ci: bump GitHub Actions to Node 24 runtimes - #144
Merged
Merged
Conversation
GitHub deprecated the Node 20 action runtime, so every run of all four workflows now prints "The following actions uses node20 which is deprecated and will be forced to run on node24". Node 20 is being removed outright, after which node20 actions hard-fail instead of merely warning. Bumped each offender to its current Node 24 release line: - actions/checkout v4 -> v7 (9 steps) - actions/setup-python v5 -> v7 (3 steps) - actions/upload-artifact v4 -> v7 (2 steps) - actions/download-artifact v4 -> v8 (1 step) - astral-sh/setup-uv v4 -> v10.0.0 (pipy.yml sdist job, which lagged the v10.0.0 already pinned in ci.yml and docs.yml) upload-artifact v5 and download-artifact v5/v6 are NOT Node 24 -- they still declare `using: node20` -- so v6 and v7 respectively were the first valid targets, and the latest majors are used instead. peaceiris/actions-gh-pages v4, PyO3/maturin-action v1, astral-sh/ruff-action v4.1.0 and Swatinem/rust-cache v2 were already Node 24; dtolnay/rust-toolchain and pypa/gh-action-pypi-publish are composite and need no bump. No workflow input changes were required: every `with:` key still exists in the new majors, upload-artifact v7's new `archive` input defaults to true (unchanged zip behavior), and download-artifact v8 still defaults `merge-multiple` to false, which pipy.yml sets explicitly. checkout v7's fork-PR refusal is scoped to pull_request_target/workflow_run, while ci.yml triggers on plain pull_request. One behavior change is pinned back explicitly. setup-uv v10 defaults `enable-cache` to "auto", which resolves to true for pipy.yml's push-to-main and workflow_dispatch triggers (v4 defaulted to false). That would add a `post: save-cache` step to the sdist job, and that step can fail the job after a successful build -- skipping `publish` while tag-version.yml still pushes the tag, leaving a tagged release with nothing on PyPI. The job only runs `uv build --sdist` and never syncs dependencies, so a cache buys nothing there; it is set to false to preserve the v4 behavior. download-artifact v8 defaults `digest-mismatch` to error (was warn). This is kept: it fails closed in the first step of `publish`, before anything reaches PyPI, which is the right behavior for a release pipeline. Verified: `actionlint` clean on all four workflows; all YAML parses; every referenced action's action.yml at its pinned tag now reads `using: node24` (or composite); `grep -rn 'node20|node16|node12' .github/` finds nothing.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
SkyeAv
added a commit
that referenced
this pull request
Sep 9, 2026
Cut 17.0.1 and bump the package version in pyproject.toml, CITATION.cff, and uv.lock. Patch: the fullmap resolver now retains every CURIE tied on a term's best ranking tier (#145) — `distinct` used to keep one arbitrary sort-first row per term, silently discarding distinct CURIEs tied across the entire ranking tuple; tied CURIEs now propagate through `resolve`, `resolve_batch`, and `join_matches` as separate output rows, collapsed only by `(term, CURIE)`. Also on main since 17.0.0: a CI-only GitHub Actions runtime bump (#144), no user-facing change. Changelog: - Versioned the release as 17.0.1 - 2026-09-09 with one Fixed entry for the tied-CURIE retention (#145); no Unreleased section existed to rename, and the CI-only bump (#144) gets no entry per repo convention. Docs: none needed here — #145 shipped its docs updates (docs/api/fullmap.md) with the fix. Testing: - make lint -> "All checks passed!" (ruff check) - make fmt-check -> 84 files already formatted; cargo fmt clean - make typecheck -> 0 errors, 0 warnings, 0 informations (pyright) - make test -> 1246 passed, 3 skipped in 37.52s (pytest, 96% coverage) - make test-rust -> all test binaries ok (cargo test) - cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings -> clean - uv lock --check -> in sync pre-bump; re-locked post-bump, self-entry only
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub deprecated the Node 20 action runtime, so every run of all four workflows now prints "The following actions uses node20 which is deprecated and will be forced to run on node24" — and Node 20 is being removed outright, after which node20 actions hard-fail. This bumps every offending action to its current Node 24 release line.
Design
upload-artifact@v5anddownload-artifact@v5and@v6still declareruns.using: node20;v6andv7are the first Node 24 majors.with:key survives;upload-artifact@v7's newarchivedefaults totrue(unchanged zip behavior);download-artifact@v8still defaultsmerge-multipletofalse, whichpipy.ymlsets explicitly.checkoutv7's fork-PR refusal is scoped topull_request_target/workflow_run;ci.ymltriggers on plainpull_request.setup-uvv10'senable-cache: "auto"→ true here (v4 = false), adding apost: save-cachestep that can failsdistafter a good build and leave a tagged release with nothing on PyPI. Set tofalse.download-artifact@v8defaultsdigest-mismatchtoerror(was warn) — fails closed before anything reaches PyPI.if-no-files-foundstill defaults towarnon both upload steps, so awheelsleg producing zero files only warns andskip-existing: truemakes a partial release sticky (pre-existing). Nodependabot.ymlfor thegithub-actionsecosystem — which is why this sweep was manual.Testing
nix-shell -p actionlint shellcheck --run "actionlint -no-color"→ exit 0, no findings.YAML parse of all four workflows → OK.
runs.usingper pinned tag → allnode24/composite;grep -rn 'node20|node16|node12' .github/→ nothing.CI on this PR (run 34266961019) → all green:
python-lint7s,python-test2m26s,python-type5m51s,rust1m30s.The warning is empirically gone. The five preceding CI runs each emitted one warning annotation per job —
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4.Queryingcheck-runs/{job}/annotationsfor this PR's run returns no annotation matchingnode20|deprecated. (Onlyci.ymlis exercised here since it is the solepull_requestworkflow;pipy.yml/tag-version.yml/docs.ymlrun on push tomain, so theirsetup-python/upload-artifact/download-artifact/setup-uvbumps were verified statically by readingruns.usingfrom each pinned tag'saction.yml.)