ci: move every action off the deprecated Node 20 runtime - #320
Merged
Conversation
GitHub is forcing Node 20 actions onto Node 24 and annotating every run that
uses one. The publish workflow named three, but the same actions are pinned
across ci, test and threatcrush-scan, and two more there — upload-artifact@v4
and github-script@v7 — are on node20 as well, along with codeql-action@v3.
actions/checkout v4 -> v7
actions/setup-node v4 -> v7
pnpm/action-setup v4 -> v6
actions/upload-artifact v4 -> v7
actions/github-script v7 -> v9
codeql-action/upload-sarif v3 -> v4
Every target confirmed `runs.using: node24` before bumping, rather than assumed
from the version number — codeql-action v3 is node20 and v4 is not, which the
deprecation notice does not mention.
Two breaking changes were checked against actual usage rather than skipped:
setup-node v5 added automatic caching driven by the `packageManager` field and
v6 narrowed it to npm. Every caller here passes `cache: pnpm` explicitly, so
the automatic path is never consulted, and pnpm/action-setup already runs first
in all three workflows — which explicit pnpm caching requires.
github-script v9 makes `require('@actions/github')` fail, since that package is
now ESM-only. The one script here requires `fs` and uses the injected `github`
client, neither of which is affected; v9's own README still documents `require`
for builtins and local modules.
Not fixed here: profullstack/coinpaybot@v0 is also node20 and has no newer tag,
so coinpay.yml keeps warning until that action is rebuilt in its own repo.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ThreatCrush Security Scan93 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 43
…and 43 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Kills the Node 20 deprecation annotation that every workflow run has been carrying.
What changed
actions/checkoutactions/setup-nodepnpm/action-setupactions/upload-artifactactions/github-scriptgithub/codeql-action/upload-sarifThe
publishannotation named three actions, but the same pins appear acrossci.yml,test.ymlandthreatcrush-scan.yml, andthreatcrush-scan.ymlcarries two more on node20 plus codeql-action v3. Fixing only the one that shouted would have left the warning everywhere else.Every target was confirmed
runs.using: node24by reading itsaction.ymlrather than inferred from the version number — worth doing, becausecodeql-actionv3 is node20 and v4 is not, and the deprecation notice never mentions it.Breaking changes, checked rather than skipped
setup-nodev5 added automatic caching driven bypackageManager, and v6 narrowed that to npm only. Every caller here passescache: pnpmexplicitly, so the automatic path is never consulted. Explicit pnpm caching also requires pnpm on PATH first, andpnpm/action-setupalready runs beforesetup-nodein all three workflows.github-scriptv9 makesrequire('@actions/github')fail — that package is now ESM-only. The single script inthreatcrush-scan.ymlrequiresfsand uses the injectedgithubclient; neither is affected, and v9's README still documentsrequirefor builtins and local modules.upload-artifactv7 adds an opt-inarchiveparameter;name/path/retention-daysare unchanged.One comment update
publish.ymldocuments an OIDC trap from #305/#309/#311 — setup-node exporting a dummyNODE_AUTH_TOKENthat corrupted.npmrcand stopped npm attempting the token exchange. setup-node v7 removes exactly that (actions/setup-node#1558), so the comment now says so. It doesn't change the token path we're on, but it means trusted publishing deserves a third attempt before npm's 2FA-bypass deprecation forces one.Not fixed here
profullstack/coinpaybot@v0is also node20 and has no newer tag, socoinpay.ymlwill keep warning until that action is rebuilt and re-tagged in its own repo.Verification
Full suite green (1142 passing, 0 failing) and all five workflow files parse. The real proof is this PR's own checks —
ci,testandthreatcrushall run the bumped actions, so a green run here is the annotation being gone.🤖 Generated with Claude Code