CI: pinned actions still target deprecated Node.js 20
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 30/100
调研方向
The pinned actions are referenced in the workflow files under .github/workflows, mainly ci.yml and release.yml, plus the vlt, sbt, pnpm, bun, gradle, pdm, npm and poetry compatibility workflows; grep those for the four SHAs in the table. Before changing anything, you need the newest Node 24 release SHA for each action, which requires upstream repo access the issue says is missing. Done means every pin uses a full SHA with a # vX.Y.Z comment, the breaking changes are reviewed, and all compatibility workflows pass on one PR.
由索引模型根据 Issue 内容生成。
描述
Problem
Every job that uses these pinned actions logs a warning saying it targets Node.js 20 and is being forced to run on Node.js 24. For example, see nightly job 115703085274 in run 38518420487:
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a1…, actions/setup-python@a26af69…
The forced run works today. When GitHub drops Node 20 action support altogether, these legs break at once across the PR, merge_group, nightly and release workflows.
| Pin | Uses | Workflows |
|---|---|---|
actions/download-artifact@d3f86a1… # v4 |
20 | ci.yml, *-compatibility.yml, release.yml |
actions/setup-node@49933ea… # v4 |
15 | same set |
actions/setup-python@a26af69… # v5 |
9 | same set |
actions/upload-artifact@ea165f8… # v4 |
5 | same set |
Affected files: ci.yml, release.yml, and the vlt, sbt, pnpm, bun, gradle, pdm, npm and poetry compatibility workflows. One step already uses actions/setup-node@48b55a0… # v6.4.0, so that pin is already trusted in this repo.
Proposed fix
Move each pin to the newest release that runs on Node 24, by full commit SHA with a # vX.Y.Z comment. Review each release's breaking changes before bumping:
- setup-node v5 and later turn on caching automatically when
packageManageris npm. - download-artifact v5 and later change the extraction path when downloading by artifact ID.
Do the bump in one PR and run every compatibility workflow on it.
Why the CI janitor didn't open the PR
This routine's GitHub access covers only this repo, so it can't resolve or check the release SHAs of the upstream actions. It won't push unverified pins. Someone with access to the upstream repos, or Dependabot or Renovate, should resolve the SHAs.
Generated by Claude Code
- 主要语言
- Rust
- 星标
- 9
- 派生
- 2
- 平均合并
- 20 小时 47 分钟
- 30 天内合并 PR
- 681
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
SocketDev/socket-patch 的其他 Issue
-
agent:triaged arch-audit priority:p3 refactor
难度 2/5 1-3 小时 新手友好度 83/100
SocketDev/socket-patch#1860 ·
维护者通常 1 天内回复
-
agent:triaged arch-audit priority:p3 refactor
难度 2/5 1-3 小时 新手友好度 78/100
SocketDev/socket-patch#1838 ·
维护者通常 1 天内回复
-
arch-audit refactor
难度 4/5 3-5 天 新手友好度 54/100
SocketDev/socket-patch#1993 ·
维护者通常 1 天内回复
-
arch-audit refactor
难度 3/5 1-2 天 新手友好度 66/100
SocketDev/socket-patch#1992 ·
维护者通常 1 天内回复
-
agent:triaged arch-audit priority:p3 refactor
难度 4/5 3-5 天 新手友好度 35/100
SocketDev/socket-patch#1987 · 1 条评论 ·
维护者通常 1 天内回复
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
A-linter
难度 2/5 1-3 小时 新手友好度 73/100
oxc-project/oxc#28783 ·
维护者通常 1 天内回复
-
Substrait consumer doesn't recognise `shift_left` / `shift_right` from functions_arithmetic.yaml未关闭bug
难度 2/5 1-3 小时 新手友好度 76/100
apache/datafusion#27059 ·
维护者通常 1 天内回复
-
Bump calamine to 0.38: RUSTSEC-2026-0436 (CFB/OLE2 panic and unbounded allocation) fails cargo audit未关闭
难度 2/5 1-3 小时 新手友好度 70/100
docling-project/docling.rs#979 ·
维护者通常 1 天内回复
-
llm translation
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复