CI: pinned actions still target deprecated Node.js 20

Offen
  • Stimmt etwas nicht?
#1,588 3 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
30/100
Issue-Typ
Refactoring
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
github-actions, yaml
Bereich
ci-cd, devops

Rechercherichtung

The pinned actions are referenced in the workflow files under .github/workflows, mainly ci.yml and release.yml, plus the vlt, sbt, pnpm, bun, gradle, pdm, npm and poetry compatibility workflows; grep those for the four SHAs in the table. Before changing anything, you need the newest Node 24 release SHA for each action, which requires upstream repo access the issue says is missing. Done means every pin uses a full SHA with a # vX.Y.Z comment, the breaking changes are reviewed, and all compatibility workflows pass on one PR.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

agent:needs-human agent:triaged ci-janitor priority:p3

Problem

Every job that uses these pinned actions logs a warning saying it targets Node.js 20 and is being forced to run on Node.js 24. For example, see nightly job 115703085274 in run 38518420487:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a1…, actions/setup-python@a26af69…

The forced run works today. When GitHub drops Node 20 action support altogether, these legs break at once across the PR, merge_group, nightly and release workflows.

Pin Uses Workflows
actions/download-artifact@d3f86a1… # v4 20 ci.yml, *-compatibility.yml, release.yml
actions/setup-node@49933ea… # v4 15 same set
actions/setup-python@a26af69… # v5 9 same set
actions/upload-artifact@ea165f8… # v4 5 same set

Affected files: ci.yml, release.yml, and the vlt, sbt, pnpm, bun, gradle, pdm, npm and poetry compatibility workflows. One step already uses actions/setup-node@48b55a0… # v6.4.0, so that pin is already trusted in this repo.

Proposed fix

Move each pin to the newest release that runs on Node 24, by full commit SHA with a # vX.Y.Z comment. Review each release's breaking changes before bumping:

  • setup-node v5 and later turn on caching automatically when packageManager is npm.
  • download-artifact v5 and later change the extraction path when downloading by artifact ID.

Do the bump in one PR and run every compatibility workflow on it.

Why the CI janitor didn't open the PR

This routine's GitHub access covers only this repo, so it can't resolve or check the release SHAs of the upstream actions. It won't push unverified pins. Someone with access to the upstream repos, or Dependabot or Renovate, should resolve the SHAs.

Generated by Claude Code

Vorherrschende Sprache
Rust
Sterne
9
Forks
2
Ø Merge
20 Std. 47 Min.
Gemergte PRs (30 T.)
681

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus SocketDev/socket-patch

Alle Issues in SocketDev/socket-patch

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.