CI: move action pins off deprecated Node 20 (#1588)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #1588 (partial fix: see Scope)

Problem

Every lean PR and merge-queue job that sets up Node or Python, or moves an artifact, logs "Node.js 20 is deprecated … being forced to run on Node.js 24". The forced run works today. Once GitHub drops Node 20 action support, those legs all fail at once, and ci-ok with them.

Change

Pins move to the first release of each action that runs on node24, by full commit SHA. I checked each new pin's action.yml at that SHA and confirmed runs.using: node24. Taking the lowest Node 24 major means the runtime is the only breaking change we pick up:

Action	Before	After	Breaking changes relevant here
actions/setup-node	49933ea v4	48b55a0 v6.4.0	v5+ auto-caches only when the root package.json sets packageManager. There is no root package.json, so caching stays off. The same pin is already trusted in release.yml.
actions/setup-python	a26af69 v5	ece7cb0 v6.3.0	Runtime only
actions/download-artifact	d3f86a1 v4	37930b1 v7.0.0	v5+ extracts a single matched artifact (by ID, or a pattern matching one artifact) directly into path/. Every caller here (the 3 direct steps and both composite callers) passes merge-multiple: true, which was already flat, so the layout doesn't change.
actions/upload-artifact	ea165f8 v4	b7c566a v6.0.0	Runtime only
astral-sh/setup-uv	d0cc045 v6.8.0	eb1897b v7.0.0	Drops the deprecated server-url input, which we don't set (checked against the upstream action.yml diff)

The files are .github/workflows/ci.yml and the composites .github/actions/{upload,download}-artifact/action.yml. After this change, every action pinned in ci.yml and the composites is node24 or composite. I checked all 20 unique pins.

Scope

• Not changed: release.yml. Agents may not edit release/publish workflows. It still pins download-artifact, upload-artifact and setup-node v4, so CI: pinned actions still target deprecated Node.js 20 #1588 stays open for a human. The same SHAs as above work there.
• Not changed: publish-cargo.yml. It pins rust-lang/crates-io-auth-action v1.0.3 (Node 20; v1.0.5 c6f97d42 is Node 24) and is also a publish workflow, so it's left for a human.
• Not changed: the disabled *-compatibility.yml workflows. They are deliberately disabled and can't be run to validate a bump.

/code-review high

• release.yml / publish-cargo.yml still on Node 20: real, but those are release/publish workflows agents may not edit. See Scope and CI: pinned actions still target deprecated Node.js 20 #1588.
• Compatibility workflows still on Node 20 pins: they are disabled and can't be run to validate. Left out of scope.
• download-artifact v5+ single-match layout: latent only. Every caller passes merge-multiple: true (see table). I didn't change the composite's merge-multiple default to avoid widening the PR.
• Stale "v4" wording in the download composite comment: fixed in c38b163.

CI result

Lean run 38798279176 on c38b163: 36 success, 19 skipped, 0 failed. ci-ok and clippy are green. None of the 40 successful jobs I checked has a "Node.js 20 is deprecated" annotation.

Runner cost

No change: 32 jobs in ci.yml, the lean PR run uses the same ~28 Linux jobs and ~8 min, and no steps were added or removed. Only the uses: SHAs change.

Validation

• actionlint on ci.yml: findings identical before and after (144 lines, all YAML-anchor parse limits of this actionlint version)
• zizmor --offline on ci.yml and the composites: identical before and after (59 findings, 0 medium/high)
• python3 -m pytest scripts/tests -q: 342 passed, 6 skipped
• ci.yml still parses, and no fromJSON matrix was touched
• No cfg(windows) / cfg(unix) code was touched, so no full-scope dispatch

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kf47xCWcRgvQuWrqr5sDGy

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​astral-sh/​setup-uv@​eb1897b8dc4b5d5bfe39a428a8f2304605e0983c

View full report

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​astral-sh/​setup-uv@​eb1897b8dc4b5d5bfe39a428a8f2304605e0983c

View full report

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c38b163. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review — head c38b163.

• CI: 36/36 checks green (19 skipped), ci-ok green. No main-wide failures.
• Bugbot: reviewed c38b163, no findings. No open review threads.
• Already approved by Tanmay Singla (@Tanmay182003) on this head.
• Reviewer note: only uses: SHAs change in ci.yml and the two composite actions. The release.yml / publish-cargo.yml pins still use Node 20 and need a human call (CI: pinned actions still target deprecated Node.js 20 #1588).

---

Generated by Claude Code