send notification about workflow result
-              uses: slackapi/slack-github-action@v1.23.0
+              uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
               with:
+                  webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
+                  webhook-type: incoming-webhook
                   payload: ${{ env.SLACK_PAYLOAD }}
-              env:
-                  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-                  SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/cross-merge.yml

@@ -12,24 +12,40 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-        - uses: actions/checkout@v3
+        - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
           with:
             fetch-depth: 0
             token: ${{ secrets.robot-token }}
 
         - name: Inject slug/short variables
-          uses: rlespinasse/github-slug-action@v3.x
+          uses: rlespinasse/github-slug-action@e6f261660910b273384c5c42b17a0217881b217a # v5.6.0
 
         - name: Get merge map
-          uses: octokit/request-action@v2.x
           id: map
           # Allow failures to be ignored.
           # We will consider output as empty
           continue-on-error: true
-          with:
-            owner: ibexa
-            repo: cross-merge-map
-            route: /repos/{owner}/{repo}/contents/${{ github.repository }}
+          shell: bash
+          run: |
+            map_repository="ibexa/cross-merge-map"
+            map_path="${{ github.repository }}"
+
+            echo "Fetching cross-merge map for ${map_path}"
+            echo "Map repository: ${map_repository}"
+
+            gh api "/repos/${map_repository}" >/dev/null
+
+            if ! response=$(gh api "/repos/${map_repository}/contents/${map_path}" 2>&1); then
+              echo "No cross-merge map found for ${map_path}. Skipping cross-merge."
+              echo "${response}"
+              exit 0
+            fi
+
+            {
+              echo 'data<<EOF'
+              echo "$response"
+              echo EOF
+            } >> "$GITHUB_OUTPUT"
           env:
             GITHUB_TOKEN: ${{ secrets.robot-token }}
 
@@ -38,15 +54,31 @@ jobs:
           id: destinations
           if: ${{ steps.map.outputs.data }}
           run: |
+            source_branch="${{ github.ref_name }}"
+
             cat > input.json <<'EOF'
             ${{ steps.map.outputs.data }}
             EOF
+
             jq -r '.["content"]' input.json | base64 --decode | jq -c . > map.json
-            echo Looking for destination for branch ${{ env.GITHUB_REF_SLUG }}
-            branch=$(jq -r '.["${{ env.GITHUB_REF_SLUG }}"] | select (.!=null)' map.json)
-            echo Destination branch found. It is ${branch}
-            repo=$(jq -r '.DEST' map.json)
+            echo "Looking for destination for branch ${source_branch}"
+            echo "Configured source branches: $(jq -r 'keys - ["DEST"] | join(", ")' map.json)"
+
+            branch=$(jq -r --arg source_branch "$source_branch" '.[$source_branch] // empty' map.json)
+            if [ -z "$branch" ]; then
+              echo "No cross-merge destination configured for branch ${source_branch}. Skipping cross-merge."
+              exit 0
+            fi
+
+            repo=$(jq -r '.DEST // empty' map.json)
+            if [ -z "$repo" ]; then
+              echo "::error::Cross-merge map for ${{ github.repository }} does not define DEST"
+              exit 1
+            fi
+
             destination=temp_${{ env.GITHUB_REF_SLUG }}_to_$branch
+            echo "Destination branch found. It is ${branch}"
+            echo "Destination repository: ${repo}"
             echo "branch=$branch" >> $GITHUB_OUTPUT
             echo "repo=$repo" >> $GITHUB_OUTPUT
             echo "destination=$destination" >> $GITHUB_OUTPUT

.github/workflows/expand-team-reviewers.yml

@@ -27,10 +27,10 @@ jobs:
 
     steps:
       - name: Generate GitHub App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: generate_token
         with:
-          app-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
+          client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
           private-key: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
           owner: ${{ github.repository_owner }}
 

.github/workflows/post_release.yaml

@@ -14,11 +14,11 @@ jobs:
     steps:
       - name: Authenticate as GitHub app
         id: generate_token
-        uses: tibdex/github-app-token@v1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app_id: ${{ secrets.AUTOMATION_CLIENT_ID }}
-          installation_id: ${{ secrets.AUTOMATION_CLIENT_INSTALLATION }}
-          private_key: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
+          client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
+          private-key: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
+          owner: ${{ github.repository_owner }}
 
       - name: Extract tag name
         id: tag
@@ -28,7 +28,7 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Trigger archive-maker via repository_dispatch
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.generate_token.outputs.token }}
           script: |

.github/workflows/pr-assign.yml

@@ -19,16 +19,19 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0 as of 25.03.2026
-        name: Get list of assignees
+      - name: Get list of assignees
         id: assignees
         # Allow failures to be ignored.
         # We will consider output as empty
         continue-on-error: true
-        with:
-          owner: ibexa
-          repo: pr-assignees
-          route: /repos/{owner}/{repo}/contents/${{ github.repository }}/maintainers
+        shell: bash
+        run: |
+          response=$(gh api /repos/ibexa/pr-assignees/contents/${{ github.repository }}/maintainers)
+          {
+            echo 'data<<EOF'
+            echo "$response"
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
         env:
           GITHUB_TOKEN: ${{ secrets.robot-token }}
 

.github/workflows/pr-check.yml

@@ -7,24 +7,34 @@ jobs:
     name: Pull Request base branch verification
     runs-on: ubuntu-latest
     steps:
-      - uses: octokit/request-action@v2.x
-        name: Get PR's composer.json
+      - name: Get PR's composer.json
         id: pr
-        with:
-          branch: "!!str ${{ github.event.pull_request.head.ref }}"
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          route: /repos/{repository}/contents/composer.json?ref={branch}
+        shell: bash
+        run: |
+          response=$(gh api --method GET "/repos/${REPOSITORY}/contents/composer.json" -f ref="$BRANCH")
+          {
+            echo 'data<<EOF'
+            echo "$response"
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ github.token }}  
-      - uses: octokit/request-action@v2.x
-        name: Get base's composer.json
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          GITHUB_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
+      - name: Get base's composer.json
         id: base
-        with:
-          branch: "!!str ${{ github.event.pull_request.base.ref }}"
-          repository: ${{ github.event.pull_request.base.repo.full_name }}
-          route: /repos/{repository}/contents/composer.json?ref={branch}
+        shell: bash
+        run: |
+          response=$(gh api --method GET "/repos/${REPOSITORY}/contents/composer.json" -f ref="$BRANCH")
+          {
+            echo 'data<<EOF'
+            echo "$response"
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ github.token }}  
+          BRANCH: ${{ github.event.pull_request.base.ref }}
+          GITHUB_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.event.pull_request.base.repo.full_name }}
       - name: Verify base branch
         run: |
           PR_BRANCH_ALIAS=$(echo $PR_DATA | jq -r '.["content"]' | base64 --decode | jq -r '.["extra"]["branch-alias"] | flatten | .[0]')

.github/workflows/pr-label-reactor.yml

@@ -19,12 +19,13 @@ jobs:
 
     - name: slack-send
       if: ${{ env.channel-id }}
-      env:
-        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-      uses: slackapi/slack-github-action@v1.26.0
+      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
       with:
-        channel-id: ${{ env.channel-id }}
-        slack-message: "${{ github.event.pull_request._links.html.href }} from @${{ github.event.pull_request.user.login }} is now ${{ github.event.label.name }}"
+        method: chat.postMessage
+        token: ${{ secrets.SLACK_BOT_TOKEN }}
+        payload: |
+          channel: ${{ env.channel-id }}
+          text: "${{ github.event.pull_request._links.html.href }} from @${{ github.event.pull_request.user.login }} is now ${{ github.event.label.name }}"
 
   unlabeler:
     if: github.event.action == 'unlabeled'
@@ -33,4 +34,4 @@ jobs:
 
     - name: Placeholder
       run: |
-        echo "This is a placeholder for when a label is removed."
+        echo "This is a placeholder for when a label is removed."

.github/workflows/raptor-pr-checks.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Check if branch is up to date with base branch

.github/workflows/raptor-required-pr-checks.yml

@@ -5,5 +5,5 @@ on:
 
 jobs:
   check-up-to-date:
-    uses: ibexa/gh-workflows/.github/workflows/raptor-pr-checks.yml@main
+    uses: ibexa/gh-workflows/.github/workflows/raptor-pr-checks.yml@ibx-11778-update-deprecated-actions
     secrets: inherit

.github/workflows/reactor-linters.yml

@@ -8,8 +8,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: json-yaml-validate
-        uses: GrantBirki/json-yaml-validate@v2.7.1
+        uses: GrantBirki/json-yaml-validate@3ff75979f3b21171f2e8a44705f0ff4bed30bbc0 # v5.0.0
         with:
-          use_dot_match: "false"
+          use_dot_match: "false"

.github/workflows/rector.yml

@@ -16,9 +16,9 @@ jobs:
         runs-on: ubuntu-latest
 
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-            - uses: ibexa/gh-workflows/actions/composer-install@main
+            - uses: ibexa/gh-workflows/actions/composer-install@ibx-11778-update-deprecated-actions
               with:
                   gh-client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
                   gh-client-secret: ${{ secrets.AUTOMATION_CLIENT_SECRET }}