Update actions node24 - #554
Merged
Merged
Conversation
Every run logged "Node 20 is being deprecated. This workflow is running with Node 24 by default." Nothing was broken -- the runner already forces Node 24 -- but 13 of the 14 pinned actions still declared runs.using: node20. All pinned actions now declare node24 (or composite). Checked each bump's release notes against how this repo actually calls the action: - actions/checkout v4.2.2 -> v6.1.0 (deliberately NOT v7, see below) - actions/upload-artifact v4.6.2 -> v7.0.1 - actions/download-artifact v4.3.0 -> v8.0.1 - actions/cache v5.0.1 -> v6.1.0 (already node24; bumped for currency) - actions/github-script v7.0.1 -> v9.0.0 - actions/stale v9.1.0 -> v11.0.0 - lukka/get-cmake v4.2.1 -> v4.4.0 - lukka/run-cmake v10.8 -> v10.9 - lukka/run-vcpkg v11.5 -> v11.6 - msys2/setup-msys2 v2.30.0 -> v2.32.0 - ncipollo/release-action v1.20.0 -> v1.21.0 - peter-evans/create-or-update-comment v4.0.0 -> v5.0.0 - peter-evans/find-comment v3.1.0 -> v4.0.0 - cpp-linter/cpp-linter-action v2.16.7 -> v2.20.0 (composite either way) Three findings worth recording: checkout is held at v6, not v7, on purpose. v7 blocks checking out a fork PR under pull_request_target and workflow_run (actions/checkout#2454). Code Style Check is pull_request_target and checks out github.event.pull_request.head.sha from head.repo.full_name, so v7 would break it. v6.1.0 is node24 and keeps that working. upload-artifact v5 was not sufficient: it shipped "preliminary" Node 24 support but still defaulted to node20. v6 is the first release that actually runs on node24. download-artifact v5 changed the output path for single downloads by ID, and github-script v9 removed require('@actions/github'). Neither applies here: the two download sites use merge-multiple with no artifact-ids, and the one github-script uses the injected github/context globals. Also pins the single floating actions/checkout@v6 in build-artifacts.yml to a SHA, matching the convention used everywhere else.
…_target Two defects, and they compound: the job took on the risk of pull_request_target while enforcing nothing. 1. The gate never fired. The step read steps.linter.outputs.format-checks-failed, which is not an output cpp-linter exposes -- it publishes checks-failed, clang-tidy-checks-failed and clang-format-checks-failed. Verified against both the old pin (v2.16.7) and the current one (v2.20.0), so this is not fallout from the version bump. The expression resolved to empty, '' > 0 is false, and the failure step was always skipped: the job annotated the offending lines and then exited 0. The last 40 runs are all green. 2. pull_request_target was unnecessary. Nothing in the job calls a write API: thread-comments is explicitly false, while step-summary writes a file and file-annotations emits workflow commands, neither of which needs a permission. So pull-requests: write was never used, and checking out fork code under the base-repo token bought nothing. Switching to pull_request keeps both feedback channels working -- fork PRs get a read-only token, which is all this job ever needed -- and removes the privileged context entirely. The `repository:` input goes away because GitHub replicates the PR head into the base repo, so the head SHA is fetchable without it; check-whitespace.yml already relies on this. Expect this to turn red on any open PR that has real formatting violations. That is the point, but it surfaces all at once rather than gradually.
Held back at v6 in the first commit of this branch because v7 blocks checking out a fork PR under pull_request_target and workflow_run (actions/checkout#2454), which the code style check relied on. That job now runs on plain pull_request, so nothing in the repo trips the guard: - no workflow uses pull_request_target or workflow_run any more - the only cross-repository checkout left is the Homebrew tap in bump-homebrew.yml, which runs on release/workflow_dispatch against a trusted repo with a deploy key, not on a fork PR 10 pins updated, v6.1.0 -> v7.0.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update CI