Update to Node 24 runtime and @actions/artifact v2.3#72
Open
Mitchell (mitchdz) wants to merge 3 commits into
Open
Update to Node 24 runtime and @actions/artifact v2.3#72Mitchell (mitchdz) wants to merge 3 commits into
Mitchell (mitchdz) wants to merge 3 commits into
Conversation
Bump action runtime from node20 to node24. Upgrade @actions/artifact from 2.0.0 to 2.3.x to support the new GitHub artifact backend used by upload-artifact/download-artifact v7. Signed-off-by: mdzurick <mitch_dz@hotmail.com>
Signed-off-by: mdzurick <mitch_dz@hotmail.com>
Signed-off-by: mdzurick <mitch_dz@hotmail.com>
Mitchell (mitchdz)
changed the title
Author
|
This is a massive PR entirely because of updating the node modules. I wouldn't blame you if you don't trust all of these binary file changes, so I urge making them yourself. My corresponding PR for matrix read cloudposse/github-action-matrix-outputs-read#42 is much more benign. |
Author
|
You are welcome to test my fork. I stole the name Of course, there is an accompanying |
This was referenced Jul 8, 2026
adityabagchi24
pushed a commit
to adityabagchi24/cuda-quantum
that referenced
this pull request
Jul 10, 2026
## Summary Fixes NVIDIA#4253. GitHub is deprecating Node.js 20 for Actions runners ([announcement](https://github.blog/changelog/2025-05-05-github-actions-deprecating-node20-on-actions-runners/)): - **June 2, 2026**: Node 24 becomes the default - **September 16, 2026**: Node 20 removed entirely This PR upgrades all GitHub Actions dependencies to their latest Node 24 releases across the workflows, and replaces the unmaintained cloudposse matrix-outputs actions with in-repo equivalents. ## Changes ### Docker actions | Action | From | To | Instances | |--------|------|----|-----------| | `docker/login-action` | `@v3` | `@v4` | 55 | | `docker/setup-buildx-action` | `@v3` | `@v4` | 23 | | `docker/build-push-action` | `@v5` | `@v7` | 20 | | `docker/metadata-action` | `@v5` | `@v6` | 10 | ### GitHub actions | Action | From | To | Instances | |--------|------|----|-----------| | `actions/upload-artifact` | `@v4` | `@v7` | 35 | | `actions/download-artifact` | `@v4` | `@v8` | 29 | | `actions/cache` (+ `/restore`, `/save`) | `@v4` | `@v6` | 19 | | `actions/github-script` | `@v7` | `@v9` | 7 | | `actions/setup-python` | `@v5` | `@v6` | 8 | | `actions/checkout` | `@v4` | `@v6` | 2 | | `actions/setup-node` | `@v4` | `@v6` | 1 | | `actions/setup-go` | `@v5` | `@v6` | 1 | ### Third-party actions | Action | From | To | Instances | |--------|------|----|-----------| | `peter-evans/create-or-update-comment` | `@v3` | `@v5` | 9 | | `peter-evans/slash-command-dispatch` | `@v3` | `@v5` | 1 | | `codecov/codecov-action` | `@v4` | `@v7` | 1 | ### Vendored matrix-outputs actions The `cloudposse/github-action-matrix-outputs-write`/`-read` actions (11 read + 7 write call sites) are unmaintained: the latest release internally runs `actions/download-artifact@v4` on Node 20, and Node 24 support PRs have been open since April with no response ([NVIDIA#72](cloudposse/github-action-matrix-outputs-write#72), and more since). They are replaced with independent, interface-compatible reimplementations at `.github/actions/matrix-outputs-write` and `.github/actions/matrix-outputs-read` (the originals are Apache-2.0; the reimplementation is interface-compatible but written fresh, built on official `actions/upload-artifact@v7`/`download-artifact@v8` plus dependency-free Node 24 scripts). Call sites are unchanged apart from the `uses:` line. The reimplementation also fixes two re-run flaws in the original design: - Artifacts are named deterministically (`matrix-outputs-<step>-<key>`) and uploaded with `overwrite: true`, so a re-run job replaces its previous upload instead of colliding with the immutable artifact or leaving a stale duplicate that gets merged on the read side. - The read action downloads only the artifacts matching its step name instead of every artifact of the run. Since local actions require the repository to be present, 12 aggregator jobs that previously used the remote actions without a checkout now start with a sparse checkout of `.github/actions`. ### Other fixes - `setup-precommit` now installs Go 1.24 (was 1.21): `license-eye` requires Go >= 1.23, and `setup-go@v6` sets `GOTOOLCHAIN=local`, so the toolchain no longer auto-upgrades like it did with v5. This fixes the license header check. ### Deliberately not upgraded - `actions/checkout` stays at `@v6` (already Node 24). `@v7.0.0` (June 18) blocks checking out fork PRs under `workflow_run`/`pull_request_target` triggers, which `deployments.yml` and `documentation.yml` rely on. - `sigstore/cosign-installer@v3.3.0` -- composite action, no Node dependency; pins cosign v2.2.2. - `github/codeql-action@v4` -- latest major, already Node 24. - `rojopolis/spellcheck-github-actions@0.30.0`, `gaurav-nelson/github-action-markdown-link-check@v1` -- Docker-based actions, no Node dependency. - `nv-gha-runners/setup-proxy-cache@main` -- internal action, separately managed. ### Known gap - `actions/delete-package-versions@v5` (7 instances) -- still Node 20, no Node 24 release exists yet. Will need upgrading when one ships (before the September 2026 deadline). ## Breaking change analysis - All upgraded actions require **Actions Runner v2.327.1+**. GitHub-hosted runners already satisfy this. Self-hosted runners (`nv-gha-runners`) must be at this version or newer. - `actions/download-artifact@v8` fails on digest mismatch by default (previously a warning) and no longer auto-unzips non-zipped downloads. No workflow relies on either behavior. - `actions/github-script@v9` is ESM-only; `require('@actions/github')` no longer works in scripts. Verified no script in this repo uses `require` or redeclares `getOctokit`. - `actions/setup-node@v6` limits automatic caching to npm. Not used; the workflows manage caches explicitly with `actions/cache`. - `docker/setup-buildx-action@v4` removed the deprecated `install` input. Verified no workflow uses it. - `docker/build-push-action@v7` removed the deprecated `DOCKER_BUILD_NO_SUMMARY` and `DOCKER_BUILD_EXPORT_RETENTION_DAYS` envs (not used). `DOCKER_BUILD_RECORD_UPLOAD` is still supported and remains set to `"false"` on all build-push steps to avoid uploading build record artifacts; with the vendored read action's scoped downloads these would no longer break matrix-outputs aggregation, but they remain pure noise. --------- Signed-off-by: mdzurick <mitch_dz@hotmail.com> Signed-off-by: mdzurick <mdzurick@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
what
node20tonode24inaction.yml@actions/artifactfrom^2.0.0to^2.3.0inpackage.jsonpackage-lock.jsonandnode_moduleswhy
@actions/artifact2.3.x is required for compatibility withactions/upload-artifact@v7andactions/download-artifact@v7, which use a newer artifact backend. The older 2.0.x SDK cannot produce artifacts thatdownload-artifact@v7can read, causing "Artifact download failed after 5 retries" errors in downstream consumers likegithub-action-matrix-outputs-read.references
Testing
I tested this version in our production workflow here :