fix: update GitHub Actions to Node 24 runtime versions - #195
Merged
Merged
Conversation
actions/checkout, actions/setup-python, actions/cache, and the google-github-actions auth/setup-gcloud actions were pinned to versions that still target the deprecated Node 20 runtime, which GitHub now force-upgrades with a warning on every run. Bump each to the latest major that declares node24 in its own action metadata.
Contributor
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
The org's zizmor security scan mandatorily requires every action reference to be pinned to a full commit SHA, not a floating tag. Apply the same SHA + version-comment pattern already used in integration-tests.yaml to the remaining three workflows.
zizmor flags the missing permissions block as overly broad (Medium severity), since the default GITHUB_TOKEN grants broader access than these jobs need. Both only checkout and run tests/lint, so contents:read matches lint-readme.yaml and integration-tests.yaml.
ajma
force-pushed
the
fix/pin-actions-node24
branch
from
September 12, 2026 21:39
7fe06dc to
9cd053d
Compare
medb
approved these changes
Sep 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tests.yaml,pyink.yaml,lint-readme.yaml,integration-tests.yaml) pinnedactions/checkout,actions/setup-python, andactions/cacheto versions that still declareusing: node20, which GitHub force-upgrades at runtime with a deprecation warning on every run.node24natively (verified directly against each action'saction.yml, not just version numbers):checkoutv4→v7.0.1,setup-pythonv5→v7.0.0,cachev4→v6.1.0, and inintegration-tests.yaml,google-github-actions/authv2→v3 andgoogle-github-actions/setup-gcloudv2→v3.0.1.unpinned-usespolicy, matching the patternintegration-tests.yamlalready used.permissions: contents: readtotests.yamlandpyink.yamlto resolve zizmor's overly-broad-permissions finding, matchinglint-readme.yamlandintegration-tests.yaml.persist-credentials,python-version,path/key/restore-keys,credentials_json).Note: two other warnings (
Feature flags do not specify a default CLI version, a CodeQL API permission notice) come from.github/workflows/action_scanning.yml, which isn't part of this repo — it's an org-level required workflow, so it's out of scope here.Test plan
python3 -c "import yaml; ..."— all four workflow YAML files parse successfully