ci: move actions off the deprecated Node 20 runtime - #138
Merged
Conversation
GitHub is forcing Node 20 actions onto Node 24 and will eventually drop the shim, so the 0.3.1 release run carried a deprecation annotation. Bump each action to the earliest version that declares runs.using: node24: - actions/upload-artifact v5.0.0 -> v6.0.0 - actions/download-artifact v6.0.0 -> v7.0.0 - actions/github-script v7 (unpinned) -> v8.0.0 - actions/checkout v4 (unpinned) -> v6.0.3 These are runtime-only bumps. The next majors (upload-artifact v7, download-artifact v8, github-script v9) add real behaviour changes, including ESM, direct uploads, and digest mismatches failing instead of warning. None of that is needed to clear the deprecation, so it is left for a separate change. Also repoint three actions/checkout uses off SHA 9f698171. That commit is not reachable from any ref in actions/checkout: the REST and raw endpoints return 404, and only codeload resolves it, so Dependabot cannot track it and it cannot be reviewed upstream. Its dist/index.js is byte-identical to v6.0.3, so this is a hygiene fix rather than a behaviour change, and it makes every checkout in the repo use the same verified SHA. Every remaining pin was checked to resolve to a reachable commit, to match the version in its trailing comment, and to declare node24. pypa/gh-action-pypi-publish is a Docker action and has no Node runtime.
Aliaksei-Kharlap
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The 0.3.1 release run carried this annotation:
Auditing every action in the repo turned up four on Node 20, not one. Each is bumped to the earliest version that declares
runs.using: node24:actions/upload-artifactb7c566aactions/download-artifact37930b1actions/github-scripted59741actions/checkoutdf4cb1cWhy the earliest Node 24 version, not the latest
These are runtime-only bumps with no API changes. The next majors carry real behaviour changes that aren't needed to clear the deprecation:
nameis ignored.Content-Type.require('@actions/github')stops working;getOctokitbecomes an injected parameter.The github-script v9 breaks don't actually affect the one script here, which only calls
github.rest.repos.createCommitComment. It's held back for consistency with the others rather than out of necessity. Adopting the newer majors is a reasonable follow-up, just not mixed into a deprecation fix — especially with download-artifact v8 turning digest mismatches into hard failures.Unreachable checkout SHA
Three
actions/checkoutuses pinned SHA9f698171…, commented# v6.0.3. That commit is not reachable from any ref in actions/checkout:Only codeload resolves it, which is why the runner fetches it fine while every audit path fails. Practical consequences: Dependabot and Renovate can't track it, and it can't be reviewed upstream.
It is not malicious. Its
dist/index.jsis byte-identical to the real v6.0.3 (df4cb1c), verified by SHA-256 against v5.0.0, v5.0.1, v5.1.0, and v6.0.3. (Thepackage.jsoninside reads5.0.0, but so does real v6.0.3 — upstream doesn't bump it.) It was also already Node 24, so it was never part of the deprecation.Repointed to
df4cb1cso every checkout in the repo uses the same verified, reachable SHA.Verification
Each resulting pin was checked to resolve to a reachable commit, to match the version in its trailing comment, and to declare
node24:No unpinned actions remain.
pypa/gh-action-pypi-publishis a Docker action with no Node runtime, so it is unaffected. All five workflow files parse.The upload/download pairing matters for the release workflow, which uploads dists and notes in
buildand downloads them in two later jobs. upload-artifact v6 and download-artifact v7 are the matched Node 24 releases on the same v4 artifact backend.Not verified here: these run for real only on the next tag push or registry publish. The changes are pure SHA swaps, so the risk is low, but nothing in this PR exercises the artifact round-trip end to end.
🤖 Generated with Claude Code