ci: move release actions off the deprecated Node 20 runtime#40
Open
ndemianc wants to merge 1 commit into
Open
Conversation
Every release run logs a Node 20 deprecation warning per step, and closes with:
"The following actions target Node.js 20 but are being forced to run on Node.js
24: actions/cache@v4, actions/checkout@v4, actions/setup-node@v4,
actions/upload-artifact@v4."
Nothing is broken — GitHub is shimming them onto Node 24 — but the shim is
temporary, so pin majors that target node24 natively:
checkout v4 -> v7
setup-node v4 -> v7
cache v4 -> v6
upload-artifact v4 -> v7
download-artifact v4 -> v8
Node 24 actions require Actions Runner >= 2.327.1; the hosted images run 2.335.1
(per the v0.9.2 build log) and self-update, so nothing to do there.
The majors were picked against how this workflow actually uses them, and each
one's breaking change was checked rather than assumed:
· setup-node v6 limits automatic caching to npm — this workflow never sets
setup-node's `cache:` input (npm caching is the explicit actions/cache step),
so it's a no-op here.
· checkout v7 blocks fork checkouts for pull_request_target / workflow_run —
neither is a trigger (tag push + workflow_dispatch).
· upload-artifact v7's unzipped "direct uploads" are opt-in via `archive:`;
the default still zips, so the .app.zip round-trip is unchanged.
· download-artifact v8 now ERRORS on a digest mismatch instead of warning.
Kept deliberately: a corrupted app bundle must not reach a release we then
sign and notarize. A spurious failure is recoverable by re-running the job.
Verified every input this workflow passes is still declared in the new majors
(notably download-artifact's `merge-multiple`, which the draft-release job
depends on), that all five now report `using: node24`, and that the YAML still
parses with both matrix arches and triggers intact.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the release workflow’s GitHub Action pins to majors that natively target the Node 24 runtime, removing the current “Node 20 deprecated / forced to run on Node 24” warnings and reducing future break risk as GitHub removes the shim.
Changes:
- Bump
actions/checkoutandactions/setup-nodetov7. - Bump
actions/cachetov6and artifact actions toupload-artifact@v7/download-artifact@v8. - Add an in-file rationale block documenting why each major bump is safe for this workflow.
Comments suppressed due to low confidence (1)
.github/workflows/release.yml:129
- The workflow still uses
softprops/action-gh-release@v2, which targets the Node 20 runtime (runs.using: node20). If the goal is to eliminate Node 20 deprecation/shim warnings from release runs, this step should also be moved to a Node 24-compatible major (v3 targetsnode24).
- uses: actions/download-artifact@v8
with:
path: apps
merge-multiple: true
- name: Create / refresh the draft release with the UNSIGNED apps
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every release run logs a Node 20 deprecation warning per step and ends with:
Nothing is broken today — GitHub shims them onto Node 24 (the v0.9.2 x64 build succeeded and uploaded its 198 MB artifact). But the shim is temporary, so this pins majors that target
node24natively.Node 24 actions require Actions Runner ≥ 2.327.1; the hosted images run 2.335.1 and self-update.
Breaking changes — checked, not assumed
cache:input; npm caching is the explicitactions/cachestep.pull_request_target/workflow_run→ not a trigger (tag push +workflow_dispatch).archive:→ opt-in; default still zips, so the.app.zipround-trip is unchanged.Verification
merge-multiple, whichdraft-releasedepends on.using: node24.arm64@macos-14,x64@macos-15-intel) and both triggers intact.What is not verified
The
testjob (ubuntu, cheap) exercises checkout + setup-node and can be run via workflow_dispatch. The artifact round-trip (upload-artifact→download-artifact) only runs on a real tag, sincedraft-releaseis gated onrefs/tags/, so that pair is verified by reading the action contracts rather than by a run.