From 947bd2a1749f5714c51de995c07ca8bdaf7cf08f Mon Sep 17 00:00:00 2001 From: lukasWuttke <54042461+LukasWodka@users.noreply.github.com> Date: Sat, 15 Aug 2026 07:01:41 +0200 Subject: [PATCH] ci: move checkout and setup-python off Node 20 before the fallback goes (#121) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * ci: move checkout and setup-python off Node 20 before the fallback goes Every job in this repo emits "Node.js 20 is deprecated ... being forced to run on Node.js 24". That forced run is a TEMPORARY GitHub fallback; when it is withdrawn, every job using these actions fails. MEASURED from each tag's own action.yml, not from release prose: checkout v4.x node20 v5.1.0 / v6.1.0 / v7.0.1 node24 setup-python v5.x node20 v6.0.0 / v6.3.0 / v7.0.0 node24 checkout needs v5+, setup-python v6+. v4.4.0 was published the same day as v5.1.0/v6.1.0/v7.0.1 - the v4 line is maintained but stays on node20, so waiting does not fix it. WHY LATEST, NOT THE MINIMAL v5/v6 HOP: cli already ran exactly these two SHAs before this sweep, so latest is proven in the org, and the fleet converges on ONE pin per action instead of gaining a third variant. Neither v7 breaking change applies - verified per repo, not assumed: * setup-python v7 drops the `pip-install` input - unused anywhere in the org. * checkout v7 blocks fork-PR checkout under pull_request_target/workflow_run - every workflow's resolved triggers were parsed as YAML (not grepped, so a comment naming a trigger cannot be mistaken for using one). No workflow in this repo pairs those triggers with a checkout. This also normalises the pin comments: some lines carried a bare `# v4`, which is a mutable major alias in comment form and not the full-semver convention. Scope here: 3 checkout + 0 setup-python lines across 3 file(s). Verified with `git diff -U0` that no other line changed, and all workflows still parse. Co-Authored-By: Claude Opus 5 * ci(sync-docs): create-pull-request v8, or this commit breaks the docs sync Bugbot, High, and correct — this commit bumped `actions/checkout` to v7.0.1 in `sync-docs.yml` while leaving `peter-evans/create-pull-request` at v6.1.0 in the same file. Confirmed upstream rather than reasoned about: v7.0.9's release notes say "Fixes an incompatibility with the recently released `actions/checkout@v6`" (issue #4228, PR #4230). checkout v6+ writes credentials under `$RUNNER_TEMP`, and create-pull-request below v7.0.9 then sends a duplicate `Authorization` header and fails the "Open or update PR" step. That failure mode is the bad kind: a sync that never opens a PR files no complaint, so docs would simply have stopped tracking upstream, green. **v8, not v7.0.11**, and the distinction is this commit's whole point: v6.1.0 and v7.0.11 are BOTH `using: node20`, so the minimal compatibility bump would have fixed the clash and left behind exactly the runtime this change exists to remove. v8.0.0 is the first `node24` release. Its only breaking change is requiring Actions Runner v2.327.1+ on SELF-HOSTED runners; every job in this repo is GitHub-hosted, so it does not apply. The pin was verified, not copied: tags `v8.1.1` and `v8` both point at 5f6978faf089d4d20b00c7766989d076bb2fc7f1, and `action.yml` at that exact SHA reads `using: 'node24'`. Swept the other twelve PRs in this migration for the same shape — a file whose checkout was bumped that also pins create-pull-request, which the diff alone does not reveal because the cpr line is unchanged. `sync-docs.yml` is the only one. actionlint clean; YAML parses. Co-Authored-By: Claude Opus 5 --------- Co-authored-by: Claude Opus 5 --- .github/workflows/preview-page-coverage.yml | 2 +- .github/workflows/sdk-extras-check.yml | 2 +- .github/workflows/sync-docs.yml | 19 +++++++++++++++++-- 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/.github/workflows/preview-page-coverage.yml b/.github/workflows/preview-page-coverage.yml index 32c7950..b79cda3 100644 --- a/.github/workflows/preview-page-coverage.yml +++ b/.github/workflows/preview-page-coverage.yml @@ -62,7 +62,7 @@ jobs: matrix: env: ${{ fromJSON(needs.resolve-env.outputs.matrix) }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Wait for Mintlify to deploy (push events only) if: github.event_name == 'push' diff --git a/.github/workflows/sdk-extras-check.yml b/.github/workflows/sdk-extras-check.yml index 1756393..de4554e 100644 --- a/.github/workflows/sdk-extras-check.yml +++ b/.github/workflows/sdk-extras-check.yml @@ -44,7 +44,7 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Validate documented extras against PyPI run: python3 scripts/check-sdk-extras.py diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml index 6db95f6..2148b89 100644 --- a/.github/workflows/sync-docs.yml +++ b/.github/workflows/sync-docs.yml @@ -44,7 +44,7 @@ jobs: YQ_VERSION: "4.44.3" YQ_SHA256: "a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7" steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -195,7 +195,22 @@ jobs: - name: Open or update PR if: steps.filter.outputs.count != '0' - uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0 + # v8, and BOTH halves of that are load-bearing. + # + # Compatibility: checkout v6+ writes its credentials under $RUNNER_TEMP, + # and create-pull-request before v7.0.9 then sends a duplicate + # `Authorization` header and fails this step outright + # (peter-evans/create-pull-request#4228, fixed by #4230). Bumping checkout + # to v7.0.1 in this commit while leaving v6.1.0 here would have stopped + # the docs sync opening or updating PRs at all — silently, since a sync + # that never runs files no complaint (Bugbot). + # + # Runtime: v7.0.11 fixes the clash but is still `using: node20`, so it + # would have failed THIS commit's whole purpose. v8.0.0 is the first + # `node24` release. Its only breaking change is requiring Actions Runner + # v2.327.1+ on SELF-HOSTED runners; every job in this repo is + # GitHub-hosted, so it does not apply here. + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: base: ${{ steps.setup.outputs.base }} branch: docs/sync-upstream