build(ci): move every action off the deprecated Node 20 runtime - #66
Merged
Conversation
GitHub is retiring Node 20 on the runners, and eight action references across four workflows still declared it. The deploy log has been warning about download-artifact for weeks; a sweep of every pinned SHA found the rest. actions/checkout v4 -> v7 actions/setup-dotnet v4 -> v6 actions/download-artifact v4 -> v8 github/codeql-action v3 -> v4 docker/setup-buildx-action v3 -> v4 docker/build-push-action v6 -> v7 Two of them were mine: gate-probes.yml was written yesterday by copying the pins out of an existing workflow, which carried the old ones along with the formatting. A new file inherits whatever it was copied from, including the staleness. download-artifact v8 pairs with upload-artifact v7 despite the major-version gap. There is no upload-artifact v8 — if they had to match, v8 would be unusable by anyone. Both are post-v4 and share the same artifact backend. Verified by re-reading action.yml at every pinned SHA: no node20 left.
This was referenced Aug 2, 2026
bgard68
added a commit
that referenced
this pull request
Aug 2, 2026
Completes on this branch what #66 did on main. The sweep there only covered main, so these were reported clean and were not — the same inference mistake the branch-scoped checks in this repository exist to prevent. Verified by reading action.yml at each pinned SHA and confirming node24.
bgard68
added a commit
that referenced
this pull request
Aug 2, 2026
Completes on this branch what #66 did on main. The sweep there only covered main, so these were reported clean and were not — the same inference mistake the branch-scoped checks in this repository exist to prevent. Verified by reading action.yml at each pinned SHA and confirming node24.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub is retiring Node 20 on the runners. The deploy log has been warning about
download-artifactfor weeks — a sweep of every pinned SHA found eight references across four workflows still declaring it.To be clear about what this is: it is the action's own JavaScript runtime, declared in its
action.yml, not the Node your code uses.actions/checkoutactions/setup-dotnetactions/download-artifactgithub/codeql-actiondocker/setup-buildx-actiondocker/build-push-actionTwo of these were mine
gate-probes.ymlwas written yesterday by copying pins out of an existing workflow — which carried the old SHAs along with the formatting. A new file inherits whatever it was copied from, staleness included. Worth noting because the same thing will happen to the next file anyone copies.The one compatibility question
download-artifactgoes to v8 whileupload-artifactstays at v7, and these two must agree on the artifact backend. That gap is fine: there is no upload-artifact v8, so if they had to match, v8 would be unusable by anyone. Both are post-v4 and share the same backend.Verification
Every pinned SHA was checked by reading its
action.ymlat that exact commit — before, to find them, and after, to confirm none is left.aquasecurity/trivy-actionandgitleaks/gitleaks-actionare composite/docker actions with no Node runtime, so they are unaffected.The deploy job's smoke test exercises
download-artifactend to end on merge, which is the one with real breakage potential.