Skip to content

Commit 7d3086f

Browse files
mikolalysenkoclaude
mikolalysenko
and
claude
authored
CI: move action pins off deprecated Node 20 (#1588) (#1590)
* CI: move action pins off deprecated Node 20 GitHub now forces actions that target Node.js 20 onto Node 24 and logs a deprecation warning on every job. When Node 20 support is removed, every PR and merge-queue leg that sets up Node or Python, or moves an artifact, would break at the same moment. Move the CI workflow and the two artifact retry composites to the first release of each action that runs on Node 24. Each new pin's only breaking change is the runtime, or an input we don't use: - setup-node v4 -> v6.4.0 (pin already used in release.yml; no root package.json, so the v5+ auto-cache never turns on) - setup-python v5 -> v6.3.0 - download-artifact v4 -> v7.0.0 (we download by pattern, not ID) - upload-artifact v4 -> v6.0.0 - setup-uv v6.8.0 -> v7.0.0 (drops only the unused server-url) release.yml and the disabled compatibility workflows are left alone. Refs #1588 Assisted-by: Claude Code:claude-opus-5-5 * CI: keep download retry comment version-neutral The truncated-download note named v4 as if it described the current pin. Say it was seen on v4 so nobody reads the verify-and-retry steps as a v4-only workaround and drops them. Assisted-by: Claude Code:claude-opus-5-5 --------- Co-authored-by: Claude <noreply@anthropic.com>
1 parent 657fce2 commit 7d3086f

3 files changed

Lines changed: 21 additions & 20 deletions

File tree

‎.github/actions/download-artifact/action.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,16 @@ inputs:
1818
runs:
1919
using: composite
2020
steps:
21-
# download-artifact v4 can finish "successfully" with a truncated file:
22-
# run 38059192473 attempt 1 logged "Starting download" and nothing more,
21+
# download-artifact can finish "successfully" with a truncated file.
22+
# Seen on v4; keep the check on newer majors too: run
23+
# 38059192473 attempt 1 logged "Starting download" and nothing more,
2324
# then `zstd -d` failed with "Read error (39) : premature end" in the
2425
# next step and the leg went red. A merge-queue leg that does that
2526
# evicts the entry, so check the files and fetch them once more.
2627
- name: Download (attempt 1)
2728
id: first
2829
if: ${{ !cancelled() }}
29-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
30+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
3031
continue-on-error: true
3132
with:
3233
pattern: ${{ inputs.pattern }}
@@ -58,7 +59,7 @@ runs:
5859
- name: Download (attempt 2)
5960
id: second
6061
if: ${{ !cancelled() && (steps.first.outcome == 'failure' || steps.first-check.outcome == 'failure') }}
61-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
62+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
6263
with:
6364
pattern: ${{ inputs.pattern }}
6465
merge-multiple: ${{ inputs.merge-multiple }}

‎.github/actions/upload-artifact/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ runs:
4242
- name: Upload (attempt 1)
4343
id: first
4444
if: ${{ !cancelled() }}
45-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
45+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
4646
continue-on-error: true
4747
with:
4848
name: ${{ inputs.name }}
@@ -61,7 +61,7 @@ runs:
6161
- name: Upload (attempt 2)
6262
id: second
6363
if: ${{ !cancelled() && steps.first.outcome == 'failure' }}
64-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
64+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
6565
continue-on-error: true
6666
with:
6767
name: ${{ inputs.name }}-retry-${{ github.run_attempt }}-2
@@ -82,7 +82,7 @@ runs:
8282
- name: Upload (attempt 3)
8383
id: third
8484
if: ${{ !cancelled() && steps.second.outcome == 'failure' }}
85-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
85+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
8686
with:
8787
name: ${{ inputs.name }}-retry-${{ github.run_attempt }}-3
8888
path: ${{ inputs.path }}

‎.github/workflows/ci.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ jobs:
178178
save-if: ${{ github.ref == 'refs/heads/main' }}
179179

180180
- name: Setup Node.js
181-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
181+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
182182
with:
183183
node-version: '20.20.2'
184184

@@ -810,7 +810,7 @@ jobs:
810810
# binary we mount into the container).
811811

812812
- name: Download base image
813-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
813+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
814814
with:
815815
pattern: docker-base-image*
816816
merge-multiple: true
@@ -909,7 +909,7 @@ jobs:
909909
run: sudo apt-get update && sudo apt-get install -y lcov
910910

911911
- name: Download all coverage artifacts
912-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
912+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
913913
with:
914914
path: coverage-artifacts
915915
pattern: coverage-{host*,docker-*}
@@ -967,7 +967,7 @@ jobs:
967967
persist-credentials: false
968968

969969
- name: Setup Node.js
970-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
970+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
971971
with:
972972
node-version: '20.20.2'
973973

@@ -1402,7 +1402,7 @@ jobs:
14021402
14031403
- name: Setup Node.js
14041404
if: matrix.suite == 'e2e_npm' || matrix.suite == 'e2e_scan' || matrix.suite == 'e2e_safety_pnpm'
1405-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
1405+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
14061406
with:
14071407
node-version: '20.20.2'
14081408

@@ -1417,13 +1417,13 @@ jobs:
14171417

14181418
- name: Setup Node.js 24 (named pnpm legs)
14191419
if: matrix.suite == 'e2e_redirect_pnpm_build'
1420-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
1420+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
14211421
with:
14221422
node-version: '24.x'
14231423

14241424
- name: Setup Python
14251425
if: matrix.suite == 'e2e_pypi' || matrix.uv != '' || matrix.poetry != '' || matrix.pdm != '' || matrix.hatch != ''
1426-
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
1426+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
14271427
with:
14281428
python-version: '3.12.x'
14291429

@@ -1464,7 +1464,7 @@ jobs:
14641464
14651465
- name: Setup uv (Pipenv / pip legs)
14661466
if: matrix.pipenv != '' || matrix.pip != ''
1467-
uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
1467+
uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
14681468

14691469
- name: Install the Pythons the Pipenv / pip legs run on
14701470
if: matrix.pipenv != '' || matrix.pip != ''
@@ -1661,7 +1661,7 @@ jobs:
16611661

16621662
- name: Setup Node.js 24 (vlt legs)
16631663
if: matrix.vlt != ''
1664-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
1664+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
16651665
with:
16661666
node-version: '24.21.0'
16671667

@@ -2151,7 +2151,7 @@ jobs:
21512151
# images and would be flagged by zizmor's cache-poisoning audit.
21522152

21532153
- name: Download base image
2154-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
2154+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
21552155
with:
21562156
pattern: docker-base-image*
21572157
merge-multiple: true
@@ -2230,7 +2230,7 @@ jobs:
22302230
shared-key: dev-ubuntu-latest
22312231
save-if: ${{ github.ref == 'refs/heads/main' }}
22322232
- name: Setup Node.js
2233-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
2233+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
22342234
with:
22352235
node-version: '24.x'
22362236
- name: Manifest-less VEX over every real yarn classic flow
@@ -2620,7 +2620,7 @@ jobs:
26202620

26212621
- name: Setup Node.js
26222622
if: steps.gate.outputs.run == 'true'
2623-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
2623+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
26242624
with:
26252625
# Node 24, NOT the 20.20.2 the other jobs pin. pnpm 10 imports
26262626
# `node:sqlite` for its store index, which does not exist before
@@ -2671,7 +2671,7 @@ jobs:
26712671
26722672
- name: Setup Python + uv
26732673
if: steps.gate.outputs.run == 'true'
2674-
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
2674+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
26752675
with:
26762676
python-version: '3.12.x'
26772677

0 commit comments

Comments
 (0)