From 6740e6978fe3e29f80c48eaab4d93e99359546b4 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Thu, 6 Aug 2026 10:46:29 +0800 Subject: [PATCH] ci: move the workflow actions onto the Node 24 runtime actions/checkout@v4 and actions/setup-go@v5 declare runs.using: node20, so every Go CI job printed the runner's Node 20 deprecation warning. The release, test-release and docker-release workflows carried six more node20 actions that never appeared in that warning only because those workflows run on a tag or a dispatch rather than on every push: upload-artifact v4, goreleaser-action v6, build-push v6 and the docker qemu/buildx/login v3 line. All of them move to the current majors, which declare node24. The SHA-pinned rest already qualified -- attest and sbom-action are node24, cosign-installer is composite. Checked against what those majors removed. build-push v7 dropped DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS and setup-buildx v4 dropped its deprecated inputs, none of which are used here. checkout v7 refuses to check out fork PRs under pull_request_target and workflow_run, and no workflow here triggers on either. setup-go v6 exports GOTOOLCHAIN=local, the one change with teeth. go.mod declares `go 1.26.5` and carries no toolchain directive, every job resolves that same version through go-version-file, and nothing in the module graph asks for more, so there is nothing left for the go command to fetch: `go build ./...` passes under GOTOOLCHAIN=local. The tools installed from outside the module are in range too -- nfpm v2.47.0 requires 1.26.4 and govulncheck v1.6.0 requires 1.25.0 -- and golangci-lint arrives as a prebuilt binary from upstream's install script, not through the toolchain. The runner floor that comes with node24 (v2.327.1) is met by GitHub-hosted runners, and every job here is ubuntu-latest. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/docker-release.yml | 12 ++++++------ .github/workflows/go.yml | 24 ++++++++++++------------ .github/workflows/release.yml | 8 ++++---- .github/workflows/test-release.yml | 8 ++++---- .github/workflows/vulncheck.yml | 4 ++-- 5 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index ad53eaa82..b61fc8e3e 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -69,7 +69,7 @@ jobs: fi - name: Checkout release tag - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ inputs.tag }} fetch-depth: 0 @@ -134,15 +134,15 @@ jobs: echo "RELEASE_REVISION=$(git rev-parse HEAD)" >> "${GITHUB_ENV}" - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 with: platforms: arm64 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -154,7 +154,7 @@ jobs: - name: Build and push amd64 image id: build-amd64 - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: docker-release/amd64 file: docker-release/amd64/Dockerfile.goreleaser @@ -170,7 +170,7 @@ jobs: - name: Build and push arm64 image id: build-arm64 - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: docker-release/arm64 file: docker-release/arm64/Dockerfile.goreleaser diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index ac711fd50..e5f4660fb 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -25,9 +25,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -62,9 +62,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 25 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -80,9 +80,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -95,9 +95,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -110,9 +110,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 25 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -134,9 +134,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 35 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d67503a53..c4b9aaae0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 # Build the code at the tag being released, not whatever branch the @@ -31,7 +31,7 @@ jobs: ref: ${{ github.event.inputs.tag || github.ref }} - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -107,7 +107,7 @@ jobs: cosign-release: v3.1.2 - name: Build Draft release with GoReleaser - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@v7 with: version: "~> v2" args: release --clean --skip=validate --config .github/goreleaser.yml @@ -206,7 +206,7 @@ jobs: - name: Upload dist artifact if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: dist path: dist/ diff --git a/.github/workflows/test-release.yml b/.github/workflows/test-release.yml index e5b2d7417..8bc650f41 100644 --- a/.github/workflows/test-release.yml +++ b/.github/workflows/test-release.yml @@ -39,12 +39,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -65,7 +65,7 @@ jobs: echo "LDFLAGS: ${LDFLAGS}" - name: GoReleaser config check - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@v7 with: version: "~> v2" args: check --config .github/goreleaser.yml @@ -79,7 +79,7 @@ jobs: syft-version: v1.50.0 - name: Build snapshot artifacts - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@v7 with: version: "~> v2" # A pull-request snapshot has no trusted release identity. Exercise diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml index c056dd639..87a4aa7e9 100644 --- a/.github/workflows/vulncheck.yml +++ b/.github/workflows/vulncheck.yml @@ -19,10 +19,10 @@ jobs: timeout-minutes: 20 steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true