Repository navigation
CI: pinned actions still target deprecated Node.js 20 #1588
Description
Problem
Every job that uses these pinned actions logs a warning saying it targets Node.js 20 and is being forced to run on Node.js 24. For example, see nightly job 115703085274 in run 38518420487:
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a1…, actions/setup-python@a26af69…
The forced run works today. When GitHub drops Node 20 action support altogether, these legs break at once across the PR, merge_group, nightly and release workflows.
| Pin | Uses | Workflows |
|---|---|---|
actions/download-artifact@d3f86a1… # v4 |
20 | ci.yml, *-compatibility.yml, release.yml |
actions/setup-node@49933ea… # v4 |
15 | same set |
actions/setup-python@a26af69… # v5 |
9 | same set |
actions/upload-artifact@ea165f8… # v4 |
5 | same set |
Affected files: ci.yml, release.yml, and the vlt, sbt, pnpm, bun, gradle, pdm, npm and poetry compatibility workflows. One step already uses actions/setup-node@48b55a0… # v6.4.0, so that pin is already trusted in this repo.
Proposed fix
Move each pin to the newest release that runs on Node 24, by full commit SHA with a # vX.Y.Z comment. Review each release's breaking changes before bumping:
- setup-node v5 and later turn on caching automatically when
packageManageris npm. - download-artifact v5 and later change the extraction path when downloading by artifact ID.
Do the bump in one PR and run every compatibility workflow on it.
Why the CI janitor didn't open the PR
This routine's GitHub access covers only this repo, so it can't resolve or check the release SHAs of the upstream actions. It won't push unverified pins. Someone with access to the upstream repos, or Dependabot or Renovate, should resolve the SHAs.
Generated by Claude Code
Activity
mikolalysenko commentedon Oct 15, 2026
[agent] Claiming this issue (shared root cause: CI actions pinned to Node 20 releases). Scope: ci.yml and the two composite artifact actions. release.yml (off-limits to agents) and the disabled *-compatibility.yml workflows stay for a human. Branch: agent/fix-ci-node24-action-pins. Claim-ID: 2026-10-15T19:50:40Z-07e1ec
Generated by Claude Code
mikolalysenko commentedon Oct 15, 2026
[agent] Draft PR: #1590. It covers ci.yml and the artifact composites. release.yml still pins Node 20 actions and needs a human; the same SHAs listed in the PR apply.
Generated by Claude Code
mikolalysenko commentedon Oct 20, 2026
[agent] Re-verified on
origin/main@14eee88. #1590 (merged 10-17) moved every pin inci.ymland the two artifact composites to Node 24 releases. The only Node 20 pins left are:release.yml:199andrelease.yml:206(actions/upload-artifact@ea165f8… # v4) andrelease.yml:254(actions/download-artifact@d3f86a1… # v4). Agents may not edit release/publish workflows, so this needs a maintainer. The drop-in pins from CI: move action pins off deprecated Node 20 (#1588) #1590 areactions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0; for upload, use the Node 24upload-artifactrelease (v6+) after checking its inputs.actions/download-artifact … # v4in the disabled*-compatibility.ymlworkflows (bun, gradle, npm, pdm, pnpm, poetry, sbt, vlt). They don't run, so they cost nothing today; bump them if a workflow is ever re-enabled.Releasing the agent claim and handing the release.yml part to a human.
Generated by Claude Code