[AustinBenoit]

Why

GitHub is forcing actions that declare Node.js 20 to run on Node.js 24, producing warnings like:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a1…, actions/upload-artifact@ea165f8…

See https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/. An audit of every uses: in this repo showed almost all pins were on node16/node20 releases, not just the two in the warning.

What

1. Bump every pinned action to its latest release (all runs.using: node24). Full-SHA pins with # ratchet: version comments are kept, matching the existing convention. Each new SHA's action.yml was verified to declare node24.

Action	Before → After
actions/checkout	v3 → v7
actions/upload-artifact	v4 → v7
actions/download-artifact	v4 → v8
actions/setup-python	v4 → v7
actions/setup-java	v3 / v4 → v6
actions/setup-node	v3 → v7
actions/cache	v3 → v6
actions/create-github-app-token	v3.2 → v3.3
nick-invision/retry	v2 → nick-fields/retry v4 (repo was renamed)
microsoft/setup-msbuild	v1.1 → v3
geekyeggo/delete-artifact	v2 → v6
styfle/cancel-workflow-action	0.8.0 → 0.13.1
FirebaseExtended/github-actions/firebase-test-lab	v1.4 → v1.5 (its nested auth/setup-gcloud are now node24 and SHA-pinned)

2. Replace unmaintained node12 actions that have no Node.js 24 release with equivalent gh CLI steps (same tokens and permissions, no third-party code to pin):

Removed action	Replacement
scherermichael-oss/action-has-permission (checks_secure.yml)	gh api repos/…/collaborators/$ACTOR/permission → sets has-permission output
lannonbr/repo-permission-check-action (integration_tests.yml)	same API call, fails unless admin
andymckay/cancel-action	gh run cancel $GITHUB_RUN_ID
actions-ecosystem/action-add-labels	gh api POST repos/…/issues/$PR/labels
buildsville/add-remove-label	gh pr edit --remove-label
KhannaAbhinav/random-selector-action + itsOliverBott/assign-pr-reviewers	jq … | shuf -n 1 + gh api POST repos/…/pulls/$PR/requested_reviewers

3. Remove update-custom-runner.yml. It targeted self-hosted macOS runners (fplmac1, fplmac2) that are no longer registered (the repo has zero self-hosted runners), was workflow_dispatch-only with no run history, and was never functional: its if: reads github.event.input (singular — not a real context) so the job was always skipped, and its steps only echo their commands.

Breaking-change review

Release notes for each major bump were checked against actual usage:

• download-artifact v5 path change only affects artifact-ids downloads — not used here (all downloads are by name, incl. the cross-run run-id ones).
• download-artifact v8 now errors on digest mismatch by default (previously a warning).
• checkout v6 stores credentials in $RUNNER_TEMP instead of .git/config; nothing in the repo reads extraheader from git config. v7 refuses fork-PR checkout under pull_request_target, but checks_secure.yml checks out the default (base) ref, so it is unaffected.
• setup-python v7 removed pip-install, setup-java v6 renamed jdkFile, setup-node v6 limited auto-caching to npm — none used.
• nick-fields/retry v4 has the same inputs as v2.

Validation

• All workflow YAML parses; every remaining non-local uses: resolves to a node24 (or composite/docker) action.
• zizmor findings dropped from 66 to 13 on main → this branch; the remaining 13 are pre-existing ref-version-mismatch on lukka/get-cmake@latest (already node24, left as-is).
• Node 24 actions require Actions Runner ≥ 2.327.1; all jobs run on GitHub-hosted runners, which already satisfy this.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[github-actions]

❌  Integration test FAILED

Requested by @AustinBenoit on commit d942bf4
Last updated: Fri Oct 23 13:48 PDT 2026
View integration test log & download artifacts

Failures	Configs
app_check	[TEST] [FAILURE] [iOS] [macos] [1/2 ios_device: simulator_target] (1 failed tests)   FirebaseAppCheckTest.TestGetTokenForcingRefresh
firestore	[TEST] [FLAKINESS] [iOS] [macos] [1/2 ios_device: ios_target] (1 failed tests)   ServerTimestampTest.TestServerTimestampsCanRetainPreviousValueThroughConsecutiveUpdates
installations	[TEST] [FLAKINESS] [Android] [1/3 os: macos] [1/2 android_device: emulator_ftl_target] (1 failed tests)   FirebaseInstallationsTest.TestCanGetToken

Add flaky tests to go/fpl-cpp-flake-tracker

[AustinBenoit]

Workflow verification on this branch ✅ complete

Every workflow touched by this PR was exercised on update-actions-node24 (PR triggers, labels, and manual workflow_dispatch). Node 24 deprecation warnings are gone from all of these runs.

Workflow	How triggered	Run	Status
Android Builds	pull_request	39969435870	✅ pass
iOS Builds	pull_request	39969435810	✅ pass
Lint	pull_request	39969436242	✅ pass
Checks	pull_request / labeled	39969533899	✅ pass
CodeQL (Analyze ×4)	pull_request	39969433900	✅ pass (see note 1)
GitHub Actions Scan (zizmor)	pull_request_target	39969436250	✅ pass
Reviewer Roulette	reviewer-roulette label	40000769625	✅ pass — new gh steps removed the label and requested a reviewer
Integration tests (self-cancel path)	non-test label	39969533939	✅ behaved as designed — gh run cancel replacement cancelled the run, same as the old action
Integration tests (quick)	tests-requested: quick label	40000774395	19 of 20 jobs ✅ — check_and_prepare passed (new admin-permission check ✅; styfle/cancel-workflow-action@0.13.1 cancelled the superseded run 40000769713 ✅). Only test-ios-macos-26-simulator_target-gameloop fails, on the known-flaky FirebaseAppCheckTest.TestGetTokenForcingRefresh (note 3)
Desktop Builds	pull_request	39969435816	✅ all 10 jobs pass (Linux x86 jobs needed re-runs for the apt-mirror flake, note 2)
CPP binary SDK packaging	workflow_dispatch	40000740534	✅ pass — all 31 jobs incl. create-windows-only-package (the job from the original warning), cleanup-packaging-artifacts (geekyeggo/delete-artifact@v6) and trigger_integration_tests (create-github-app-token@v3 → dispatched the run below)
Integration tests — chained, dispatched by firebase-workflow-trigger[bot] against the packaged SDK	via packaging above	40034553992	20 of 22 jobs ✅ — check_and_prepare ✅ with the permission check correctly skipped for the bot actor (note 4); summarize-results ✅ (create-github-app-token@v3 with pull-requests:write). The 2 failures are single App Check SDK tests (note 5)
Update Android and iOS dependencies	workflow_dispatch	40000761523	✅ pass — create-github-app-token@v3 + checkout/push path OK; no dependency changes detected so no PR was created (label step correctly skipped)
Generate Test Report Table	workflow_dispatch	40000745628	✅ pass
Retry Test Failures	workflow_dispatch (run_id=39969435816)	40000750666, 40017130124	✅ pass — second run (run_id=40000774395) performed a real retry: it re-ran the two failed test jobs as attempt 2, and test-tvos-macos-26-tvos_simulator passed on retry
Update Feature Branches	workflow_dispatch	40000756176	✅ pass (no feature_branch/* branches exist, merge job correctly skipped)
Checks (secure)	pull_request_target: synchronize	—	⏭️ not testable pre-merge: pull_request_target always runs the workflow file from main, so the new permission step only takes effect after merge

Notes

1. The "CodeQL — 1 high" status on this PR is alert #2633 (actions/cache-poisoning/direct-cache in integration_tests.yml), which is already open on main. It is flagged here only because the actions/cache line moved; nothing about the cache usage changed.

2. The Linux x86 desktop jobs hit the pre-existing apt-mirror flake (Release passed on the 2nd run, Debug on the 3rd): Install Desktop SDK prerequisites normally takes ~1 min but intermittently exceeds the 15-min nick-fields/retry timeout, at which point the retry action crashes with kill EPERM trying to kill the root-owned sudo apt process (same code path in v2 and v4). The same failure hit #39825804202 on the ab-14_1_0-update PR yesterday. Not related to this change; a follow-up could raise timeout_minutes for that step.

3. FirebaseAppCheckTest.TestGetTokenForcingRefresh on the iOS/tvOS simulators is a known flaky SDK test, unrelated to CI actions: it is listed in today's nightly report ([C++] Nightly Integration Testing Report #1859, failed 5× on iOS from main), and test-ios-…-simulator_target-gameloop has failed on ~1 in 3 integration runs on main over the past week (e.g. 39928695935, 39881514960, 39852599368). It passed on tvOS on retry; the iOS failure is left as-is rather than re-running again.

4. Permission check tightened in dc44663. Exercising the same change in firebase-unity-sdk (Update GitHub Actions to Node.js 24 releases firebase-unity-sdk#1552) showed the bot-dispatched integration run (packaging → integration_tests.yml) fails the new gh api …/collaborators/$ACTOR/permission step, because firebase-workflow-trigger[bot] is not a collaborator. The old lannonbr/repo-permission-check-action turned out to be a silent no-op (it reads its input as permision, a typo, so the required level was never set; 404s for non-collaborators were unhandled and never failed the step). The check is now skipped for bot actors (they already need actions:write to dispatch) and scheduled runs, and accepts write or admin so write-level team members can still trigger tests. Verified on the chained run 40034553992: actor firebase-workflow-trigger[bot], step skipped, run proceeds.

5. Chained-run failures are one SDK test each, not CI: test-tvos-macos-26-tvos_simulator → FirebaseAppCheckTest.TestGetTokenForcingRefresh (the known flake from note 3), and test-desktop-windows-2022-x64-boringssl → FirebaseAppCheckTest.TestDatabaseCreateWorkingPath (same App Check family; that job passed 7/7 on main this past week and passed in this PR's from-source run 40000774395, and the packaged SDK downloaded, built and ran the rest of the suite fine). Not re-running.