Bump the GitHub Actions pinned to Node 20 runtimes - #2
Merged
Conversation
The verify run warned that actions/cache@v4 and actions/checkout@v4 target Node.js 20 and were being forced onto Node 24. Bumped to current majors, and took the two Pages actions along since they were behind as well: actions/checkout v4 -> v7 actions/cache v4 -> v6 actions/upload-pages-artifact v3 -> v5 actions/deploy-pages v4 -> v5 Left alone because they are already on their current major and were not in the deprecation warning: taiki-e/install-action@v2, baptiste0928/cargo-install@v3, and dtolnay/rust-toolchain@stable (a moving tag is that action's documented usage). Release notes read rather than bumped blind; two behaviour changes needed handling, and one did not apply: - upload-pages-artifact@v4 stopped including dotfiles. Set include-hidden-files: true so this bump publishes byte-identically to before instead of quietly changing a live site — mdbook emits .nojekyll, and src="." drags stray .gitignore files in. (Actions-based Pages never runs Jekyll, so .nojekyll is almost certainly inert; proving that is a separate change.) The input excludes .git and .github regardless, so it cannot over-share. - deploy-pages has resolved artifacts by id since v4 and documents actions:read as required. It works without it today, but that is undocumented behaviour to be leaning on, so the deploy job now asks for that one read-only scope. - checkout@v7 blocks fork-PR checkout for pull_request_target and workflow_run. Neither is used here; this repo's workflows trigger on pull_request. checkout@v5+ and cache@v5+ need runner >= 2.327.1, which ubuntu-latest is well past. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1, which surfaced this warning on every run:
actions/checkoutactions/cacheactions/upload-pages-artifactactions/deploy-pagesUnchanged, because they are already on their current major and were not in the deprecation warning:
taiki-e/install-action@v2,baptiste0928/cargo-install@v3,dtolnay/rust-toolchain@stable(a moving tag is that action's documented usage).Behaviour changes handled
I read the release notes rather than bumping blind. Three mattered:
upload-pages-artifact@v4stopped including dotfiles. The book contains.nojekyll(mdbook writes it) plus stray.gitignorefiles thatsrc = "."drags in. Setinclude-hidden-files: trueso this bump publishes byte-identically to before rather than quietly changing a live site. Pages deployed via Actions never runs Jekyll, so.nojekyllis almost certainly inert here — but demonstrating that is a separate change from bumping a version. Verified against the action definition that this input excludes.git/.githubregardless, so it cannot over-share.deploy-pageshas resolved artifacts by id since v4 and documentsactions: readas required. It works without it today, but that is undocumented behaviour to lean on, so the deploy job now requests that one read-only scope.checkout@v7blocks fork-PR checkout forpull_request_targetandworkflow_run. Neither is used here — these workflows trigger onpull_request— so it does not apply.checkout@v5+andcache@v5+require runner ≥ 2.327.1;ubuntu-latestis well past it.Test plan
The workflows test themselves. What to look for:
verifyrestores the cache saved by Repo-wide audit: rebuild the measurement spine, backfill the conventions #1's final run rather than compiling 45 crates cold — the first chance to confirm that fix end to end18-gpustill reports SKIP, not FAILbuildpasses anddeploystill skips on a PR🤖 Generated with Claude Code