From 9c33f09966b221b7e6625d9920531e00c331454c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 13:10:20 +0000 Subject: [PATCH 1/3] ci: bump the actions group across 1 directory with 2 updates Bumps the actions group with 2 updates in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/release.yml | 2 +- .github/workflows/stage-release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 900495f..18ae0cc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -205,7 +205,7 @@ jobs: - name: Upload unsigned build artifact if: steps.v.outputs.go_release == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: unsigned-release-${{ github.ref_name }} path: | diff --git a/.github/workflows/stage-release.yml b/.github/workflows/stage-release.yml index 2c00ae9..27af314 100644 --- a/.github/workflows/stage-release.yml +++ b/.github/workflows/stage-release.yml @@ -86,7 +86,7 @@ jobs: || { echo "tag commit is not contained in main" >&2; exit 1; } - name: Download gated unsigned artifact - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: unsigned-release-${{ github.event.workflow_run.head_branch }} path: dist From 162414b62ff098c50e9ecd35248c670d28a39b71 Mon Sep 17 00:00:00 2001 From: "XXV.CC" Date: Mon, 27 Jul 2026 21:19:18 +0800 Subject: [PATCH 2/3] docs: record v2.8.2 release audit stop --- .github/workflows/mirror-release.yml | 2 +- CHANGELOG.md | 8 ++++++++ docs/releasing.md | 18 +++++++++--------- 3 files changed, 18 insertions(+), 10 deletions(-) diff --git a/.github/workflows/mirror-release.yml b/.github/workflows/mirror-release.yml index da91d27..f3db0bf 100644 --- a/.github/workflows/mirror-release.yml +++ b/.github/workflows/mirror-release.yml @@ -6,7 +6,7 @@ on: workflow_dispatch: inputs: tag: - description: Immutable release tag to mirror, for example v2.8.2 + description: Immutable release tag to mirror, for example v2.8.3 required: true type: string diff --git a/CHANGELOG.md b/CHANGELOG.md index 6e25ec5..b06edb9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,14 @@ All notable changes to this project are documented here. +## v2.8.3 - 2026-07-27 + +- Run the release artifact handoff on the official actions' native Node.js 24 + versions. The signed `v2.8.2` tag exposed the upload action's Node.js 20 + deprecation warning after the read-only gate produced an unsigned artifact; + its unsigned draft was deliberately removed before release signing or + publication, and no published v2.8.2 assets exist. + ## v2.8.2 - 2026-07-27 - Serialize root integration test packages because they share the host account diff --git a/docs/releasing.md b/docs/releasing.md index cd95749..64e08e1 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -422,10 +422,10 @@ git -c user.name='XXV.CC' \ -c user.signingkey="${TAG_SIGNING_FPR}!" \ -c gpg.format=openpgp \ -c gpg.program=/usr/bin/gpg \ - tag -s v2.8.2 "$RELEASE_COMMIT" -m 'linux-temp-admin v2.8.2' + tag -s v2.8.3 "$RELEASE_COMMIT" -m 'linux-temp-admin v2.8.3' git -c gpg.format=openpgp -c gpg.program=/usr/bin/gpg \ - verify-tag --raw v2.8.2 -git push origin v2.8.2 + verify-tag --raw v2.8.3 +git push origin v2.8.3 ``` Before pushing, the `VALIDSIG` record from `verify-tag --raw` must identify the @@ -489,7 +489,7 @@ printf '\n' >/dev/tty || fail "GH_TOKEN must be one non-empty token without whitespace" export GH_TOKEN exec /opt/lta-release-tools/prepare-release.sh \ - v2.8.2 /srv/linux-temp-admin /srv/release-transfer/v2.8.2-prepared + v2.8.3 /srv/linux-temp-admin /srv/release-transfer/v2.8.3-prepared LTA_PREPARE_RELEASE ``` @@ -509,7 +509,7 @@ the candidate or transfer media: LTA_SIGN_KEY=/offline/keys/release-v1.key LTA_TRUSTED_SIGNER=/opt/lta-release-tools/lta-release LTA_TRUSTED_SIGNER_SHA256='' -LTA_EXPECTED_TAG=v2.8.2 +LTA_EXPECTED_TAG=v2.8.3 LTA_EXPECTED_COMMIT='' LTA_EXPECTED_PREPARED_MANIFEST_SHA256='' LTA_EXPECTED_RELEASE_SIGNER_PUBKEY='' @@ -521,7 +521,7 @@ LTA_EXPECTED_RELEASE_SIGNER_PUBKEY='/dev/tty || fail "GH_TOKEN must be one non-empty token without whitespace" export GH_TOKEN exec /opt/lta-release-tools/publish-release.sh \ - /srv/release-transfer/v2.8.2-signed /srv/linux-temp-admin + /srv/release-transfer/v2.8.3-signed /srv/linux-temp-admin LTA_PUBLISH_RELEASE ``` @@ -637,7 +637,7 @@ noncanonical published stable tag, excludes the failed `TAG`, and verifies the exact resulting Latest state: ```bash -TAG=v2.8.2 # the failed release; verify this value before running +TAG=v2.8.3 # the failed release; verify this value before running /usr/bin/sudo /usr/bin/env -i \ HOME=/root PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin LC_ALL=C \ TAG="$TAG" /bin/bash -p <<'LTA_LATEST_RECOVERY' @@ -996,7 +996,7 @@ the release audit/signing record and a separate authenticated channel, then run: ```bash INSTALLER_COMMIT='replace-with-the-audited-40-hex-commit' INSTALLER_SHA256='replace-with-the-independent-64-hex-script-hash' -LTA_RELEASE_TAG='v2.8.2' +LTA_RELEASE_TAG='v2.8.3' /usr/bin/sudo /usr/bin/env -i \ HOME=/root PATH=/usr/sbin:/usr/bin:/sbin:/bin LC_ALL=C \ INSTALLER_COMMIT="$INSTALLER_COMMIT" INSTALLER_SHA256="$INSTALLER_SHA256" \ From d02601e5489eb00d12d7945e4ec6aea06085fd71 Mon Sep 17 00:00:00 2001 From: "XXV.CC" Date: Mon, 27 Jul 2026 21:20:44 +0800 Subject: [PATCH 3/3] test: pin audited Node.js 24 artifact actions --- internal/selfmanage/release_pipeline_test.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/internal/selfmanage/release_pipeline_test.go b/internal/selfmanage/release_pipeline_test.go index 6ec0543..c3514ad 100644 --- a/internal/selfmanage/release_pipeline_test.go +++ b/internal/selfmanage/release_pipeline_test.go @@ -92,6 +92,22 @@ func TestReleaseWriterIsSeparatedFromCandidateWorkflow(t *testing.T) { } } +func TestReleaseArtifactHandoffUsesAuditedNode24Actions(t *testing.T) { + release := readReleaseFile(t, "../../.github/workflows/release.yml") + stage := readReleaseFile(t, "../../.github/workflows/stage-release.yml") + for name, check := range map[string]struct { + content string + pin string + }{ + "upload": {release, "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1"}, + "download": {stage, "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1"}, + } { + if !strings.Contains(check.content, check.pin) { + t.Errorf("release %s action is not pinned to the audited native Node.js 24 version", name) + } + } +} + func TestMirrorReleaseWorkflowPublishesVerifiedImmutableContentFailClosed(t *testing.T) { mirror := readReleaseFile(t, "../../.github/workflows/mirror-release.yml") installer := readReleaseFile(t, "../../scripts/install.sh")