Skip to content

ci: move Actions off the deprecated Node 20 runtime - #600

Merged
ytallo merged 1 commit into
mainfrom
ci/node24-action-bumps
Jul 24, 2026
Merged

ci: move Actions off the deprecated Node 20 runtime#600
ytallo merged 1 commit into
mainfrom
ci/node24-action-bumps

Conversation

@ytallo

@ytallo ytallo commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Every job currently logs:

Node 20 is being deprecated. This workflow is running with Node 24 by default. If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable.

The runner already forces Node 24, so this is a warning about actions whose action.yml still declares node20. This moves each one to the lowest major that declares node24, so the change carries no more behavioural risk than the runtime demands.

Action From To Note
actions/checkout v4 v5
actions/setup-node v4 v5 see caching note below
actions/setup-python v5 v6
actions/upload-artifact v4 v6 v5 is still node20
actions/download-artifact v4 v7 v5 and v6 are still node20
pnpm/action-setup v4 v5
softprops/action-gh-release v2 v3
actions/create-github-app-token v2 v3
docker/setup-qemu-action v3 v4
docker/setup-buildx-action v3 v4
docker/login-action v3 v4
docker/build-push-action v6 v7

Unchanged: Swatinem/rust-cache@v2 already declares node24. dtolnay/rust-toolchain, taiki-e/upload-rust-binary-action and iii-hq/skills-and-validation are composite actions with no Node runtime.

Two things worth knowing

The artifact actions skip majors. upload-artifact v5.0.0 and download-artifact v6.0.0 both have release notes announcing Node 24 support, but action.yml at those tags still declares node20. Versions here were chosen by reading runs.using at each tag rather than trusting the notes — hence v6 and v7 respectively.

setup-node v5 changes caching semantics. It begins caching automatically when package.json declares packageManager, and this repository's root declares pnpm@11.13.1. Eight steps that have never cached would silently start — in a repository already over its 10 GiB cache budget (see #599), where added pressure evicts the pinned-engine cache that every PR run depends on. Those eight now pin package-manager-cache: false to preserve today's behaviour:

_harness-integration.yml, _publish-registry.yml, ci.yml (×2), release-lsp-vscode.yml (×3), storage-e2e.yml

The eight steps with an explicit cache: are untouched. Turning any of them on is a deliberate decision, not a side effect of a runtime bump.

Validation

  • Every workflow still parses (yaml.safe_load across .github/workflows/*.yml).
  • Re-audited every uses: in the repository against the GitHub API: no action still resolves to a node20 runtime.
  • Audited all 16 setup-node steps: the 8 with explicit cache: keep it, the 8 without now carry package-manager-cache: false. No step changes caching behaviour.
  • checkout v5, setup-python v6 and the docker bumps require runner ≥ v2.327.1; all jobs run on GitHub-hosted ubuntu-latest or a hosted matrix, well past that.

Not validated: the release-only paths (release.yml, release-lsp-vscode.yml, docker publish) can't be exercised from a PR — they run on tag pushes. softprops/action-gh-release@v3 and docker/build-push-action@v7 land untested here and are worth watching on the first release after merge.

CI-only, so no Linear ticket; labelled no-ticket per pr-linear-check.yml.

@ytallo ytallo added the no-ticket PR deliberately has no Linear ticket (bump/typo/CI-only) label Jul 24, 2026
@vercel

vercel Bot commented Jul 24, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
workers Ready Ready Preview, Comment Jul 24, 2026 11:24pm
workers-tech-spec Ready Ready Preview, Comment Jul 24, 2026 11:24pm

Request Review

@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@ytallo, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 36 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 32e682f7-a9ed-48e7-b5f0-5723ff2ec104

📥 Commits

Reviewing files that changed from the base of the PR and between b00dd31 and e93a9ea.

📒 Files selected for processing (16)
  • .github/workflows/_bundle.yml
  • .github/workflows/_container.yml
  • .github/workflows/_harness-integration.yml
  • .github/workflows/_publish-registry.yml
  • .github/workflows/_publish-worker-skills.yml
  • .github/workflows/_rust-binary.yml
  • .github/workflows/cache-warm.yml
  • .github/workflows/ci.yml
  • .github/workflows/create-tag.yml
  • .github/workflows/database-e2e.yml
  • .github/workflows/publish-worker-skills.yml
  • .github/workflows/rbac-proxy-e2e.yml
  • .github/workflows/release-lsp-vscode.yml
  • .github/workflows/release.yml
  • .github/workflows/shell-e2e.yml
  • .github/workflows/storage-e2e.yml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch ci/node24-action-bumps

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown
Contributor

skill-check — worker

0 verified, 49 skipped (no docs/).

Layer Result
structure
vale
ai
render

Four for four. Nicely done.

Runners now execute node20 actions on Node 24 and warn on every job:
"Node 20 is being deprecated. This workflow is running with Node 24 by
default." Each action moves to the LOWEST major that declares node24, so
this carries no more behavioural change than the runtime demands.

  actions/checkout                 v4 -> v5
  actions/setup-node               v4 -> v5
  actions/setup-python             v5 -> v6
  actions/upload-artifact          v4 -> v6   (v5 is still node20)
  actions/download-artifact        v4 -> v7   (v5, v6 still node20)
  pnpm/action-setup                v4 -> v5
  softprops/action-gh-release      v2 -> v3
  actions/create-github-app-token  v2 -> v3
  docker/setup-qemu-action         v3 -> v4
  docker/setup-buildx-action       v3 -> v4
  docker/login-action              v3 -> v4
  docker/build-push-action         v6 -> v7

Unchanged: Swatinem/rust-cache@v2 already declares node24, and
dtolnay/rust-toolchain, taiki-e/upload-rust-binary-action and
iii-hq/skills-and-validation are composite actions with no Node runtime.

The artifact actions skip majors because their v5/v6 release notes claim
Node 24 support that action.yml does not actually declare; the versions
above were picked by reading `runs.using` at each tag rather than the notes.

setup-node v5 additionally starts caching automatically when package.json
declares `packageManager`, which this repository's root does
(pnpm@11.13.1). Eight steps that never cached would silently begin to, in a
repository already over its 10 GiB cache budget, so they pin
`package-manager-cache: false` to keep current behaviour. Steps with an
explicit `cache:` are untouched.

checkout v5, setup-python v6 and the docker bumps require runner
v2.327.1+; every job here runs on GitHub-hosted ubuntu-latest or a hosted
matrix, all well past that.
@ytallo
ytallo force-pushed the ci/node24-action-bumps branch from d62dadc to e93a9ea Compare July 24, 2026 23:23
@ytallo
ytallo merged commit fb03988 into main Jul 24, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-ticket PR deliberately has no Linear ticket (bump/typo/CI-only)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant