ci: bump first-party Actions to Node 24 majors#36086
Open
wezell wants to merge 2 commits into
Open
Conversation
Node 20 is deprecated; runners default to Node 24 on 2026-06-16. Bump the clean single-major first-party actions to their verified Node-24 majors (runtime confirmed from each action.yml): actions/checkout v2/v3/v4 -> v5 actions/setup-node v4/v2-beta -> v5 actions/setup-python v4 -> v6 (v5 is still Node 20) actions/github-script v7 -> v8 actions/cache v4 -> v5 upload-artifact (v4->v6) and download-artifact (v4->v7) are intentionally left for a separate, reviewed change: they are 2-3 major jumps with breaking-API history, and a FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 smoke-test proved the existing v4 actions already run fine on Node 24. Also updates the matching version examples in composite-action READMEs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
Area : CI/CD
sfreudenthaler
left a comment
sfreudenthaler
left a comment
Member
There was a problem hiding this comment.
@wezell did you happen to try this in dotcms/core-workflows-test ? just as an added smoke test.
| uses: actions/setup-node@v2-beta | ||
| uses: actions/setup-node@v5 | ||
| with: | ||
| node-version: "16.13.2" |
Member
There was a problem hiding this comment.
this should be bumped or explicitly out of scope in the pr description so we don't miss it on the follow up issue.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bump the first-party GitHub Actions pinned to Node-20 majors up to their verified Node-24 majors, repo-wide (48 files).
Fixes #36085
actions/checkoutactions/setup-nodeactions/setup-pythonactions/github-scriptactions/cacheTarget versions were confirmed by reading each action's
action.ymlruntime, not assumed — notesetup-python's first Node-24 release is v6 (v5 is still Node 20).Why
Node 20 is deprecated; GitHub runners default to Node 24 on 2026-06-16 and remove Node 20 in fall 2026. This clears the
actions/checkout@v4(and related) deprecation warnings on a runtime that's already been validated.Validation
A prior smoke-test forced the entire PR pipeline onto Node 24 (
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true) — build, all 7 integration suites, all 11 Postman splits, E2E Playwright, CLI, Karate, JVM unit — and everything passed. So Node 24 itself is proven safe here; this PR just updates the pins to make it official and silence the warnings.Deliberately out of scope
actions/upload-artifact(v4→v6) andactions/download-artifact(v4→v7) are 2–3 major jumps with breaking-API history (the pipeline relies on v4 inputs likepattern,merge-multiple,name,retention-days). The smoke-test proved the existing v4 artifact actions already run fine on Node 24, so they're not a cutover risk — they'll be bumped in a separate, reviewed change.Notes
@vNversion pins (and matching examples in composite-action READMEs).docker/*,aws-actions/*,dorny/paths-filter, and other third-party actions are unchanged; they also passed the Node 24 smoke-test and will auto-migrate at the cutover.