ci: move checkout and setup-python off Node 20 before the fallback goes - #121
Merged
Conversation
Every job in this repo emits "Node.js 20 is deprecated ... being forced to run
on Node.js 24". That forced run is a TEMPORARY GitHub fallback; when it is
withdrawn, every job using these actions fails.
MEASURED from each tag's own action.yml, not from release prose:
checkout v4.x node20 v5.1.0 / v6.1.0 / v7.0.1 node24
setup-python v5.x node20 v6.0.0 / v6.3.0 / v7.0.0 node24
checkout needs v5+, setup-python v6+. v4.4.0 was published the same day as
v5.1.0/v6.1.0/v7.0.1 - the v4 line is maintained but stays on node20, so
waiting does not fix it.
WHY LATEST, NOT THE MINIMAL v5/v6 HOP: cli already ran exactly these two SHAs
before this sweep, so latest is proven in the org, and the fleet converges on
ONE pin per action instead of gaining a third variant. Neither v7 breaking
change applies - verified per repo, not assumed:
* setup-python v7 drops the `pip-install` input - unused anywhere in the org.
* checkout v7 blocks fork-PR checkout under pull_request_target/workflow_run
- every workflow's resolved triggers were parsed as YAML (not grepped, so a
comment naming a trigger cannot be mistaken for using one). No workflow in
this repo pairs those triggers with a checkout.
This also normalises the pin comments: some lines carried a bare `# v4`, which
is a mutable major alias in comment form and not the full-semver convention.
Scope here: 3 checkout + 0 setup-python lines across 3 file(s). Verified
with `git diff -U0` that no other line changed, and all workflows still parse.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
… sync Bugbot, High, and correct — this commit bumped `actions/checkout` to v7.0.1 in `sync-docs.yml` while leaving `peter-evans/create-pull-request` at v6.1.0 in the same file. Confirmed upstream rather than reasoned about: v7.0.9's release notes say "Fixes an incompatibility with the recently released `actions/checkout@v6`" (issue #4228, PR #4230). checkout v6+ writes credentials under `$RUNNER_TEMP`, and create-pull-request below v7.0.9 then sends a duplicate `Authorization` header and fails the "Open or update PR" step. That failure mode is the bad kind: a sync that never opens a PR files no complaint, so docs would simply have stopped tracking upstream, green. **v8, not v7.0.11**, and the distinction is this commit's whole point: v6.1.0 and v7.0.11 are BOTH `using: node20`, so the minimal compatibility bump would have fixed the clash and left behind exactly the runtime this change exists to remove. v8.0.0 is the first `node24` release. Its only breaking change is requiring Actions Runner v2.327.1+ on SELF-HOSTED runners; every job in this repo is GitHub-hosted, so it does not apply. The pin was verified, not copied: tags `v8.1.1` and `v8` both point at 5f6978faf089d4d20b00c7766989d076bb2fc7f1, and `action.yml` at that exact SHA reads `using: 'node24'`. Swept the other twelve PRs in this migration for the same shape — a file whose checkout was bumped that also pins create-pull-request, which the diff alone does not reveal because the cpr line is unchanged. `sync-docs.yml` is the only one. actionlint clean; YAML parses. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit cc5ab92. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the fleet-wide sweep tracked in tracebloc/backend#2004. Sibling of tracebloc/backend#2005, which is green.
Why
Every job in this repo emits:
The forced run is a temporary GitHub fallback. When it is withdrawn, every job using these two actions fails. Same defect class as tracebloc/backend#1816, which moved
add-to-projectoffusing: node20.Measured, from each tag's own
action.ymlRead
runs.usingat the tag rather than trusting release prose:using:node20node24node20node24checkout needs v5+, setup-python needs v6+. Note v4.4.0 was published 2026-07-20 alongside v5.1.0/v6.1.0/v7.0.1 — the v4 line is still maintained but stays on node20, so waiting does not fix this.
Why latest rather than the minimal v5/v6 hop
clialready ran exactly these two SHAs before this sweep, so latest is proven in the org, and the fleet converges on one pin per action instead of gaining a third variant.pip-installinput → unused anywhere in the org.pull_request_target/workflow_run→ every workflow's resolved triggers were parsed as YAML, not grepped, so a comment naming a trigger cannot be mistaken for using one. No workflow in this repo pairs those triggers with a checkout.This also normalises the pin comments: some lines carried a bare
# v4, which is a mutable major alias in comment form rather than the full-semver convention.Verification
git diff -U0inspected: onlyuses:lines changed, in either direction.github/workflows/checkoutandsetup-pythonno longer appear in the run's Node 20 deprecation annotation, with no other behavioural change.action.ymldeclaresusing: node20(actions/stale×1) — out of scope here, measured the same way (readruns.usingat the pinned SHA).quality / *jobs come fromcode-quality.yml@main, so their annotation also keeps naming the oldcheckoutpin until.githubpromotes develop → main. That is a sequencing artefact of the reusable, not a defect in this PR.Ordering
No sequencing constraint.
caller-drift.pybyte-compares only the entries markedcopies:inrepo-inventory.yml, and there are none fleet-wide — so these PRs may merge in any order, including.github.Note
Low Risk
Workflow pin and comment-only changes on GitHub-hosted runners; no app code or secrets handling logic changed beyond action versions.
Overview
Part of the org-wide move off Node 20 GitHub Actions before GitHub withdraws the forced Node 24 fallback.
actions/checkoutis pinned from v4.4.0 → v7.0.1 (full SHA) inpreview-page-coverage.yml,sdk-extras-check.yml, andsync-docs.ymlso those jobs use an action built for Node 24.In
sync-docs.yml,peter-evans/create-pull-requestgoes v6.1.0 → v8.1.1 in the same change set: newer checkout stores credentials under$RUNNER_TEMP, which breaks older create-pull-request (duplicateAuthorization), and v8 is the first create-pull-request release on Node 24. Inline comments document why both bumps must land together.Reviewed by Cursor Bugbot for commit cc5ab92. Bugbot is set up for automated code reviews on this repo. Configure here.