Skip to content

chore: bump actions to node 24 runtime#88

Open
adisivaprasad wants to merge 1 commit into
opensource-nepal:mainfrom
adisivaprasad:chore/bump-actions-node24
Open

chore: bump actions to node 24 runtime#88
adisivaprasad wants to merge 1 commit into
opensource-nepal:mainfrom
adisivaprasad:chore/bump-actions-node24

Conversation

@adisivaprasad
Copy link
Copy Markdown

@adisivaprasad adisivaprasad commented May 14, 2026

Summary

GitHub deprecated the Node 20 runtime for actions, so every workflow run currently emits a "Node.js 20 actions are deprecated" warning — including for downstream users of opensource-nepal/commitlint@v1, since action.yml pulls in actions/setup-python@v5.1.0 (Node 20).

This bumps every referenced action to a version running on Node 24:

Action Before After Where
actions/setup-python v5.1.0 v6.2.0 action.yml (user-facing)
actions/setup-python v5 v6 ci.yaml, release-please.yml
actions/checkout v4 v6 all 3 workflows
astral-sh/ruff-action v3 v4 ci.yaml
codecov/codecov-action v3 v6 ci.yaml
googleapis/release-please-action v4.1.3 v5.0.0 release-please.yml
pypa/gh-action-pypi-publish v1.13.0 v1.14.0 release-please.yml (composite — bumped for parity)

After this change, the deprecation warning is eliminated for downstream consumers of opensource-nepal/commitlint@v1 (the user-facing surface) and for the repo's own ci.yaml / commitlint.yaml runs.

Known residual warning (blocked on upstream)

pypa/gh-action-pypi-publish@v1.14.0 is a composite action that internally calls actions/setup-python@v5.6.0 (Node 20). This means the release-please workflow will still emit a Node 20 warning on release runs only — not on PRs or normal CI. v1.14.0 is the latest available release (April 2026) and there's no open PR upstream tracking this; the residual warning will resolve when pypa/gh-action-pypi-publish bumps their internal setup-python reference.

Compatibility notes

  • Runner version: Node 24 actions require GitHub runner ≥ v2.327.1. Hosted runners are already past this.
  • googleapis/release-please-action v4 → v5: manifest-based config is now required; this repo already has release-please-config.json + .release-please-manifest.json, so it should work without further changes. Worth eyeballing the next release-please run.
  • astral-sh/ruff-action v3 → v4: some input names changed, but the CI step here is invoked with no inputs, so no migration needed.
  • codecov/codecov-action v3 → v6: deprecated file/plugin inputs; this repo only passes token, fail_ci_if_error, verbose — all still supported.
  • SHA-pinned actions kept their SHA-pinning style; new SHAs match their tagged versions.

Test plan

  • CI workflow runs green on this PR (checkout v6 + setup-python v6 + ruff v4 + codecov v6)
  • Commitlint workflow passes against this PR's commits
  • No "Node.js 20 actions are deprecated" warning appears in CI / commitlint workflow runs on this PR
  • On next merge to main, release-please workflow runs without error (release-please-action v5, pypi-publish v1.14.0)

GitHub deprecated the Node 20 runtime for actions, emitting a
deprecation warning on every workflow run. This bumps all actions to
versions running on Node 24:

- actions/setup-python v5.1.0 -> v6.2.0 (action.yml, user-facing)
- actions/setup-python v5 -> v6 (CI workflows)
- actions/checkout v4 -> v6
- astral-sh/ruff-action v3 -> v4
- codecov/codecov-action v3 -> v6
- googleapis/release-please-action v4.1.3 -> v5.0.0
- pypa/gh-action-pypi-publish v1.13.0 -> v1.14.0 (composite, bumped for parity)

Node 24 actions require GitHub runner >= v2.327.1, already met by
hosted runners.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant