From 3dc4e4e91cc512eb3159074fff81eea32598a363 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 10 Aug 2026 12:13:08 +0200 Subject: [PATCH] chore(ci): upgrade actions to Node 24 runtimes GitHub deprecated the Node.js 20 runtime; actions declaring `runs.using: node20` (or node16) are force-run on Node 24 and will stop working once the fallback is removed. Because these composite actions are consumed across the org, every node20 action in here surfaces the deprecation warning in every consumer repo's workflow runs. Bumps each action to the newest major that declares `runs.using: node24`: actions/checkout v4 -> v7 (SHA pin v5 -> v7) actions/cache v4 -> v6 actions/setup-node v4 -> v7 actions/setup-python v5 -> v7 actions/upload-artifact v4 -> v7 (SHA pin v4 -> v7) actions/download-artifact SHA v4 -> v8 actions/github-script v7 -> v9 aws-actions/configure-aws-credentials v4 -> v6 hashicorp/setup-terraform v3 -> v4 dorny/paths-filter v3 -> v4 pnpm/action-setup v4 -> v6 softprops/action-gh-release v1 -> v3 stefanzweifel/git-auto-commit-action v5 -> v7 webfactory/ssh-agent v0.9.0 -> v0.10.0 Three dependencies have no Node 24 release upstream and are left as-is: contributor-assistant/github-action@v2.6.1, pozetroninc/github-action-get- latest-release@v0.7.0 and the org's own WalletConnect/actions-rs/toolchain fork. Co-Authored-By: Claude Opus 5 --- .github/workflows/claude-review.yml | 2 +- .github/workflows/claude.yml | 2 +- .github/workflows/maestro-kpi-aggregate.yml | 6 +++--- .github/workflows/test-claude-auto-review.yml | 10 +++++----- actions/deploy-ecs/action.yml | 2 +- actions/deploy-terraform/action.yml | 8 ++++---- actions/fmt-check-terraform/action.yml | 2 +- actions/plan-terraform/action.yml | 8 ++++---- aws/ecs/deploy-image/action.yml | 2 +- aws/ecs/get-task-image/action.yml | 2 +- github/latest_release/action.yml | 2 +- github/paths-filter/action.yml | 2 +- github/update-release-version/action.yml | 2 +- github/update-rust-version/action.yml | 4 ++-- maestro/permit2-reset/action.yml | 2 +- terraform/plan/action.yml | 6 +++--- 16 files changed, 31 insertions(+), 31 deletions(-) diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index 726d655..4ac0a07 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -25,7 +25,7 @@ jobs: id-token: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 686a224..ff7256b 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -43,7 +43,7 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 1 diff --git a/.github/workflows/maestro-kpi-aggregate.yml b/.github/workflows/maestro-kpi-aggregate.yml index 7e245a4..b8e24ed 100644 --- a/.github/workflows/maestro-kpi-aggregate.yml +++ b/.github/workflows/maestro-kpi-aggregate.yml @@ -27,7 +27,7 @@ jobs: # high blast radius. Other workflows in this repo use tags; bump # this one when the actions release a meaningful new version. - name: Checkout - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Validate secrets run: | @@ -47,7 +47,7 @@ jobs: - name: Download yesterday's pass rates (best-effort) id: yesterday continue-on-error: true - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: kpi-pass-rate-latest path: yesterday/ @@ -84,7 +84,7 @@ jobs: # detect a 2-consecutive-day breach. 7-day retention is more than # enough (we only ever read the most-recent artifact). - name: Upload today's pass rates - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: kpi-pass-rate-latest path: pass.jsonl diff --git a/.github/workflows/test-claude-auto-review.yml b/.github/workflows/test-claude-auto-review.yml index 02cfce8..98ccb2f 100644 --- a/.github/workflows/test-claude-auto-review.yml +++ b/.github/workflows/test-claude-auto-review.yml @@ -16,15 +16,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: "20" - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 9 @@ -34,7 +34,7 @@ jobs: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV - name: Setup pnpm cache - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ${{ env.STORE_PATH }} key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} @@ -50,7 +50,7 @@ jobs: run: pnpm test:coverage - name: Upload coverage report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 if: always() with: name: coverage-report diff --git a/actions/deploy-ecs/action.yml b/actions/deploy-ecs/action.yml index 7e1becc..6e944a6 100644 --- a/actions/deploy-ecs/action.yml +++ b/actions/deploy-ecs/action.yml @@ -30,7 +30,7 @@ runs: using: "composite" steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v6 with: aws-access-key-id: ${{ inputs.aws-access-key-id }} aws-secret-access-key: ${{ inputs.aws-secret-access-key }} diff --git a/actions/deploy-terraform/action.yml b/actions/deploy-terraform/action.yml index 7973789..f4d2f0a 100644 --- a/actions/deploy-terraform/action.yml +++ b/actions/deploy-terraform/action.yml @@ -62,15 +62,15 @@ runs: using: "composite" steps: - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 + uses: hashicorp/setup-terraform@v4 with: cli_config_credentials_token: ${{ inputs.tfc_token }} - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 if: ${{ inputs.needs-python == 'true' }} with: python-version: ${{ inputs.python-version }} - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v6 with: aws-access-key-id: ${{ inputs.aws-access-key-id }} aws-secret-access-key: ${{ inputs.aws-secret-access-key }} @@ -94,7 +94,7 @@ runs: echo "::set-output name=workspace-id::$WORKSPACE_ID" - name: Setup SSH key if: ${{ inputs.ssh-key != '' }} - uses: webfactory/ssh-agent@v0.9.0 + uses: webfactory/ssh-agent@v0.10.0 with: ssh-private-key: ${{ inputs.ssh-key }} - name: Configure Terraform Variables diff --git a/actions/fmt-check-terraform/action.yml b/actions/fmt-check-terraform/action.yml index b42d620..113c7c5 100644 --- a/actions/fmt-check-terraform/action.yml +++ b/actions/fmt-check-terraform/action.yml @@ -10,7 +10,7 @@ runs: using: "composite" steps: - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 + uses: hashicorp/setup-terraform@v4 - name: Terraform fmt env: TERRAFORM_PATH: ${{ inputs.terraform-path }} diff --git a/actions/plan-terraform/action.yml b/actions/plan-terraform/action.yml index 20dea23..8893f9d 100644 --- a/actions/plan-terraform/action.yml +++ b/actions/plan-terraform/action.yml @@ -74,14 +74,14 @@ runs: using: "composite" steps: - name: Setup Terraform - uses: hashicorp/setup-terraform@v3 - - uses: actions/setup-python@v5 + uses: hashicorp/setup-terraform@v4 + - uses: actions/setup-python@v7 if: ${{ inputs.needs-python == 'true' }} with: python-version: ${{ inputs.python-version }} cli_config_credentials_token: ${{ inputs.tfc_token }} - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v6 with: aws-access-key-id: ${{ inputs.aws-access-key-id }} aws-secret-access-key: ${{ inputs.aws-secret-access-key }} @@ -103,7 +103,7 @@ runs: echo "key=$KEY" >> $GITHUB_OUTPUT - name: Setup SSH key if: ${{ inputs.ssh-key != '' }} - uses: webfactory/ssh-agent@v0.9.0 + uses: webfactory/ssh-agent@v0.10.0 with: ssh-private-key: ${{ inputs.ssh-key }} - name: Configure Terraform Variables diff --git a/aws/ecs/deploy-image/action.yml b/aws/ecs/deploy-image/action.yml index c8ad3d9..59c3b41 100644 --- a/aws/ecs/deploy-image/action.yml +++ b/aws/ecs/deploy-image/action.yml @@ -25,7 +25,7 @@ runs: using: "composite" steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v6 with: role-to-assume: ${{ inputs.aws-role-arn }} aws-region: ${{ inputs.aws-region }} diff --git a/aws/ecs/get-task-image/action.yml b/aws/ecs/get-task-image/action.yml index 6e348c8..bff5183 100644 --- a/aws/ecs/get-task-image/action.yml +++ b/aws/ecs/get-task-image/action.yml @@ -30,7 +30,7 @@ runs: using: "composite" steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v6 with: role-to-assume: ${{ inputs.aws-role-arn }} aws-region: ${{ inputs.aws-region }} diff --git a/github/latest_release/action.yml b/github/latest_release/action.yml index 8400668..5ac5deb 100644 --- a/github/latest_release/action.yml +++ b/github/latest_release/action.yml @@ -18,7 +18,7 @@ runs: - name: Get release value id: get_value - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: LATEST_TAG: ${{ steps.latest_release.outputs.release }} with: diff --git a/github/paths-filter/action.yml b/github/paths-filter/action.yml index b422ffb..b28950b 100644 --- a/github/paths-filter/action.yml +++ b/github/paths-filter/action.yml @@ -30,7 +30,7 @@ runs: using: composite steps: - - uses: dorny/paths-filter@v3 + - uses: dorny/paths-filter@v4 id: filter with: filters: | diff --git a/github/update-release-version/action.yml b/github/update-release-version/action.yml index 9d2e4ef..37c3a51 100644 --- a/github/update-release-version/action.yml +++ b/github/update-release-version/action.yml @@ -36,7 +36,7 @@ runs: run: cog changelog --at ${{ steps.release.outputs.version }} -t full_hash > GITHUB_CHANGELOG.md - name: Update GitHub release notes - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@v3 with: body_path: GITHUB_CHANGELOG.md tag_name: ${{ steps.release.outputs.version }} diff --git a/github/update-rust-version/action.yml b/github/update-rust-version/action.yml index 8250f5d..7b8b115 100644 --- a/github/update-rust-version/action.yml +++ b/github/update-rust-version/action.yml @@ -49,7 +49,7 @@ runs: git remote set-url origin https://x-access-token:${{ inputs.token }}@github.com/${{ github.repository }} - name: Commit version bump - uses: stefanzweifel/git-auto-commit-action@v5 + uses: stefanzweifel/git-auto-commit-action@v7 with: commit_message: "chore: Bump version for release" file_pattern: "Cargo.toml Cargo.lock" @@ -71,7 +71,7 @@ runs: run: cog changelog --at ${{ steps.release.outputs.version }} -t full_hash > GITHUB_CHANGELOG.md - name: Update GitHub release notes - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@v3 with: body_path: GITHUB_CHANGELOG.md tag_name: ${{ steps.release.outputs.version }} diff --git a/maestro/permit2-reset/action.yml b/maestro/permit2-reset/action.yml index 5f32c12..7d7e4a7 100644 --- a/maestro/permit2-reset/action.yml +++ b/maestro/permit2-reset/action.yml @@ -47,7 +47,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: ${{ inputs.node-version }} diff --git a/terraform/plan/action.yml b/terraform/plan/action.yml index c5634bb..fea037d 100644 --- a/terraform/plan/action.yml +++ b/terraform/plan/action.yml @@ -51,13 +51,13 @@ runs: terraform -chdir=${{ inputs.terraform-path }} show -no-color /tmp/plan.tfplan > /tmp/plan.txt echo "output-file=/tmp/plan.txt" >> $GITHUB_OUTPUT - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 if: ${{ inputs.upload-plan-file == 'true' }} with: name: plan.tfplan path: ${{ steps.plan.outputs.plan-file }} - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 if: ${{ inputs.upload-output-file == 'true' }} with: name: plan.txt @@ -65,7 +65,7 @@ runs: - name: Add Plan to PR if: ${{ github.event_name == 'pull_request' || inputs.add-output-to-pr == 'true' }} - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: PLAN_FILE: ${{ steps.plan.outputs.output-file }} with: