Skip to content

Migrate to node24, resolve all Dependabot alerts, point repo at new home - #19

Merged
BrandonLWhite merged 6 commits into
mainfrom
chore/dependency-updates-and-node24
Aug 13, 2026
Merged

Migrate to node24, resolve all Dependabot alerts, point repo at new home#19
BrandonLWhite merged 6 commits into
mainfrom
chore/dependency-updates-and-node24

Conversation

@BrandonLWhite

@BrandonLWhite BrandonLWhite commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Consolidates all 17 open Dependabot PRs and all open Dependabot security alerts into one PR, migrates the action off the deprecated node20 runtime, and points repo metadata at its new home under python-build-tools.

Security / dependency updates

  • npm audit: 22 → 0 vulnerabilities.
  • Bumped @actions/core → ^2.0.3, @actions/cache → ^5.2.0, @actions/exec → ^2.0.0, @eslint/compat → ^2.1.0, plus transitive bumps (js-yaml, @babel/core, etc.) picked up via npm update.
  • Removed @actions/github — it was require()'d in src/main.js but never actually used (dead since the original template scaffold; confirmed via grep and full test coverage). This alone eliminated the entire undici/octokit/@actions/http-client vulnerable subtree that Dependabot's own PR Bump @actions/github from 6.0.1 to 9.1.1 #3 would have required a breaking major bump to fix.
  • Removed prettier-eslint — also unused (the actually-used package is the different eslint-plugin-prettier). Removing it resolved the @typescript-eslint/minimatch alerts without the major bump Dependabot PR Bump prettier-eslint from 16.4.2 to 17.1.1 #4 proposed.
  • Deliberately capped @actions/core/@actions/cache/@actions/exec below the versions Dependabot and npm audit fix --force both wanted (3.x/6.x/3.x): those majors made the packages ESM-only, which breaks this repo's CommonJS require()-based src/. Went with the latest CommonJS-compatible major of each instead — confirmed via each package's RELEASES.md and by re-running the full test suite.
  • Bumped actions/setup-node (v5→v7), actions/setup-python (v6→v7), github/codeql-action (v3→v4), actions/deploy-pages (v4→v5), actions/configure-pages (v5→v6) per the matching Dependabot PRs. Checked each release's changelog for breaking changes relevant to our usage (e.g. setup-python v7 dropped the pip-install input, which we don't use) — none apply.

This PR supersedes Dependabot PRs #1–#18 and should resolve the corresponding alerts on the Security tab once merged.

node20 → node24 migration

GitHub is deprecating Node 20 on Actions runners: forced to Node 24 by default June 2026, removed entirely September 16, 2026. Updated action.yml (runs.using: node24) and package.json (engines.node: >=24) ahead of that.

Repo home

Updated homepage/repository/bugs URLs in package.json, plus the badges and usage example in README.md, from BrandonLWhite/pipx-install-action to python-build-tools/pipx-install-action.

Agent instructions

Added AGENTS.md + .agents/INSTRUCTIONS.md documenting repo-specific gotchas for future AI-assisted changes, most importantly: dist/ is generated and must be rebuilt via npm run all before every commit, or check-dist.yml CI fails — this is the actual reason Dependabot's own PRs here don't pass CI. Also documents the ESM-only trap above so it doesn't get re-introduced by a future automated dependency bump.

Test plan

  • npm run all (format, lint, jest with 100% statement coverage, ncc package build) passes clean
  • npm audit reports 0 vulnerabilities
  • dist/index.js and badges/coverage.svg regenerated and committed (satisfies check-dist.yml)
  • CI (ci.yml end-to-end action smoke test on ubuntu/windows) — will run on this PR

🤖 Generated with Claude Code

BrandonLWhite and others added 6 commits August 12, 2026 17:54
@BrandonLWhite @claude
Migrate to node24, resolve all Dependabot alerts, point repo at new home
4ad1d1e 
- action.yml: runs.using node20 -> node24, ahead of GitHub's forced
  migration (node20 removed from runners 2026-09-16).
- Bump @actions/core (^2.0.3), @actions/cache (^5.2.0), and @actions/exec
  (^2.0.0) -- the latest majors that stay CommonJS-compatible. Their next
  majors (3.x/6.x/3.x) went ESM-only, which npm audit fix --force and
  Dependabot's own PRs don't account for and would have broken require()
  at runtime.
- Remove the unused @actions/github import (dead since the original
  template scaffold) and the unused prettier-eslint devDependency; both
  only existed to accumulate Dependabot security alerts (undici,
  @typescript-eslint, minimatch, etc.) with no runtime benefit.
- npm audit: 22 -> 0 vulnerabilities.
- Bump actions/setup-node, actions/setup-python, github/codeql-action,
  actions/deploy-pages, and actions/configure-pages per the open
  Dependabot PRs; verified no breaking changes affect our usage.
- Point package.json and README URLs at the new
  python-build-tools/pipx-install-action home.
- Add AGENTS.md / .agents/INSTRUCTIONS.md documenting repo-specific
  agent gotchas, especially: dist/ is generated and must be rebuilt via
  `npm run all` before every commit, or check-dist.yml CI fails (the
  most common reason Dependabot's own PRs don't pass here).
- Regenerate dist/ and badges/coverage.svg via `npm run all`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@BrandonLWhite @claude
Fix CI failures: linter terminology/markdown errors, missing pipx on …
a949fa5 
…Windows

- Fix markdownlint (MD040 fenced code language, MD029 ordered-list style)
  and textlint terminology ("repo" -> "repository", "CLI tools" ->
  "command-line tools") errors in AGENTS.md / .agents/INSTRUCTIONS.md that
  super-linter flagged.
- ci.yml: install pipx explicitly on the windows-latest job via `pip install
  pipx` after actions/setup-python. Confirmed this failure ("Unable to
  locate executable file: pipx") is pre-existing and unrelated to this
  branch's changes -- it reproduces identically on unrelated Dependabot
  branches (e.g. the js-yaml-only bump), so the windows-latest runner image
  apparently no longer ships pipx preinstalled.

Note: CodeQL Analyze also fails repo-wide (including on Dependabot's own
branches) with "CodeQL analyses from advanced configurations cannot be
processed when the default setup is enabled" -- the repo's code-scanning
default-setup is "configured", conflicting with the checked-in advanced
codeql-analysis.yml. Fixing that requires a repo settings change
(PATCH /repos/.../code-scanning/default-setup), which my environment's
permission classifier blocked as a sensitive action outside version-controlled
files. Flagged for the repo owner to action directly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@BrandonLWhite @claude
Remove advanced CodeQL workflow in favor of default setup
ab68b51 
The advanced-setup codeql-analysis.yml only analyzed the javascript
language and conflicted with the repo's code-scanning default setup,
which GitHub already runs for javascript, javascript-typescript,
typescript, and actions -- more language coverage than the custom
workflow provided, and it fails on every branch (including Dependabot's
own PRs) with "CodeQL analyses from advanced configurations cannot be
processed when the default setup is enabled".

The one thing the custom workflow's config file added -- excluding
dist/ and node_modules from analysis via paths-ignore -- is now
achievable on default setup itself via the github-codeql-config-file
repository property (GitHub, 2026-08-04), so there's nothing left the
advanced workflow uniquely provided. Kept .github/codeql/codeql-config.yml
for that property to point at, and updated .agents/INSTRUCTIONS.md
accordingly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@BrandonLWhite @claude
Trigger CodeQL default-setup rescan
332ce7d 
Empty commit to force a fresh default-setup scan now that the
github-codeql-config-file repository property points at
.github/codeql/codeql-config.yml, so dist/ and node_modules are
excluded and the js/incomplete-sanitization alert in bundled
@iarna/toml code should stop appearing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@BrandonLWhite @claude
Correct the record on why windows-latest needs pipx installed explicitly
4f71d52 
An earlier commit message claimed "the windows-latest runner image
apparently no longer ships pipx preinstalled" -- that's wrong. Per
actions/runner-images, pipx IS preinstalled on windows-latest (and
ubuntu-latest), but only against the image's cached default Python
patch version. ci.yml pins an exact patch (3.12.3) for parity with
ubuntu-latest; since that doesn't match what's cached, setup-python
deletes the cached interpreter and downloads a fresh one with no pipx
registered against it. Documented the real cause in a workflow comment
and as a pitfall in .agents/INSTRUCTIONS.md so this doesn't get
misdiagnosed again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@BrandonLWhite @claude
Remove obsolete Python version pin from windows-latest CI job
cc577d0 
The exact python-version pin was added in PR BrandonLWhite#64 (2025-07-05) to
reproduce a cross-platform GitHub Actions cache-key collision: the
cache key hash didn't include OS/image info, so a venv cached on
ubuntu-latest could be incorrectly restored on windows-latest whenever
the pipx/python version strings happened to match. That same commit
fixed it by adding imageVersion/imageOs to systemHashInput in
pipx-install.js, and __tests__/pipx-install.test.js directly covers it
with distinct ImageOS values. The E2E job's version-matching was never
load-bearing for that regression once the real fix landed.

The pin also assumed ubuntu-latest and windows-latest share one
default Python version -- they don't (3.12.3 vs 3.12.10 today, and
each drifts independently) -- which is what caused setup-python to
evict the windows image's cached interpreter (and its preinstalled
pipx) in favor of a freshly downloaded one lacking pipx, requiring the
manual pipx install workaround from the previous commit.

Removing the setup-python step entirely (mirroring ubuntu-latest,
which never called it) removes the pin, removes the now-unnecessary
workaround, and relies on each image's own preinstalled pipx directly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@BrandonLWhite
BrandonLWhite merged commit e37f156 into main Aug 13, 2026
21 checks passed
@BrandonLWhite
BrandonLWhite deleted the chore/dependency-updates-and-node24 branch August 13, 2026 16:39
@BrandonLWhite BrandonLWhite mentioned this pull request Aug 13, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@BrandonLWhite