Skip to content

Bump GitHub Actions to Node 24 runtimes#240

Merged
diolektor merged 1 commit into
mainfrom
chore/actions-node24-bump
Jun 23, 2026
Merged

Bump GitHub Actions to Node 24 runtimes#240
diolektor merged 1 commit into
mainfrom
chore/actions-node24-bump

Conversation

@diolektor

@diolektor diolektor commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

What and why

GitHub is deprecating Node.js 20 on its runners — actions declared as node20 are force-run on Node 24 with a warning. This bumps every Node-based action to the lowest major that defaults to the Node.js 24 runtime so the warning goes away.

Changes

Action Before → After
actions/checkout v4 → v5
actions/cache v4 → v5
actions/upload-artifact v4 → v6
actions/download-artifact v4 → v7
docker/login-action v3 → v4
docker/setup-buildx-action v3 → v4
docker/build-push-action v6 → v7
dorny/paths-filter v3 → v4

Notes

  • upload/download-artifact: v5/v6 only had preliminary Node 24 support and still defaulted to Node 20, so they would not clear the warning — hence v6/v7. Both run on the @actions/artifact v4 backend and stay mutually compatible (classic zip/unzip), so the release/weekly jobs that pass PHP-patch artifacts between stages keep working.
  • Lowest Node 24 major, not latest — deliberate, to avoid pulling in unneeded breaking changes: download-artifact@v8 (hash mismatch now errors by default + ESM), upload@v7 (direct uploads + ESM), checkout@v7 (blocks fork-PR checkout for pull_request_target).
  • Left untouched: sigstore/cosign-installer@v3 and EmbarkStudios/cargo-deny-action@v2 — composite/container actions not affected by the Node 20 deprecation.
  • checkout@v5 requires runner ≥ v2.327.1 — always satisfied on GitHub-hosted runners; no self-hosted runners are used in this repo.

All four workflow files were validated to still parse.

CI:
  - Update all Node-based actions to the lowest major that defaults to the Node.js 24 runtime, clearing the Node.js 20 deprecation warning on the runners.
  - actions/checkout v4 -> v5 and actions/cache v4 -> v5 (Node 24 baselines).
  - actions/upload-artifact v4 -> v6 and actions/download-artifact v4 -> v7: earlier majors only had preliminary Node 24 support and still defaulted to Node 20. v6/v7 share the @actions/artifact v4 backend and stay mutually compatible (classic zip/unzip), so the release/weekly jobs that pass PHP-patch artifacts between stages keep working.
  - docker/login-action v3 -> v4, docker/setup-buildx-action v3 -> v4, docker/build-push-action v6 -> v7, dorny/paths-filter v3 -> v4.
  - Left sigstore/cosign-installer@v3 and EmbarkStudios/cargo-deny-action@v2 untouched — composite/container actions not affected by the Node 20 deprecation.
@diolektor diolektor force-pushed the chore/actions-node24-bump branch from 7f9e7af to 4a84d8f Compare June 23, 2026 18:16
@diolektor diolektor merged commit bfb7189 into main Jun 23, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant