ci: bump remaining node20 action pins to node24-ready releases (rebase of #28333)#44832
Closed
AIalliAI wants to merge 1 commit into
Closed
ci: bump remaining node20 action pins to node24-ready releases (rebase of #28333)#44832AIalliAI wants to merge 1 commit into
AIalliAI wants to merge 1 commit into
Conversation
GitHub forces actions declaring node20 onto the node24 runtime by default starting 2026-06-16, and removes node20 from runners on 2026-09-16. Every Tests/Lint run currently emits deprecation annotations for the node20 pins. This is a rebase of NousResearch#28333 (credit: daelnom-dev) onto current main. Roughly half of that PR's bumps have since landed on main piecemeal (checkout v6.0.2, setup-python v6.2.0, docker login v4.1.0, build-push v7.1.0, upload/download-artifact v7/v8 in tests.yml, sigstore v3.3.0, osv-scanner v2.3.8); this picks up the remainder, keeping that PR's exact verified SHAs: - astral-sh/setup-uv v5 + v6 -> v8.1.0 (node24) - actions/upload-artifact v4 -> v7.0.1, download-artifact v4 -> v8.0.1 (remaining lint/docker-publish/skills-index/pypi sites) - actions/github-script v7 -> v9.0.0 - actions/setup-node v4 -> v6.4.0 - actions/create-github-app-token v1.9.3 -> v3.2.0 (inputs already use the v2+ hyphenated names) - docker/setup-buildx-action v3 -> v4.0.0 - marocchino/sticky-pull-request-comment v2.9.1 -> v3.0.4 - actions/upload-pages-artifact v3 -> v5.0.0 + deploy-pages v4 -> v5.0.0 (documented compatible pair) - cachix/cachix-action v17 re-tag SHA (tree-identical to current pin) - comment fix: setup-python pin in lint.yml was already v6.2.0 but still labeled v5 Every new SHA was verified to match its tagged release commit in the action's upstream repo, and each major bump's breaking changes were checked against this repo's actual usage (inputs, outputs, credential -dependent push flows in nix-lockfile-fix.yml, Pages staging in deploy-site.yml, artifact name/pattern downloads) - no workflow behavior changes required. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
Live verification: these exact pin bumps were cherry-picked onto the head of rollup PR #44061 (commit 1f0dc0d) and the full check suite ran green — Tests (all 6 shards + e2e), Lint, Docker Build and Publish, Nix (including the sticky-comment v3.0.4 path), uv.lock check, Docs Site Checks, Typecheck, Supply Chain Audit, History Check, Contributor Attribution. The Node.js 20 deprecation annotations that previously appeared on every Tests/Lint run are gone on that head. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps every remaining GitHub Actions pin that still declares the node20 runtime to its current node24-ready release, SHA-pinned. GitHub forces node20 actions onto node24 by default starting 2026-06-16 (and removes node20 from runners 2026-09-16) — every Tests/Lint run currently emits deprecation annotations for these pins.
This is a rebase of #28333 (credit: @daelnom-dev) onto current main. That PR is now conflicting: roughly half of its bumps have since landed on main piecemeal (checkout v6.0.2, setup-python v6.2.0, docker login v4.1.0, build-push v7.1.0, upload/download-artifact v7/v8 in tests.yml, sigstore v3.3.0, osv-scanner v2.3.8). This PR picks up the remainder, keeping that PR's exact SHAs:
Plus one comment fix: the setup-python pin in lint.yml was already bumped to the v6.2.0 SHA on main but still labeled
# v5.Verification
actions/checkoutv6 (already on main) keepspersist-credentials: trueas default; v6 moves credentials to$RUNNER_TEMPwith no workflow changes required — thegit pushflows in nix-lockfile-fix.yml are unaffected.create-github-app-tokenv2 removed the snake_case inputs — nix-lockfile-fix.yml already usesapp-id/private-key, and thetokenoutput is unchanged.github-scriptv9: both scripts in this repo use onlyrequire('fs')+github.rest.*/core.*— nogetOctokitshadowing, noresult-encoding.upload-pages-artifactv4+ excludes dotfiles from the artifact — deploy-site.yml stages withcp -r website/build/* _site/docs/, which already drops top-level dotfiles; no load-bearing dotfiles in the Docusaurus build.download-artifactv5's single-download path change applies only toartifact-idsdownloads — this repo downloads bynameorpattern+merge-multipleexclusively ("no action needed" cases).setup-uvv6–v8 removals (python-versionauto-venv,server-url,pyproject-file, tag conventions) — none used here;enable-cache+cache-dependency-globin tests.yml keep identical semantics in v8.setup-nodev5 auto-caching trigger (packageManagerfield) — absent from all package.json files; every caching usage passes explicitcache: npm.setup-buildxv4 /build-pushv7 /loginv4: removed inputs/envs unused; the consumedsteps.push.outputs.digestis unchanged.Closes #28333 if maintainers prefer this rebase; happy to close this one instead if @daelnom-dev rebases the original.