Keep older version tags of GitHub Action

[itchyny]

Feature request

The Chromatic GitHub Action does not keep the git history and older version tags, but we really need them.
As usual for reproducible build, we lock the patch version of chromatic in package.json and use the exactly same version of chromaui/action by tag pinning.
This normally works well because GitHub Action Runner locally cache the action version, but it starts to fail when the cache expires.

We also have problem on integration with Renovate.
In order to conform to my company security rule, we actually use digest pinning for the action.
However, since you forcibly push and drop the git history of the action repository, Renovate fails to look up the configured digest from the repository.
This makes us unable to update the action version using Renovate, and we keep using older version which may expire at unexpected timing.

Proposed solution

Keep git history and older tags of chromaui/action.

Alternative solutions

Not sure.

Additional context

Nothing.

[withinfocus]

Here's an example: bitwarden/clients#6120 -- we'd like to add a comment after the digest so we can pin to a specific version / tag.

[ghengeveld]

FWIW, the alternative is to write your own GitHub Action workflow which invokes our CLI (which follows semver) directly, rather than using chromaui/action.

The main thing our action does is for pull_request events set event.payload.pull_request.head.ref as CHROMATIC_BRANCH and event.payload.pull_request.head.ref as CHROMATIC_PULL_REQUEST_SHA (env vars). See this file. However, the CLI actually does attempt to deal with that (see here) so you may not even need to do any of that. Here's an example workflow you could be using.

Needless to say the release process for the action is lacking and we want to address it. We just haven't gotten around to doing that yet.

[bmuenzenmeyer]

also found this issue in pursuit of associating a chromai/action sha with a semver tag - was slightly alarmed to see the history getting overwritten...it is literally harder to do what you are doing then just letting them remain out there, right?

my code: https://github.com/nodejs/nodejs.org/blob/main/.github/workflows/lint-and-tests.yml#L219

[ghengeveld]

We have plans to add versioning to the GitHub Action by introducing tags for major and patch releases (e.g. v7 and v7.0.1), which is what many other popular actions do as well. I can't pick this up short-term, but may be able to get to it later this month. No guarantees.

[itchyny]

Thanks for keeping old tags, we're now happy because Renovate can update the action version. Although git history is still lost, I'm okay with closing the issue because the original Renovate issue was resolved, but is there anyone really need old git history?

[ghengeveld]

Keeping history is still the intention but is a bit more work that’s hard to prioritize unfortunately. Happy to keep this ticket until we get around to it.