chore(actions): bump Node 20 actions to Node 24 before the Sep 16 runner removal - #282
Merged
Merged
Conversation
GitHub removes the Node 20 Actions runtime on 2026-09-16. Every pinned action was checked against its own action.yml `runs.using` rather than a version table; these 18 references were the ones still declaring node20: actions/checkout@v4 -> v5 (7) actions/setup-node@v4 -> v5 (3) actions/setup-python@v4/@v5 -> v6 (3, one in the root action.yml) actions/github-script@v7 -> v8 (1) actions/stale@v9 -> v10 (1) dependabot/fetch-metadata@v2 -> v3 (1) softprops/action-gh-release@v2 -> v3 (1) Every one of these majors is a runtime bump only. The single behavioural change is setup-node v5 enabling package-manager caching by default; deploy-landing.yml sets `cache: npm` explicitly, which still wins. The root action.yml matters beyond CI: it is the composite action external repos consume via @main, so its node20 step would have broken consumers too, not just this pipeline. Already on Node 24 and left alone: checkout@v5, setup-python@v6, upload-artifact@v6, download-artifact@v7, github-script@v8, cache@v5, labeler@v6, gitleaks-action@v3, codecov-action@v5 (composite). Refs #235 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Aa8jYF37KPZRRD1tWyePeo
Contributor
📊 Code Complexity AnalysisSummary:
|
| File | Function | Complexity | Line |
|---|---|---|---|
core/risk_scorer.py |
score_pull_request |
35 | 141 |
autopilot/autopilot.py |
generate_summary |
24 | 195 |
autopilot/staleness_engine.py |
process_stale_prs |
16 | 281 |
autopilot/ai_optimization/performance_monitor.py |
get_benchmark_stats |
15 | 184 |
.github/scripts/batch_scan_dependabot.py |
main |
15 | 64 |
.github/scripts/weekly_digest.py |
build_blocks |
15 | 38 |
autopilot/recommendation_contract.py |
validate |
14 | 54 |
.github/scripts/workflow_monitor.py |
get_workflow_statistics |
14 | 216 |
.github/scripts/metrics_collector.py |
parse_workflow_metrics |
14 | 148 |
.github/scripts/setup_branch_protection.py |
main |
14 | 240 |
... and 19 more
Recommendations:
- Break down large functions into smaller, focused units
- Extract complex conditional logic into separate functions
- Use early returns to reduce nesting
🔧 Low Maintainability Files
These files have low maintainability scores and may need refactoring:
| File | Score | Status |
|---|---|---|
.github/scripts/health_dashboard_generator.py |
28.14 | 🔴 |
.github/scripts/workflow_monitor.py |
33.73 | 🔴 |
.github/scripts/ai_code_suggestor.py |
33.76 | 🔴 |
.github/scripts/ai_workflow_optimizer.py |
35.51 | 🔴 |
.github/scripts/performance_benchmark.py |
39.46 | 🔴 |
.github/scripts/self_healing_system.py |
40.27 | 🔴 |
.github/scripts/threshold_monitor.py |
41.13 | 🔴 |
.github/scripts/parallel_code_analyzer_optimized.py |
41.16 | 🔴 |
autopilot/tests/test_recommendation_contract.py |
42.05 | 🔴 |
autopilot/autopilot.py |
42.45 | 🔴 |
autopilot/ai_optimization/anomaly_detector.py |
42.56 | 🔴 |
.github/scripts/refactoring_assistant.py |
43.03 | 🔴 |
autopilot/ai_optimization/intelligent_cache.py |
43.28 | 🔴 |
autopilot/ai_optimization/commit_summarizer.py |
44.05 | 🔴 |
.github/scripts/async_parallel_analyzer.py |
44.47 | 🔴 |
autopilot/ai_optimization/performance_monitor.py |
44.69 | 🔴 |
.github/scripts/badge_generator.py |
45.28 | 🔴 |
.github/scripts/copilot_integration.py |
45.37 | 🔴 |
.github/scripts/distributed_monitoring.py |
45.53 | 🔴 |
autopilot/dependency_graph.py |
45.65 | 🔴 |
.github/scripts/elite_copilot.py |
45.69 | 🔴 |
.github/scripts/issue_auto_creator.py |
46.39 | 🔴 |
.github/scripts/cost_calculator.py |
46.4 | 🔴 |
.github/scripts/inline_pr_commenter.py |
46.63 | 🔴 |
.github/scripts/complexity_reporter.py |
46.78 | 🔴 |
.github/scripts/pr_triage.py |
47.13 | 🔴 |
core/risk_scorer.py |
48.15 | 🔴 |
autopilot/ai_optimization/nlp_relevance_filter.py |
48.43 | 🔴 |
.github/scripts/pr_inline_commenter.py |
48.47 | 🔴 |
.github/scripts/dependency_audit.py |
48.7 | 🔴 |
autopilot/staleness_engine.py |
48.73 | 🔴 |
.github/scripts/metrics_collector.py |
48.91 | 🔴 |
.github/scripts/dependency_updater.py |
48.91 | 🔴 |
autopilot/ai_optimization/ml_priority_scorer.py |
49.53 | 🔴 |
.github/scripts/parallel_code_analyzer.py |
49.96 | 🔴 |
autopilot/ai_optimization/api_optimizer.py |
50.46 | 🟡 |
.github/scripts/workflow_optimizer.py |
51.67 | 🟡 |
.github/scripts/cot_selector.py |
51.73 | 🟡 |
.github/scripts/release_manager.py |
51.92 | 🟡 |
.github/scripts/check_quality.py |
52.33 | 🟡 |
.github/scripts/auto_pr.py |
52.72 | 🟡 |
.github/scripts/changelog_generator.py |
53.13 | 🟡 |
.github/scripts/notification_manager.py |
53.58 | 🟡 |
.github/scripts/prometheus_exporter.py |
54.96 | 🟡 |
.github/scripts/weekly_digest.py |
55.02 | 🟡 |
.github/scripts/llm_router.py |
55.19 | 🟡 |
core/audit_logger.py |
55.6 | 🟡 |
.github/scripts/gather_context.py |
56.0 | 🟡 |
.github/scripts/batch_scan_dependabot.py |
56.3 | 🟡 |
core/llm_provider.py |
56.32 | 🟡 |
.github/scripts/streaming_results.py |
56.64 | 🟡 |
.github/scripts/setup_branch_protection.py |
57.0 | 🟡 |
.github/scripts/optimized_github_client.py |
58.27 | 🟡 |
agents/orchestrator_agent.py |
59.02 | 🟡 |
core/incident_freeze.py |
59.67 | 🟡 |
core/github_client.py |
61.96 | 🟡 |
core/message_queue.py |
63.22 | 🟡 |
core/agent_config.py |
63.82 | 🟡 |
autopilot/decisions/ledger.py |
63.92 | 🟡 |
core/idempotency.py |
64.45 | 🟡 |
Maintainability Index Guide:
- 🟢 85-100: Excellent maintainability
- 🟡 65-84: Good maintainability
- 🟠 50-64: Moderate maintainability (consider refactoring)
- 🔴 0-49: Poor maintainability (needs refactoring)
Contributor
🟡 Risk Assessment: MEDIUM (5.5/10)Analysed 9 files, 18+ / 18− lines. Security-sensitive paths detected. Test coverage unchanged or improved. Scoring breakdown
|
Contributor
🤖 Elite AI Copilot AnalysisElite AI Copilot Analysis ReportGenerated: 2026-09-03 06:29:09 🎯 Health Score: 100.0/100🚀 Top Recommendations
📊 Detailed InsightsCode Quality Baseline Established
Security Scan Initiated
Repository Structure Analyzed
Performance Baseline Captured
Documentation Structure Good
Powered by Elite AI Copilot v1.0 |
Contributor
🔍 Pre-commit Checks✅ All pre-commit checks passed! Your code follows the project style guidelines. Pre-commit hooks help maintain code quality and consistency. |
Contributor
Code Quality Analysis ❌ FAILEDDuration: 0.02s Tool Results
View detailed results{
"timestamp": "2026-09-03 06:29:17",
"elapsed_seconds": 0.02,
"summary": {
"total_issues": 10,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0
},
"tools": {
"pylint": {
"status": "failed",
"output": "",
"errors": "Pylint error: [Errno 2] No such file or directory: 'pylint'"
},
"flake8": {
"status": "failed",
"output": "",
"errors": "Flake8 error: [Errno 2] No such file or directory: 'flake8'"
},
"bandit": {
"status": "failed",
"output": "",
"errors": "Bandit error: [Errno 2] No such file or directory: 'bandit'"
},
"radon_cc": {
"status": "failed",
"output": "",
"errors": "Radon error: [Errno 2] No such file or directory: 'radon'"
},
"radon_mi": {
"status": "failed",
"output": "",
"errors": "Radon MI error: [Errno 2] No such file or directory: 'radon'"
}
},
"passed": false
} |
Contributor
🔒 Security Scan Results🛡️ Bandit Security Scan
📦 Dependency Vulnerabilities
Vulnerable Dependencies:
Security scans run automatically on every PR. View detailed reports in the Actions tab. |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The changes consistently update pinned GitHub Actions to Node 24-compatible majors without introducing workflow/YAML issues in the modified files.
Pull request overview
Updates this repository’s GitHub Actions dependencies to versions that run on the Node 24 Actions runtime ahead of the 2026-09-16 deprecation of Node 20 on GitHub-hosted runners, including the repo-root composite action.yml consumed by downstream repositories.
Changes:
- Bumped
actions/checkoutusages fromv4→v5across relevant workflows. - Bumped
actions/setup-nodefromv4→v5,actions/setup-pythonfromv4/v5→v6, andactions/github-scriptfromv7→v8where used. - Bumped other Node20-based actions (
actions/stale→v10,dependabot/fetch-metadata→v3,softprops/action-gh-release→v3) to Node24-capable majors.
File summaries
| File | Description |
|---|---|
action.yml |
Updates actions/setup-python to v6 so the published composite action doesn’t depend on Node 20. |
.github/workflows/stale-pr-handler.yml |
Bumps actions/stale to v10 for Node 24 runtime compatibility. |
.github/workflows/set-vercel-env.yml |
Bumps actions/checkout to v5 to avoid Node 20 runtime usage. |
.github/workflows/release-and-publish.yml |
Bumps softprops/action-gh-release to v3 for Node 24 runtime compatibility. |
.github/workflows/deploy-landing.yml |
Bumps checkout to v5, setup-node to v5, and github-script to v8 to remove Node 20 action runtime dependencies. |
.github/workflows/dependabot-automerge.yml |
Bumps dependabot/fetch-metadata to v3 and setup-python to v6 for Node 24 runtime compatibility. |
.github/workflows/daily-summary.yml |
Bumps checkout to v5 and setup-python to v6 to remove Node 20 action runtime dependencies. |
.github/workflows/changelog.yml |
Bumps checkout to v5 and setup-python to v6 for Node 24 runtime compatibility. |
.github/workflows/auto-pr.yml |
Bumps checkout to v5 and setup-python to v6 for Node 24 runtime compatibility. |
Review details
- Files reviewed: 9/9 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Owner
Author
🤖 DRC Agent AnalysisRecommendation: 🔴 P0 CRITICAL Summary: Dependabot Actions Ecosystem Auto-Management (Solution 3) with Manual Seed Bump (Solution 1) as immediate prerequisite Next steps:
Strategic fit: Consulting: medium · Product: low · Tech debt: reduces Analysed by GadgetLab DRC Agent (Dreamer → Realist → Critic) · Run |
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub removes the Node 20 Actions runtime on 2026-09-16. Closes the actionable half of #235.
Each pinned action was classified by reading its own
action.ymlruns.using, not by version recall. 18 references still declarednode20:actions/checkout@v4actions/setup-node@v4actions/setup-python@v4/@v5actions/github-script@v7actions/stale@v9dependabot/fetch-metadata@v2softprops/action-gh-release@v2One of those lives in the repo-root
action.yml, the composite action external repos consume via@main. Its Node 20 step would have broken downstream consumers on the 16th, not just this pipeline.Breaking-change review
Every major crossed here is a runtime bump only, per each project's release notes. The one behavioural change is
setup-nodev5 enabling package-manager caching by default;deploy-landing.ymlsetscache: npmwith an explicitcache-dependency-path, which still takes precedence.Already on Node 24, left alone
checkout@v5,setup-python@v6,upload-artifact@v6,download-artifact@v7,github-script@v8,cache@v5,labeler@v6,gitleaks-action@v3, andcodecov-action@v5(composite, no JS runtime).Verification
Dispatched
stale-pr-handler.ymlon this branch withdry_run=true, which wiresdebug-onlyonactions/stale@v10, so the bumped action really executes with no comments posted or PRs closed. The PR checks below exercisecheckout@v5andsetup-node@v5indeploy-landing.Out of scope
deploy-landing.ymlstill pinsnode-version: "20"for the application runtime. That is the app's Node, not the Actions runtime, and the September 16 removal does not touch it.🤖 Generated with Claude Code
https://claude.ai/code/session_01Aa8jYF37KPZRRD1tWyePeo