Repository navigation
Bump per-repository action pins off Node 20 (checkout, setup-node, setup-dotnet, artifacts, docker) #235
Description
@einari Publish runs warn "Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24". GitHub will remove the forced Node 24 shim, so these pins will break.
Findings
- The shared reusable workflows in this repository are already on current Node 24 majors, SHA-pinned:
actions/checkoutv7.0.1,actions/setup-nodev7.0.0,actions/setup-dotnetv6.0.0,actions/download-artifactv8.0.2,actions/upload-artifactv7.0.x,actions/cachev6.1.0. Nothing to bump here. - The warnings come from per-repository workflows that still pin the old v4 SHAs: checkout
11d5960a, setup-node49933ea5, setup-dotnet67a3573c, download-artifactd3f86a10, upload-artifactea165f8d. Showrunner's Publish also pinsdocker/build-push-actionv6,docker/login-action,docker/setup-buildx-actionanddocker/setup-qemu-actionv3 (these also warn). - Repositories with at least one of those v4 pins (code search, first 100 hits per pin): Chronicle, Identity, Studio, Dockerfiles, Showrunner, Ensemble, Arc.TypeScript, Arc.Kotlin, Choreography, AI, Infrastructure, Stage, Screenplay.Generation, Screenplay.CritterStack.
- Of these, only Identity has a
.github/dependabot.yml. The other 13 have none, so nothing bumps their pins automatically.
Plan
- Decide how the 13 repositories get current pins: add Dependabot (
github-actionsecosystem) or a propagated bump from this repository's bootstrap workflow. - Bump the pins to the same SHAs this repository uses, keeping SHA pinning. Check
download-artifactv4 to v8 path semantics (artifact name/merge behaviour) per repository before bumping. - Bump the docker actions to their current Node 24 majors.
- Re-run the search to confirm zero remaining v4 pins.
Status
State: In review — PR open; after merge dispatch rollout (dry_run=false); then check first Dependabot PRs for download-artifact semantics
Branch: axon-90-screenplay-618 (#237)
Scope: Dependabot github-actions distributed via bootstrap (L0 decision)
Delivered: Nothing yet.
Remaining: To be confirmed.
Follow-ups: None.
Metadata
Metadata
Assignees
Labels
No labels
Activity
woksin commentedon Nov 12, 2026
Dry-run of the Dependabot rollout (read-only, no writes), produced from the
workflows-235-dependabotbranch: 43 repositories evaluated.Planned change in every repository:
.github/dependabot.ymlwith only thegithub-actionsecosystem, one grouped update (actions, pattern*), monthly,open-pull-requests-limit: 1.Deliberately excluded: Arc.Kotlin, Fundamentals.Kotlin and Arc.Elixir (Dependabot was removed from them in the last 90 days), the Go repositories, and the private repositories acme-commerce-demo, SEO and the temporary security-advisory fork. Repositories on the bootstrap ignore list stay ignored, except Identity, Studio, Stage, Arc.TypeScript, Dockerfiles, AI, Infrastructure and Ensemble, which carry stale action pins and receive only this file.
The rollout is a separate, manually dispatched workflow, so merging it triggers no write. Each repository's first grouped Dependabot PR does the actual bump and carries only
no-release; I will check download-artifact v4 to v8 path semantics there and list any repository where it breaks. Expect up to about 40 grouped PRs shortly after the rollout.