Describe the bug
GitHub Actions runs in this repository emit the deprecation annotation:
Node.js 20 is deprecated. GitHub Actions will drop support for Node.js 20 soon. Please update the following actions to a newer version: actions/checkout, actions/setup-node
The cause is that the first-party actions are pinned to majors whose action.yml still declares using: node20:
.github/workflows/audit.yml — actions/checkout@v4, actions/setup-node@v4
.github/workflows/main.yml — actions/checkout@v4, actions/setup-node@v4
.github/workflows/release.yml — actions/checkout@v4, actions/setup-node@v4
.github/workflows/sync-docs.yaml — actions/checkout@v4 (x2)
.github/workflows/trivy.yaml — actions/checkout@v4
Additionally, the single-version node-version inputs are behind the current release line: audit.yml uses 22.x and release.yml uses '22', while the CI matrix in main.yml already covers Node 24.
To Reproduce
- Open any recent workflow run under the Actions tab (for example a
CI run on a pull request).
- Look at the run summary / annotations panel.
- See the "Node.js 20 is deprecated" warning attached to the checkout and setup-node steps.
Expected behavior
No Node 20 deprecation annotations. Every first-party actions/* step should resolve to a major whose action.yml declares using: node24.
Fix needed
- Bump
actions/checkout from @v4 to @v5 in all five workflows (@v5 declares using: node24).
- Bump
actions/setup-node from @v4 to @v5 in audit.yml, main.yml, and release.yml (@v5 declares using: node24).
- Bump
node-version from 22.x to 24.x in audit.yml and from '22' to '24' in release.yml, preserving each file's existing value format.
- Leave the
main.yml CI matrix at [22, 24] — it already covers Node 24, and dropping 22 would reduce test coverage for consumers still on that LTS line.
- Leave
aquasecurity/trivy-action alone; it is SHA-pinned to a third-party release and is out of scope for this change.
Additional context
Same remediation as sourcefuse/loopback4-microservice-catalog issue #2601 / PR #2602. No source or runtime code is affected — the change is confined to .github/workflows/.
Describe the bug
GitHub Actions runs in this repository emit the deprecation annotation:
The cause is that the first-party actions are pinned to majors whose
action.ymlstill declaresusing: node20:.github/workflows/audit.yml—actions/checkout@v4,actions/setup-node@v4.github/workflows/main.yml—actions/checkout@v4,actions/setup-node@v4.github/workflows/release.yml—actions/checkout@v4,actions/setup-node@v4.github/workflows/sync-docs.yaml—actions/checkout@v4(x2).github/workflows/trivy.yaml—actions/checkout@v4Additionally, the single-version
node-versioninputs are behind the current release line:audit.ymluses22.xandrelease.ymluses'22', while the CI matrix inmain.ymlalready covers Node 24.To Reproduce
CIrun on a pull request).Expected behavior
No Node 20 deprecation annotations. Every first-party
actions/*step should resolve to a major whoseaction.ymldeclaresusing: node24.Fix needed
actions/checkoutfrom@v4to@v5in all five workflows (@v5declaresusing: node24).actions/setup-nodefrom@v4to@v5inaudit.yml,main.yml, andrelease.yml(@v5declaresusing: node24).node-versionfrom22.xto24.xinaudit.ymland from'22'to'24'inrelease.yml, preserving each file's existing value format.main.ymlCI matrix at[22, 24]— it already covers Node 24, and dropping 22 would reduce test coverage for consumers still on that LTS line.aquasecurity/trivy-actionalone; it is SHA-pinned to a third-party release and is out of scope for this change.Additional context
Same remediation as
sourcefuse/loopback4-microservice-catalogissue #2601 / PR #2602. No source or runtime code is affected — the change is confined to.github/workflows/.