chore(ci): bump artifact + release actions off the Node 20 runtime - #673
Merged
Conversation
The v0.90.0 release-kbagent.yml run annotated every gate / package-linux / homebrew job with "actions target Node.js 20 but are being forced to run on Node.js 24". Three actions were still on a node20 runtime. Chosen majors are the first ones that actually declare `runs.using: node24`, verified against each tag's action.yml rather than its release notes: - actions/upload-artifact v4 -> v7 (v5 is still node20; v6 was the switch) - actions/download-artifact v4 -> v8 (v5 AND v6 are still node20; v7 switched) - softprops/action-gh-release v2 -> v3 Breaking changes reviewed against actual usage: - download-artifact v5 changed the output path for single-artifact-by-ID downloads; this repo downloads by pattern or whole-run, never by ID. - download-artifact v8 makes a digest mismatch a hard error instead of a warning — the right default for a pipeline that signs and ships these bytes. - upload-artifact v7 direct (unzipped) uploads only apply with `archive: false`, which is not used here. - action-gh-release v3 keeps tag_name / files / prerelease unchanged. Every remaining action in .github/ was audited and already runs on node24 (checkout v5, setup-node v6, setup-python v6, setup-uv v7, configure-aws-credentials v6); cpina/...-push-to-another-repository is a docker action and pypa/gh-action-pypi-publish is composite over node24 steps. All GitHub-hosted runners, so the node24 minimum runner version (2.327.1) is satisfied; no self-hosted fleet to update.
padak
force-pushed
the
chore/ci-node24-actions
branch
from
August 23, 2026 22:16
99f4bf4 to
084bb6b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The v0.90.0
release-kbagent.ymlrun annotated thegate,package-linuxandhomebrewjobs with:Rather than fix only the two actions GitHub named, every
uses:in.github/was audited by resolvingruns.usingfrom each pinned tag's ownaction.yml(release notes are less reliable than the field the runner actually reads).What changed
Only
release-kbagent.ymlcontained node20 actions:actions/upload-artifactusing: node20(its Node 24 support was "preliminary"); v6 was the real switch. v7 is current.actions/download-artifactusing: node20; v7 was the switch. v8 is current.softprops/action-gh-releaseA naive v4 → v5 bump on either artifact action would have kept emitting the same deprecation annotation — that non-obvious fact is now recorded as a comment at the first use of each.
Breaking changes, checked against actual usage
download-artifactv5 changed the output path for single-artifact-by-ID downloads. Not applicable: this repo downloads bypattern:or whole-run, never withartifact-ids:.download-artifactv8 turns a download digest mismatch into a hard error instead of a warning. Kept as-is — the correct default for a pipeline that GPG-signs and ships these exact bytes.download-artifactv8 skips decompression for non-zipped downloads. Not applicable: artifacts here are always service-zipped (the innerdist/*.zipfiles are just members of that archive).upload-artifactv7 direct/unzipped uploads only engage witharchive: false, which is not used.action-gh-releasev3 keepstag_name/files/prerelease— verified against v3'saction.ymlinputs.Already clean (no change needed)
actions/checkout@v5,actions/setup-node@v6,actions/setup-python@v6,astral-sh/setup-uv@v7,aws-actions/configure-aws-credentials@v6all already run on node24.cpina/github-action-push-to-another-repositoryis adockeraction (stays SHA-pinned — it receives the tap PAT).pypa/gh-action-pypi-publish@release/v1is composite over node24 steps.Note: the
node-version: "20"in.github/actions/setup-buildis the Node used to build the React SPA, not an action runtime — untouched here, since bumping the build toolchain is a separate decision.Verification
yaml.safe_load.uses:in.github/resolves tonode24/docker/composite— nonode20remains.Per repo rules: no version bump, no
changelog.pyentry (CI-only change).