Run the action on Node 24 - #2
Open
ralyodio wants to merge 1 commit into
Open
Conversation
GitHub is forcing node20 actions onto Node 24 and annotating every workflow
run that uses one, so every consumer of coinpaybot@v0 carries the deprecation
warning — moshcode's coinpay.yml among them.
Three places had to agree, not just the manifest:
action.yml runs.using node20 -> node24
scripts/build.mjs esbuild target node20 -> node24
package.json engines.node >=20 -> >=24
Rebuilding against the new target produced a byte-identical dist/index.js —
nothing in src uses syntax esbuild downlevels between the two — so this changes
the declared runtime without changing the shipped bundle.
The repo's own workflows were pinned to the same deprecated actions:
actions/checkout v4 -> v7
actions/setup-node v4 -> v7
pnpm/action-setup v4 -> v6
actions/upload-artifact v4 -> v7
actions/github-script v7 -> v9
codeql-action/upload-sarif v3 -> v4
Each confirmed `runs.using: node24` before bumping. CI also moves to Node 24,
which it has to — it builds and tests an action that now declares that runtime.
github-script v9 drops `require('@actions/github')` (ESM-only now); the scan
workflow's script only requires `fs`, which v9 still supports.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ThreatCrush Security Scan2 finding(s) HIGH/CRITICAL: 2
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the action off the deprecated Node 20 runtime, so consumers stop carrying the warning.
GitHub forces
node20actions onto Node 24 and annotates every run that uses one. Because this action ships as@v0, that warning lands in every downstream workflow — moshcode'scoinpay.ymlis where it surfaced.Three places had to agree
action.ymlruns.usingnode20→node24scripts/build.mjstargetnode20→node24package.jsonengines.node>=20→>=24Changing only the manifest would leave the bundle built for a runtime the action no longer declares — harmless today, misleading later.
dist/index.jscame out byte-identical after rebuilding against the new target: nothing insrcuses syntax esbuild downlevels between node20 and node24. So the declared runtime changes and the shipped bundle does not, which is the safest possible version of this change. The "Verify dist is up to date" guard passes unchanged.The repo's own workflows had the same problem
actions/checkoutactions/setup-nodepnpm/action-setupactions/upload-artifactactions/github-scriptcodeql-action/upload-sarifEach was confirmed
runs.using: node24by reading itsaction.yml, not inferred from the version number —codeql-actionv3 is node20 and v4 is not, which the deprecation notice never mentions.CI also moves to Node 24. That one isn't cosmetic: it builds and tests an action that now declares that runtime, so testing on 20 would be testing the wrong thing.
github-scriptv9 dropsrequire('@actions/github')— that package is ESM-only now. The scan workflow's script only requiresfs, which v9 still supports.Verification
pnpm run checkgreen locally on Node 24: typecheck clean, 35 tests passing, build reproducible.After merge
The
v0tag needs to move to pick this up, since consumers pin@v0.🤖 Generated with Claude Code