From b187bb5de5d4076769bf33cc34cd177e5f9b40aa Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 15 Oct 2026 19:54:10 +0000 Subject: [PATCH 1/2] CI: move action pins off deprecated Node 20 GitHub now forces actions that target Node.js 20 onto Node 24 and logs a deprecation warning on every job. When Node 20 support is removed, every PR and merge-queue leg that sets up Node or Python, or moves an artifact, would break at the same moment. Move the CI workflow and the two artifact retry composites to the first release of each action that runs on Node 24. Each new pin's only breaking change is the runtime, or an input we don't use: - setup-node v4 -> v6.4.0 (pin already used in release.yml; no root package.json, so the v5+ auto-cache never turns on) - setup-python v5 -> v6.3.0 - download-artifact v4 -> v7.0.0 (we download by pattern, not ID) - upload-artifact v4 -> v6.0.0 - setup-uv v6.8.0 -> v7.0.0 (drops only the unused server-url) release.yml and the disabled compatibility workflows are left alone. Refs #1588 Assisted-by: Claude Code:claude-opus-5-5 --- .github/actions/download-artifact/action.yml | 4 +-- .github/actions/upload-artifact/action.yml | 6 ++--- .github/workflows/ci.yml | 26 ++++++++++---------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/actions/download-artifact/action.yml b/.github/actions/download-artifact/action.yml index 862030a6a..ca99b303c 100644 --- a/.github/actions/download-artifact/action.yml +++ b/.github/actions/download-artifact/action.yml @@ -26,7 +26,7 @@ runs: - name: Download (attempt 1) id: first if: ${{ !cancelled() }} - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 continue-on-error: true with: pattern: ${{ inputs.pattern }} @@ -58,7 +58,7 @@ runs: - name: Download (attempt 2) id: second if: ${{ !cancelled() && (steps.first.outcome == 'failure' || steps.first-check.outcome == 'failure') }} - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: ${{ inputs.pattern }} merge-multiple: ${{ inputs.merge-multiple }} diff --git a/.github/actions/upload-artifact/action.yml b/.github/actions/upload-artifact/action.yml index 96d80ecea..527112b92 100644 --- a/.github/actions/upload-artifact/action.yml +++ b/.github/actions/upload-artifact/action.yml @@ -42,7 +42,7 @@ runs: - name: Upload (attempt 1) id: first if: ${{ !cancelled() }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 continue-on-error: true with: name: ${{ inputs.name }} @@ -61,7 +61,7 @@ runs: - name: Upload (attempt 2) id: second if: ${{ !cancelled() && steps.first.outcome == 'failure' }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 continue-on-error: true with: name: ${{ inputs.name }}-retry-${{ github.run_attempt }}-2 @@ -82,7 +82,7 @@ runs: - name: Upload (attempt 3) id: third if: ${{ !cancelled() && steps.second.outcome == 'failure' }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: ${{ inputs.name }}-retry-${{ github.run_attempt }}-3 path: ${{ inputs.path }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b576932a4..eef9a64dd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -178,7 +178,7 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20.20.2' @@ -810,7 +810,7 @@ jobs: # binary we mount into the container). - name: Download base image - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: docker-base-image* merge-multiple: true @@ -909,7 +909,7 @@ jobs: run: sudo apt-get update && sudo apt-get install -y lcov - name: Download all coverage artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: path: coverage-artifacts pattern: coverage-{host*,docker-*} @@ -967,7 +967,7 @@ jobs: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20.20.2' @@ -1402,7 +1402,7 @@ jobs: - name: Setup Node.js if: matrix.suite == 'e2e_npm' || matrix.suite == 'e2e_scan' || matrix.suite == 'e2e_safety_pnpm' - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20.20.2' @@ -1417,13 +1417,13 @@ jobs: - name: Setup Node.js 24 (named pnpm legs) if: matrix.suite == 'e2e_redirect_pnpm_build' - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24.x' - name: Setup Python if: matrix.suite == 'e2e_pypi' || matrix.uv != '' || matrix.poetry != '' || matrix.pdm != '' || matrix.hatch != '' - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12.x' @@ -1464,7 +1464,7 @@ jobs: - name: Setup uv (Pipenv / pip legs) if: matrix.pipenv != '' || matrix.pip != '' - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 + uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0 - name: Install the Pythons the Pipenv / pip legs run on if: matrix.pipenv != '' || matrix.pip != '' @@ -1661,7 +1661,7 @@ jobs: - name: Setup Node.js 24 (vlt legs) if: matrix.vlt != '' - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24.21.0' @@ -2151,7 +2151,7 @@ jobs: # images and would be flagged by zizmor's cache-poisoning audit. - name: Download base image - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: docker-base-image* merge-multiple: true @@ -2230,7 +2230,7 @@ jobs: shared-key: dev-ubuntu-latest save-if: ${{ github.ref == 'refs/heads/main' }} - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24.x' - name: Manifest-less VEX over every real yarn classic flow @@ -2620,7 +2620,7 @@ jobs: - name: Setup Node.js if: steps.gate.outputs.run == 'true' - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: # Node 24, NOT the 20.20.2 the other jobs pin. pnpm 10 imports # `node:sqlite` for its store index, which does not exist before @@ -2671,7 +2671,7 @@ jobs: - name: Setup Python + uv if: steps.gate.outputs.run == 'true' - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12.x' From c38b163169e6bde2fc2fdaff8debf2c1df101816 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 15 Oct 2026 19:58:46 +0000 Subject: [PATCH 2/2] CI: keep download retry comment version-neutral The truncated-download note named v4 as if it described the current pin. Say it was seen on v4 so nobody reads the verify-and-retry steps as a v4-only workaround and drops them. Assisted-by: Claude Code:claude-opus-5-5 --- .github/actions/download-artifact/action.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/actions/download-artifact/action.yml b/.github/actions/download-artifact/action.yml index ca99b303c..1524ffec7 100644 --- a/.github/actions/download-artifact/action.yml +++ b/.github/actions/download-artifact/action.yml @@ -18,8 +18,9 @@ inputs: runs: using: composite steps: - # download-artifact v4 can finish "successfully" with a truncated file: - # run 38059192473 attempt 1 logged "Starting download" and nothing more, + # download-artifact can finish "successfully" with a truncated file. + # Seen on v4; keep the check on newer majors too: run + # 38059192473 attempt 1 logged "Starting download" and nothing more, # then `zstd -d` failed with "Read error (39) : premature end" in the # next step and the leg went red. A merge-queue leg that does that # evicts the entry, so check the files and fetch them once more.