Skip to content

ci: bump GitHub Actions to current majors - #3

Merged
antomanc merged 1 commit into
mainfrom
ci/bump-actions
Oct 9, 2026
Merged

antomanc merged 1 commit into
mainfrom
ci/bump-actions

Conversation

@antomanc

@antomanc antomanc commented Oct 9, 2026

Copy link
Copy Markdown
Owner

Summary

The v4 action releases run on the deprecated Node 20 runtime, which made every job emit a deprecation annotation (visible on the v0.2.0 publish run). Bumping to the current majors:

Action was now
actions/checkout v4 v7
actions/setup-node v4 v7
pnpm/action-setup v4 v6

Applied to all three workflows (ci.yml, publish.yml, skill-drift.yml) — 9 references.

Compatibility

  • checkout v7 — the breaking change around allow-unsafe-pr-checkout only affects pull_request_target triggers; none of our workflows use it.
  • setup-node v7 — node-version, cache, registry-url inputs unchanged; adds cache-primary-key / cache-matched-key outputs.
  • pnpm/action-setup v6 — adds pnpm 11+ support and runs on Node 24; version still comes from the packageManager field (pnpm@12.10.1), no inputs passed.

Verification

  • All three files parse cleanly (YAML).
  • The ci.yml job matrix on this PR validates the new action versions end to end (3 OS × 2 Node, including the pnpm cache and the smoke suite).

The v4 releases target the deprecated Node 20 runtime and now emit a
deprecation annotation on every job.

- actions/checkout v4 -> v7
- actions/setup-node v4 -> v7 (same inputs; adds cache key outputs)
- pnpm/action-setup v4 -> v6 (adds pnpm 11+ support, runs on Node 24)

The checkout v7 defaults around pull_request_target do not apply here:
none of the workflows use that trigger. All existing step inputs are
unchanged in the new majors.
@antomanc
antomanc merged commit 348d08c into main Oct 9, 2026
6 checks passed
@antomanc
antomanc deleted the ci/bump-actions branch October 9, 2026 17:01
antomanc added a commit that referenced this pull request Oct 10, 2026
The v4 releases target the deprecated Node 20 runtime and now emit a
deprecation annotation on every job.

- actions/checkout v4 -> v7
- actions/setup-node v4 -> v7 (same inputs; adds cache key outputs)
- pnpm/action-setup v4 -> v6 (adds pnpm 11+ support, runs on Node 24)

The checkout v7 defaults around pull_request_target do not apply here:
none of the workflows use that trigger. All existing step inputs are
unchanged in the new majors.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant