ci: bring every action up to a node 24 runtime - #89
Merged
Conversation
The runners now warn on all of them: Node 20 is deprecated and every action here was being force-run on Node 24 already. That forcing is a grace period, not a fix, and the pins had drifted several majors behind besides — checkout was on v4 against v7, download-artifact on v4 against v8. Each major was read rather than assumed, since a release pipeline is a poor place to discover a changed output name: - checkout v5-v7 are node24, credential handling and a fork-checkout block for pull_request_target and workflow_run, which this workflow does not use. - setup-node v5 added automatic caching keyed off `packageManager`, and v6 narrowed it to npm. Both are moot here: `cache: pnpm` is set explicitly. - download-artifact v5 changed the output path for single downloads *by id*; the merge job downloads by pattern. v8 now errors on a digest mismatch instead of warning, which is the behaviour worth having. `pattern` and `merge-multiple` both still exist. - upload-artifact v7 added unzipped single-file uploads behind `archive`, which defaults to the old behaviour. - The docker actions are node24 and ESM. build-push-action still exports `digest` and metadata-action still exports `tags`, `labels` and `json` — the three this workflow reads. setup-buildx-action dropped deprecated inputs; none are passed here. - release-please-action v5 is node24 and nothing else; the config and the `release_created` and `tag_name` outputs are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every run currently warns that Node 20 is deprecated and that the actions are
being force-run on Node 24. That forcing is a grace period, not a fix — and the
pins had drifted badly besides.
actions/checkoutactions/setup-nodeactions/upload-artifactactions/download-artifactpnpm/action-setupdocker/build-push-actiondocker/login-actiondocker/metadata-actiondocker/setup-buildx-actiongoogleapis/release-please-actionBreaking changes, checked rather than assumed
Ten majors at once through a release pipeline is a good way to discover a
renamed output the hard way, so each one was read:
that applies to
pull_request_target/workflow_run. This workflow usesneither.
packageManager;v6 narrowed it to npm only. Both moot —
cache: pnpmis set explicitly.ID; the merge job downloads by
pattern. v8 now errors on a digestmismatch rather than warning, which is the behaviour worth having. Confirmed
patternandmerge-multiplestill exist in v8'saction.yml.archiveinput, which defaults to the previous behaviour.action.ymlthat
build-push-actionstill exportsdigest, andmetadata-actionstillexports
tags,labelsandjson— the three this workflow reads.setup-buildx-action@v4dropped deprecated inputs; none are passed here.Config handling and the
release_created/tag_nameoutputs — which gatethe semver image tags — are unchanged.
What this PR cannot prove
release,publishandmergearepush-only, so this PR exercisescheckout,setup-nodeandpnpm/action-setupin Lint/Web/Commitlint andsetup-buildx-action+build-push-actionin the Docker gate — but notrelease-please, the artifact round-trip, or the manifest merge. Those first run
on merge to
main.The merge job asserts both architectures are on the published manifest and
fails if not, so a broken artifact hand-off surfaces as a red run rather than a
single-arch
latest.