Upgrade GitHub Actions to Node.js 24 compatibility#255
Merged
Conversation
WalkthroughCI workflows update GitHub Actions major versions ( ChangesGitHub Actions Upgrades
Release and version bump
🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/cli_version.yml (1)
38-38: 💤 Low valueOptional: pin actions to a commit SHA to satisfy zizmor's
unpinned-usespolicy.The
@v6bumps are valid. zizmor flags these as unpinned per its blanket pin-to-hash policy. This is pre-existing (the@v4refs were also tag-pinned), so it's not introduced here, but since you're already touching these lines you could pin to the release commit SHA (with the version as a trailing comment) to clear the finding.♻️ Example pinning (use the actual v6 release SHA)
- uses: actions/checkout@v6 + uses: actions/checkout@<v6-release-sha> # v6Also applies to: 44-44
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cli_version.yml at line 38, Replace the unpinned action reference "actions/checkout@v6" with the specific release commit SHA for the v6 release and keep the human-readable tag as a trailing comment (e.g., use the full commit hash with a comment like "# v6") so zizmor's unpinned-uses policy is satisfied; do the same for the other occurrence ("actions/checkout@v6" at the other line) so both references are pinned while still indicating the version tag for clarity..github/workflows/tests.yml (1)
21-21: 💤 Low valueOptional: pin actions to a commit SHA to satisfy zizmor's
unpinned-usespolicy.Both
@v6bumps are valid; the action runtime (Node 24) is independent of the matrixnode-version: 22.xused to run your tests, so there's no conflict. As incli_version.yml, zizmor flags these as unpinned per its blanket policy — optionally pin to the release commit SHA to clear the finding.Also applies to: 24-24
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/tests.yml at line 21, Replace the unpinned action references (e.g., the uses: actions/checkout@v6 entries) with pinned commit SHAs: locate each occurrence of "actions/checkout@v6" in the workflow and change the tag to the repository commit SHA for the v6 release (actions/checkout@<commit-sha>), doing the same for any other unpinned action tags flagged by zizmor; ensure you use the exact release commit SHA for the corresponding tag so the workflow references an immutable commit instead of a floating tag.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/cli_version.yml:
- Line 38: Replace the unpinned action reference "actions/checkout@v6" with the
specific release commit SHA for the v6 release and keep the human-readable tag
as a trailing comment (e.g., use the full commit hash with a comment like "#
v6") so zizmor's unpinned-uses policy is satisfied; do the same for the other
occurrence ("actions/checkout@v6" at the other line) so both references are
pinned while still indicating the version tag for clarity.
In @.github/workflows/tests.yml:
- Line 21: Replace the unpinned action references (e.g., the uses:
actions/checkout@v6 entries) with pinned commit SHAs: locate each occurrence of
"actions/checkout@v6" in the workflow and change the tag to the repository
commit SHA for the v6 release (actions/checkout@<commit-sha>), doing the same
for any other unpinned action tags flagged by zizmor; ensure you use the exact
release commit SHA for the corresponding tag so the workflow references an
immutable commit instead of a floating tag.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c0f66540-0a28-4293-9204-376a7a7b4d01
📒 Files selected for processing (2)
.github/workflows/cli_version.yml.github/workflows/tests.yml
Bump actions/checkout from v4 to v6 and actions/setup-node from v4 to v6 so all workflow steps run on the Node.js 24 runtime (deadline: 2026-06-16). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
BenjaminLangenakenSF
force-pushed
the
upgrade/node24-actions
branch
from
33afe53 to
97b8e6a
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cli_version.yml:
- Line 38: Replace the floating `uses: actions/checkout@v6` references with
pinned full commit SHAs for both occurrences (the two `uses:
actions/checkout@v6` lines) to satisfy the unpinned-uses policy; locate each
`uses: actions/checkout@v6` in the workflow and change it to `uses:
actions/checkout@<FULL_COMMIT_SHA>` (use the official actions/checkout
repository commit SHA you intend to pin), and commit the updated workflow.
In @.github/workflows/tests.yml:
- Line 21: The workflow currently uses mutable tags for third-party actions —
update the two uses entries referencing actions/checkout@v6 and
actions/setup-node@v6 to pinned immutable SHAs: locate the uses lines that
mention "actions/checkout" and "actions/setup-node" in the tests.yml and replace
the tag versions with the corresponding full commit digests (the commit SHA for
the exact release you want) so both uses: entries are fixed to exact SHAs rather
than floating tags.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 92369c0e-4302-4990-9992-f300b32f7a92
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (4)
.github/workflows/cli_version.yml.github/workflows/tests.ymlCHANGELOG.mdpackage.json
✅ Files skipped from review due to trivial changes (2)
- package.json
- CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/checkoutfrom v4 to v6 in bothcli_version.yml(2 occurrences) andtests.ymlactions/setup-nodefrom v4 to v6 intests.ymlThese v6 releases use the Node.js 24 runtime. GitHub will deprecate the Node.js 20 runtime used by v4 actions; all workflows must be updated before the deadline of June 16, 2026.
Files changed
.github/workflows/cli_version.yml.github/workflows/tests.ymlTest plan
actions/checkout@v4oractions/setup-node@v4🤖 Generated with Claude Code