release-train: develop -> staging - #727
Merged
Merged
Conversation
…es (#721) Every job in this repo emits "Node.js 20 is deprecated ... being forced to run on Node.js 24". That forced run is a TEMPORARY GitHub fallback; when it is withdrawn, every job using these actions fails. MEASURED from each tag's own action.yml, not from release prose: checkout v4.x node20 v5.1.0 / v6.1.0 / v7.0.1 node24 setup-python v5.x node20 v6.0.0 / v6.3.0 / v7.0.0 node24 checkout needs v5+, setup-python v6+. v4.4.0 was published the same day as v5.1.0/v6.1.0/v7.0.1 - the v4 line is maintained but stays on node20, so waiting does not fix it. WHY LATEST, NOT THE MINIMAL v5/v6 HOP: cli already ran exactly these two SHAs before this sweep, so latest is proven in the org, and the fleet converges on ONE pin per action instead of gaining a third variant. Neither v7 breaking change applies - verified per repo, not assumed: * setup-python v7 drops the `pip-install` input - unused anywhere in the org. * checkout v7 blocks fork-PR checkout under pull_request_target/workflow_run - every workflow's resolved triggers were parsed as YAML (not grepped, so a comment naming a trigger cannot be mistaken for using one). No workflow in this repo pairs those triggers with a checkout. This also normalises the pin comments: some lines carried a bare `# v4`, which is a mutable major alias in comment form and not the full-semver convention. Scope here: 26 checkout + 0 setup-python lines across 9 file(s). Verified with `git diff -U0` that no other line changed, and all workflows still parse. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit ca86b2c. Configure here.
tracebloc-release-train
Bot
added
gate-nudge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion by the release train (RFC-0008 D14). Head is the train-managed
release-train/to-stagingbranch (a mirror ofdevelop), so it never collides with a human PR. Merged only when the fr-gate is green.Note
Low Risk
Mechanical third-party action pin bump in CI only; no application, auth, or release logic changes.
Overview
Pins
actions/checkoutto commit3d3c42e5aac5ba805825da76410c181273ba90b1(v7.0.1) everywhere it appears under.github/workflows/, replacing older v4 / v4.4.0 SHAs.Touched workflows include Helm CI, installer tests, drift/digest guards, standard checks, Windows e2e, k3s-cuda build, and release-helm-chart (including verify, release, sign-installer-manifest, and verify-index jobs). No job logic, triggers, or permissions change—only the checkout action reference.
Reviewed by Cursor Bugbot for commit ca86b2c. Bugbot is set up for automated code reviews on this repo. Configure here.