CI: pinned actions still target deprecated Node.js 20

Abierto
  • ¿Algo no está bien?
#1,588 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
30/100
Tipo de issue
Refactorización
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
github-actions, yaml
Área
ci-cd, devops

Línea de trabajo

The pinned actions are referenced in the workflow files under .github/workflows, mainly ci.yml and release.yml, plus the vlt, sbt, pnpm, bun, gradle, pdm, npm and poetry compatibility workflows; grep those for the four SHAs in the table. Before changing anything, you need the newest Node 24 release SHA for each action, which requires upstream repo access the issue says is missing. Done means every pin uses a full SHA with a # vX.Y.Z comment, the breaking changes are reviewed, and all compatibility workflows pass on one PR.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

agent:needs-human agent:triaged ci-janitor priority:p3

Problem

Every job that uses these pinned actions logs a warning saying it targets Node.js 20 and is being forced to run on Node.js 24. For example, see nightly job 115703085274 in run 38518420487:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a1…, actions/setup-python@a26af69…

The forced run works today. When GitHub drops Node 20 action support altogether, these legs break at once across the PR, merge_group, nightly and release workflows.

Pin Uses Workflows
actions/download-artifact@d3f86a1… # v4 20 ci.yml, *-compatibility.yml, release.yml
actions/setup-node@49933ea… # v4 15 same set
actions/setup-python@a26af69… # v5 9 same set
actions/upload-artifact@ea165f8… # v4 5 same set

Affected files: ci.yml, release.yml, and the vlt, sbt, pnpm, bun, gradle, pdm, npm and poetry compatibility workflows. One step already uses actions/setup-node@48b55a0… # v6.4.0, so that pin is already trusted in this repo.

Proposed fix

Move each pin to the newest release that runs on Node 24, by full commit SHA with a # vX.Y.Z comment. Review each release's breaking changes before bumping:

  • setup-node v5 and later turn on caching automatically when packageManager is npm.
  • download-artifact v5 and later change the extraction path when downloading by artifact ID.

Do the bump in one PR and run every compatibility workflow on it.

Why the CI janitor didn't open the PR

This routine's GitHub access covers only this repo, so it can't resolve or check the release SHAs of the upstream actions. It won't push unverified pins. Someone with access to the upstream repos, or Dependabot or Renovate, should resolve the SHAs.

Generated by Claude Code

Lenguaje dominante
Rust
Estrellas
9
Forks
2
Merge medio
20 h 47 min
PR fusionados (30 d)
681

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de SocketDev/socket-patch

Todos los issues de SocketDev/socket-patch

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.