Skip to content

ci: Update dependencies - #2119

Merged
marcleblanc2 merged 2 commits into
mainfrom
marc/deps/github-actions
Oct 30, 2026
Merged

marcleblanc2 merged 2 commits into
mainfrom
marc/deps/github-actions

Conversation

@marcleblanc2

@marcleblanc2 marcleblanc2 commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

Every job currently logs Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. This moves every action to its latest major.

Action From To Breaking changes between, and why they do not apply here
actions/checkout v4 v7 v5: Node 24. v6: credentials persisted to a separate file (v6.0.1 added includeIf support for the worktree that check-links, check-redirects, and check-duplicates each create); spellcheck-allow.yml's git push still uses them. v7: refuses to check out a fork head on pull_request_target and workflow_run; no workflow here uses either event
actions/setup-node v4 v7 v5: automatic cache when package.json has packageManager; v6: automatic cache limited to npm. algolia-index.yml sets cache: pnpm explicitly, the spelling workflows do not install anything. v7: ESM, new outputs
actions/github-script v7 v9 v8: Node 24. v9: require('@actions/github') no longer works and getOctokit is injected; preview-links.yml uses neither
pnpm/action-setup v4 v6 v5: Node 24. v6: pnpm 11 support

sourcegraph/actions/diff-tour@main already tracks main.

actionlint passes. The PR-check workflows run on this PR since their paths filters include their own workflow file, so the checkout and worktree steps are exercised here.

Direct dependency trim

npx knip --dependencies found one dead dependency: sharp. next lists sharp ^0.35.4 in its own optionalDependencies, so the devDependency only duplicated it; the lockfile still resolves sharp@0.35.5, now as an optional dependency of next. shiki stays: knip flags it, but it is a required peer of rehype-pretty-code. Its other flags (rehype-*, remark-gfm, unist-util-visit, glob) are knip not reading contentlayer.config.ts and dev/*.mjs.

@types/node, @types/react, @types/react-dom, and typescript move from dependencies to devDependencies. Vercel installs both, so what gets installed does not change.

Verified locally: pnpm install, pnpm run build, npx tsc --noEmit, pnpm run lint (8 pre-existing React Compiler warnings, 0 errors).

actions/checkout v4 -> v7, actions/setup-node v4 -> v7,
actions/github-script v7 -> v9, pnpm/action-setup v4 -> v6. The v4
actions still target Node 20, which the runners deprecate with a
warning on every job.

Amp-Thread-ID: https://ampcode.com/threads/T-01a11326-478d-72cf-bbb7-587d16b378e9
Co-authored-by: Amp <amp@ampcode.com>
@vercel

vercel Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
sourcegraph-docs Ready Ready Preview Oct 30, 2026 9:45pm UTC

Request Review

@github-actions

github-actions Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

@github-actions

This comment has been minimized.

…encies

next lists sharp as its own optional dependency, so the devDependency
only duplicated it. The type packages and typescript are build-time only.

Amp-Thread-ID: https://ampcode.com/threads/T-01a11326-478d-72cf-bbb7-587d16b378e9
Co-authored-by: Amp <amp@ampcode.com>
@marcleblanc2 marcleblanc2 changed the title ci: Update GitHub Actions to their latest major versions ci: Update dependencies Oct 30, 2026
@marcleblanc2
marcleblanc2 enabled auto-merge (squash) October 30, 2026 21:52
@marcleblanc2
marcleblanc2 requested review from a team and enriquegh October 30, 2026 21:52
@marcleblanc2
marcleblanc2 merged commit f8b261c into main Oct 30, 2026
13 checks passed
@marcleblanc2
marcleblanc2 deleted the marc/deps/github-actions branch October 30, 2026 23:50

This branch was successfully deployed

1 active deployment
Preview — 5c3bdb2e Deployed Oct 30, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants