ci: move every action off the deprecated Node 20 runtime - #320
Merged
ralyodio merged 1 commit intoAug 6, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
GitHub is forcing Node 20 actions onto Node 24 and annotating every run that
uses one. The publish workflow named three, but the same actions are pinned
across ci, test and threatcrush-scan, and two more there — upload-artifact@v4
and github-script@v7 — are on node20 as well, along with codeql-action@v3.
actions/checkout v4 -> v7
actions/setup-node v4 -> v7
pnpm/action-setup v4 -> v6
actions/upload-artifact v4 -> v7
actions/github-script v7 -> v9
codeql-action/upload-sarif v3 -> v4
Every target confirmed `runs.using: node24` before bumping, rather than assumed
from the version number — codeql-action v3 is node20 and v4 is not, which the
deprecation notice does not mention.
Two breaking changes were checked against actual usage rather than skipped:
setup-node v5 added automatic caching driven by the `packageManager` field and
v6 narrowed it to npm. Every caller here passes `cache: pnpm` explicitly, so
the automatic path is never consulted, and pnpm/action-setup already runs first
in all three workflows — which explicit pnpm caching requires.
github-script v9 makes `require('@actions/github')` fail, since that package is
now ESM-only. The one script here requires `fs` and uses the injected `github`
client, neither of which is affected; v9's own README still documents `require`
for builtins and local modules.
Not fixed here: profullstack/coinpaybot@v0 is also node20 and has no newer tag,
so coinpay.yml keeps warning until that action is rebuilt in its own repo.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Copy link
Copy Markdown
ThreatCrush Security Scan93 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 43
…and 43 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
Sorry, something went wrong.
Merged
ralyodio
added a commit
that referenced
this pull request
Aug 8, 2026
Bump to v0.27.0, releasing `/crypto` — crypto market data from advis0r.com as a CLI verb, a pit command, and a second Claude Code plugin (#322) — alongside two commits that have been sitting on main unreleased: the compact() carry fix for `ticker` (#321) and the move off the deprecated Node 20 runtime (#320). Minor rather than patch: it adds a command and a plugin, and changes no existing one. As with v0.26.0 and `ticker`, the release is what makes the plugin's primary path work. install.sh serves the latest release tarball, not main, so until a release carries it every installed binary answers `unknown command "crypto"` and the plugin's slash commands fall back to curl — which works, but skips the rendering the verb exists to do. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Kills the Node 20 deprecation annotation that every workflow run has been carrying.
What changed
The publish annotation named three actions, but the same pins appear across ci.yml, test.yml and threatcrush-scan.yml, and threatcrush-scan.yml carries two more on node20 plus codeql-action v3. Fixing only the one that shouted would have left the warning everywhere else.
Every target was confirmed runs.using: node24 by reading its action.yml rather than inferred from the version number — worth doing, because codeql-action v3 is node20 and v4 is not, and the deprecation notice never mentions it.
Breaking changes, checked rather than skipped
setup-node v5 added automatic caching driven by packageManager, and v6 narrowed that to npm only. Every caller here passes cache: pnpm explicitly, so the automatic path is never consulted. Explicit pnpm caching also requires pnpm on PATH first, and pnpm/action-setup already runs before setup-node in all three workflows.
github-script v9 makes require('@actions/github') fail — that package is now ESM-only. The single script in threatcrush-scan.yml requires fs and uses the injected github client; neither is affected, and v9's README still documents require for builtins and local modules.
upload-artifact v7 adds an opt-in archive parameter; name/path/retention-days are unchanged.
One comment update
publish.yml documents an OIDC trap from #305/#309/#311 — setup-node exporting a dummy NODE_AUTH_TOKEN that corrupted .npmrc and stopped npm attempting the token exchange. setup-node v7 removes exactly that (actions/setup-node#1558), so the comment now says so. It doesn't change the token path we're on, but it means trusted publishing deserves a third attempt before npm's 2FA-bypass deprecation forces one.
Not fixed here
profullstack/coinpaybot@v0 is also node20 and has no newer tag, so coinpay.yml will keep warning until that action is rebuilt and re-tagged in its own repo.
Verification
Full suite green (1142 passing, 0 failing) and all five workflow files parse. The real proof is this PR's own checks — ci, test and threatcrush all run the bumped actions, so a green run here is the annotation being gone.
🤖 Generated with Claude Code