CI: pinned actions still target deprecated Node.js 20

Ouverte
  • Quelque chose ne va pas ?
#1,588 3 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
30/100
Type d'issue
Refactorisation
Clarté
Plutôt claire
Activité
Active
Stack technique
github-actions, yaml
Domaine
ci-cd, devops

Piste de recherche

The pinned actions are referenced in the workflow files under .github/workflows, mainly ci.yml and release.yml, plus the vlt, sbt, pnpm, bun, gradle, pdm, npm and poetry compatibility workflows; grep those for the four SHAs in the table. Before changing anything, you need the newest Node 24 release SHA for each action, which requires upstream repo access the issue says is missing. Done means every pin uses a full SHA with a # vX.Y.Z comment, the breaking changes are reviewed, and all compatibility workflows pass on one PR.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

agent:needs-human agent:triaged ci-janitor priority:p3

Problem

Every job that uses these pinned actions logs a warning saying it targets Node.js 20 and is being forced to run on Node.js 24. For example, see nightly job 115703085274 in run 38518420487:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a1…, actions/setup-python@a26af69…

The forced run works today. When GitHub drops Node 20 action support altogether, these legs break at once across the PR, merge_group, nightly and release workflows.

Pin Uses Workflows
actions/download-artifact@d3f86a1… # v4 20 ci.yml, *-compatibility.yml, release.yml
actions/setup-node@49933ea… # v4 15 same set
actions/setup-python@a26af69… # v5 9 same set
actions/upload-artifact@ea165f8… # v4 5 same set

Affected files: ci.yml, release.yml, and the vlt, sbt, pnpm, bun, gradle, pdm, npm and poetry compatibility workflows. One step already uses actions/setup-node@48b55a0… # v6.4.0, so that pin is already trusted in this repo.

Proposed fix

Move each pin to the newest release that runs on Node 24, by full commit SHA with a # vX.Y.Z comment. Review each release's breaking changes before bumping:

  • setup-node v5 and later turn on caching automatically when packageManager is npm.
  • download-artifact v5 and later change the extraction path when downloading by artifact ID.

Do the bump in one PR and run every compatibility workflow on it.

Why the CI janitor didn't open the PR

This routine's GitHub access covers only this repo, so it can't resolve or check the release SHAs of the upstream actions. It won't push unverified pins. Someone with access to the upstream repos, or Dependabot or Renovate, should resolve the SHAs.

Generated by Claude Code

Langage dominant
Rust
Étoiles
9
Forks
2
Merge moyen
20 h 47 min
PR mergées (30 j)
681

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de SocketDev/socket-patch

Toutes les issues de SocketDev/socket-patch

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.