ci: bump actions off the deprecated Node 20 runtime - #12
Merged
Conversation
Every pinned action targeted Node 20, which GitHub deprecated — the runners were already force-running them on Node 24 and annotating every build. checkout/setup-node/upload-artifact go to v7 and pnpm/action-setup to v6; all four now declare node24 natively. Reviewed the intermediate majors rather than bumping blind. One real breaking change: setup-node v6 stopped auto-enabling caching for pnpm and yarn (it now only auto-caches npm). It does not affect us — we pass `cache: pnpm` explicitly, which is still the supported path — but the input is now load-bearing rather than decorative, so it gets a comment saying so, including the ordering requirement that pnpm/action-setup runs first so the binary is on PATH. The rest are ESM migrations, Node 24 runtimes, and additive inputs. checkout v7 blocks fork checkout for pull_request_target/workflow_run; this workflow triggers on push and pull_request, so it's unaffected. Only the actions changed. `node-version: 22`, the Dockerfile base and @types/node are all still 22 — moving the runtime is a separate decision with a native-module (better-sqlite3) rebuild behind it.
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every action in
ci.ymltargeted Node 20, which GitHub deprecated. The runners were already force-running them on Node 24 and annotating every build with it.actions/checkoutactions/setup-nodeactions/upload-artifactpnpm/action-setupThe one breaking change that mattered
actions/setup-node@v6stopped auto-enabling caching for pnpm and yarn — it now only auto-caches npm, "to avoid compatibility issues" (#1374).We're unaffected, because we pass
cache: pnpmexplicitly and the manual input is still the supported path. But it means that input is now load-bearing rather than a nicety, so I added a comment saying so — along with the ordering requirement thatpnpm/action-setupmust run beforesetup-node, or the binary isn't on PATH when the cache step looks for it.Worth knowing because the failure mode is silent: it wouldn't break the build, just quietly stop caching and make every run slower.
Everything else
ESM migrations, Node 24 runtimes, additive inputs.
checkout@v7blocks fork checkout forpull_request_target/workflow_run; this workflow triggers onpushandpull_request, so it doesn't apply.Deliberately not included
The runtime Node stays on 22 —
node-version: 22,FROM node:22-alpine, and@types/node@^22. That's a separate decision: Node 22 is in maintenance LTS until April 2027, and moving the Docker base means rebuildingbetter-sqlite3against a new ABI on the image that serves prod. Worth doing deliberately, not as a side effect of a CI hygiene change.Note also
superfly/flyctl-actions/setup-flyctl@masteris pinned to a moving branch rather than a tag — unchanged here, but it's the one remaining supply-chain soft spot in this file.Verification
CI on this PR exercises the
ciande2ejobs with the new pins. Thedeployjob only runs on push to master, so itscheckout@v7is first exercised on merge — it takes no inputs, so the risk is minimal.