chore: bump Node-20 actions to Node-24 compatible SHAs#110
Merged
Conversation
GitHub-Actions runners force Node-24 on 2026-06-02 (≈one week from
this commit) and remove Node-20 entirely on 2026-09-16. The
release.yml run for v0.2.17 emitted Node-20 deprecation annotations
on three actions; bumping them to current major-version SHAs makes
the warnings go away and unblocks the forced-migration date.
Bumps (SHA + documented tag both updated):
actions/checkout 34e1148... # v4 -> 93cb6ef... # v5
actions/setup-python a26af69... # v5 -> a309ff8... # v6
docker/login-action c94ce9f... # v3 -> 650006c... # v4
49 lines changed across 10 workflow files:
.github/workflows/artifact-cleanup.yml 1 line
.github/workflows/branch-protection.yml 1 line
.github/workflows/changelog-prestage.yml 2 lines
.github/workflows/changelog-rollup.yml 2 lines
.github/workflows/ci.yml 30 lines
.github/workflows/codeql.yml 1 line
.github/workflows/eval-nightly.yml 2 lines
.github/workflows/pin-freshness-audit.yml 2 lines
.github/workflows/release.yml 3 lines
.github/workflows/security.yml 5 lines
No behaviour change beyond the underlying Node runtime. The actions
themselves keep the same input/output contract across these majors
(per upstream release notes).
Local verification:
pin-freshness audit: 68 pins checked, 0 findings
pytest tests/: 215 passed
mypy --strict, ruff, ci-script compile gate, branch-protection
contexts sync: all clean
Self-version bump 0.2.17 -> 0.2.18 (chore = PATCH).
Closes #109
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
GitHub-Actions runners force Node-24 on 2026-06-02 (≈one week away) and remove Node-20 entirely on 2026-09-16. The release.yml run for v0.2.17 emitted Node-20 deprecation annotations on three actions; bumping each to the current major-version SHA makes the warnings go away and unblocks the forced-migration date.
Bumps
actions/checkout34e1148...93cb6ef...actions/setup-pythona26af69...a309ff8...docker/login-actionc94ce9f...650006c...Both the SHA and the trailing
# vNcomment are updated together, matchingdocs/DEVELOPMENT.md#action-pinning-policy.Scope
49 lines changed across 10 workflow files (no other files touched):
.github/workflows/ci.yml.github/workflows/security.yml.github/workflows/release.yml.github/workflows/changelog-prestage.yml,changelog-rollup.yml,eval-nightly.yml,pin-freshness-audit.yml.github/workflows/artifact-cleanup.yml,branch-protection.yml,codeql.ymlNo behaviour change beyond the underlying Node runtime. The actions keep the same input/output contract across these majors (per upstream release notes —
actions/checkoutv4→v5 andactions/setup-pythonv5→v6 are documented as pure Node-runtime bumps with no breaking config changes).Closes #109.
Test plan
python .github/scripts/check_pin_freshness.py→ 68 pins checked, 0 findingspython .github/scripts/check_required_contexts.py→ 21 required jobs across 2 branches, in syncpytest tests/test_scripts_compile.py→ 10 passedpytest tests/ -q→ 215 passedmypy --strict src/ tests/→ clean (44 source files)ruff check .→ All checks passedrelease.ymlrun should emit zero Node-20 deprecation annotationsInvariants affected
None. The action-pinning policy is unchanged; this PR exercises it.
New deps / actions / external surface
Same actions, newer majors. No new actions; no new external endpoints; no new direct or transitive Python/npm deps.
Linked issue
Closes #109