ci: pin GitHub Actions to commit SHAs, fix Node 20 deprecation - #1129
Conversation
actions/checkout@v4 and actions/setup-node@v4 still declare node20 in their action metadata, so GitHub Actions runners now force them onto Node 24 with a deprecation warning. actions/upload-artifact@v4 has the same issue. Bump all three to their latest Node 24-native majors (checkout v7.0.1, setup-node v7.0.0, upload-artifact v7.0.1) and pin by commit SHA with a version comment instead of a floating tag.
HaaLeo/publish-vscode-extension, euberdeveloper/ga-project-version, softprops/action-gh-release, quarto-dev/quarto-actions/setup, and posit-dev/setup-positron were still referenced by mutable tags or a branch (ga-project-version@main). Pin each to the commit SHA behind its currently-used version, matching the SHA-pinning approach applied to the GitHub-owned actions in the previous commit.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
juliasilge
left a comment
juliasilge
left a comment
There was a problem hiding this comment.
I tend to have a pretty good experience just using tags like v7 in GH actions for projects that aren't super duper big or complicated. We don't have dependabot set up here at all for this, so if we merge this PR as is we'll go stale really fast with fixes and such for these actions. What do you think about just using the tags?
Alternatively we could also add dependabot config to this repo and set it up to be able to stay current.
I am ok with tags too. I thought this was becoming good practice to use the hash - and easier than before when you have 🤖 to help you update. I'll put back the tags and we can change in another PR for dependabot if we don't want to end in this situation of using v4 while v7 is out. |
3 participants
actions/checkout@v4 and actions/setup-node@v4 still declare
node20in their action metadata, so GitHub Actions runners now force them onto Node 24 with a deprecation warning (see changelog). actions/upload-artifact@v4 has the same issue.Bumps checkout, setup-node, and upload-artifact to their latest Node 24-native majors, and pins every action reference across the four workflows to a commit SHA (with a version comment) instead of a mutable tag or branch.