From 0866beeb2ec96e889569284df1040c3478f00507 Mon Sep 17 00:00:00 2001 From: Sergii Demianchuk Date: Thu, 23 Jul 2026 23:50:02 -0400 Subject: [PATCH] ci: move release actions off the deprecated Node 20 runtime MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every release run logs a Node 20 deprecation warning per step, and closes with: "The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4." Nothing is broken — GitHub is shimming them onto Node 24 — but the shim is temporary, so pin majors that target node24 natively: checkout v4 -> v7 setup-node v4 -> v7 cache v4 -> v6 upload-artifact v4 -> v7 download-artifact v4 -> v8 Node 24 actions require Actions Runner >= 2.327.1; the hosted images run 2.335.1 (per the v0.9.2 build log) and self-update, so nothing to do there. The majors were picked against how this workflow actually uses them, and each one's breaking change was checked rather than assumed: · setup-node v6 limits automatic caching to npm — this workflow never sets setup-node's `cache:` input (npm caching is the explicit actions/cache step), so it's a no-op here. · checkout v7 blocks fork checkouts for pull_request_target / workflow_run — neither is a trigger (tag push + workflow_dispatch). · upload-artifact v7's unzipped "direct uploads" are opt-in via `archive:`; the default still zips, so the .app.zip round-trip is unchanged. · download-artifact v8 now ERRORS on a digest mismatch instead of warning. Kept deliberately: a corrupted app bundle must not reach a release we then sign and notarize. A spurious failure is recoverable by re-running the job. Verified every input this workflow passes is still declared in the new majors (notably download-artifact's `merge-multiple`, which the draft-release job depends on), that all five now report `using: node24`, and that the YAML still parses with both matrix arches and triggers intact. --- .github/workflows/release.yml | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 516d22e..d7d6dd9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,13 +19,24 @@ on: permissions: contents: write # create/update the draft release +# Action pins run on the Node 24 runtime. GitHub deprecated Node 20 on the runners (2025-09-19) and +# was force-running the old v4 pins on Node 24 with a warning per step; these majors target node24 +# natively, so the shim (and the warning) is gone. They need Actions Runner >= 2.327.1 — the hosted +# images are well past that (2.335.1 as of the v0.9.2 build) and self-update, so no action needed. +# The majors were chosen against how THIS workflow uses them, not blindly: +# · setup-node v6 limited automatic caching to npm — not used here; npm caching is the explicit +# actions/cache step below, so the change is a no-op for us. +# · checkout v7 blocks fork checkouts for pull_request_target/workflow_run — neither is a trigger. +# · upload-artifact v7 added unzipped "direct uploads" behind `archive:` — opt-in, default unchanged. +# · download-artifact v8 now ERRORS on a digest mismatch (was a warning). Deliberate: a corrupted +# app bundle must not reach a release we then sign and notarize. Recoverable by re-running the job. jobs: # Cheap gate: run the extension unit tests before spending ~1h of macOS build minutes. test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: "24" - name: Extension unit tests @@ -79,12 +90,12 @@ jobs: # the whole class of flake goes away. Same spirit as the GITHUB_TOKEN mitigation above. PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1" steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: "24" # bootstrap.sh checks the .nvmrc major; 24.x satisfies the 1.126 pin - name: Cache npm downloads - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.npm key: npm-${{ matrix.arch }}-${{ hashFiles('scripts/bootstrap.sh') }} @@ -98,7 +109,7 @@ jobs: - name: Zip the unsigned app run: ditto -c -k --sequesterRsrc --keepParent "VSCode-darwin-${{ matrix.arch }}/LevelCode.app" "UNSIGNED-LevelCode-${{ matrix.arch }}.app.zip" - name: Upload app artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: UNSIGNED-LevelCode-${{ matrix.arch }} path: UNSIGNED-LevelCode-${{ matrix.arch }}.app.zip @@ -111,7 +122,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/') runs-on: ubuntu-latest steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: path: apps merge-multiple: true