From e41a782eef3434ee58b8550e809241a082069e3a Mon Sep 17 00:00:00 2001 From: Preetam Dwivedi Date: Wed, 7 Oct 2026 19:27:57 -0700 Subject: [PATCH] ci: move checkout and cache actions to Node 24 releases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary ### Why? Every workflow run warns that `actions/checkout@v4.3.1` and `actions/cache@v4` target the deprecated Node.js 20 runtime and are being forced onto Node 24 (e.g. https://github.com/uber/submitqueue/actions/runs/37717545209). ### What? - `actions/checkout` v4.3.1 → v7.0.1 in `ci.yml`, `docs.yml` and `tag-go-pseudoversion.yml`. - `actions/cache` v4 → v6.1.0 in `.github/actions/setup`. - Both stay SHA-pinned. No breaking change applies here: jobs run on GitHub-hosted runners (minimum runner version met), checkout v6+ still persists credentials for `tag-go-pseudoversion.yml`'s tag push (now in a separate file), and v7's `pull_request_target` fork block does not affect this repo. ## Test Plan ✅ zizmor 1.25.2 (repo config) and actionlint clean on `.github/` ✅ Every directly pinned action now declares `node24` (the rest are composite) Post-merge: confirm the Node.js 20 annotation is gone from the next `main` CI and Docs runs, and that `tag-go-pseudoversion` still pushes its tag. --- .github/actions/setup/action.yml | 2 +- .github/workflows/ci.yml | 24 +++++++++++----------- .github/workflows/docs.yml | 2 +- .github/workflows/tag-go-pseudoversion.yml | 2 +- 4 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index 0b72f08f5..f32a0d6c5 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -17,7 +17,7 @@ runs: using: composite steps: - name: Setup Bazel cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cache/bazel-disk-cache diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d37772938..c6c17826e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,7 +36,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -54,7 +54,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -75,7 +75,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -90,7 +90,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -112,7 +112,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -131,7 +131,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -150,7 +150,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -172,7 +172,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -187,7 +187,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -202,7 +202,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -220,7 +220,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # This job executes untrusted PR code (make build/test/lint). Don't # leave the GITHUB_TOKEN in the workspace git config while it runs. @@ -244,7 +244,7 @@ jobs: if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: actionlint diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 2db199c78..af3c508fb 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -25,7 +25,7 @@ jobs: name: Build site runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup diff --git a/.github/workflows/tag-go-pseudoversion.yml b/.github/workflows/tag-go-pseudoversion.yml index 1488cbd78..b1e7b4428 100644 --- a/.github/workflows/tag-go-pseudoversion.yml +++ b/.github/workflows/tag-go-pseudoversion.yml @@ -24,7 +24,7 @@ jobs: name: Create and push pseudo-version tag runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0