From 09e2d386dffa6e6e9310e0ea9a8d8f505d1a7f5d Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Thu, 6 Aug 2026 23:20:38 +0000
Subject: [PATCH] Run the action on Node 24
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GitHub is forcing node20 actions onto Node 24 and annotating every workflow
run that uses one, so every consumer of coinpaybot@v0 carries the deprecation
warning — moshcode's coinpay.yml among them.

Three places had to agree, not just the manifest:

  action.yml        runs.using   node20 -> node24
  scripts/build.mjs esbuild target node20 -> node24
  package.json      engines.node >=20 -> >=24

Rebuilding against the new target produced a byte-identical dist/index.js —
nothing in src uses syntax esbuild downlevels between the two — so this changes
the declared runtime without changing the shipped bundle.

The repo's own workflows were pinned to the same deprecated actions:

  actions/checkout            v4 -> v7
  actions/setup-node          v4 -> v7
  pnpm/action-setup           v4 -> v6
  actions/upload-artifact     v4 -> v7
  actions/github-script       v7 -> v9
  codeql-action/upload-sarif  v3 -> v4

Each confirmed `runs.using: node24` before bumping. CI also moves to Node 24,
which it has to — it builds and tests an action that now declares that runtime.

github-script v9 drops `require('@actions/github')` (ESM-only now); the scan
workflow's script only requires `fs`, which v9 still supports.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml               |  8 ++++----
 .github/workflows/threatcrush-scan.yml | 10 +++++-----
 action.yml                             |  2 +-
 package.json                           |  2 +-
 scripts/build.mjs                      |  2 +-
 5 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2c77baf..cfe829c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,13 +9,13 @@ jobs:
   build-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
         with:
           version: 10
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm run typecheck
diff --git a/.github/workflows/threatcrush-scan.yml b/.github/workflows/threatcrush-scan.yml
index d9190b6..83fed51 100644
--- a/.github/workflows/threatcrush-scan.yml
+++ b/.github/workflows/threatcrush-scan.yml
@@ -19,9 +19,9 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
 
@@ -151,7 +151,7 @@ jobs:
       - name: Upload to the Security tab
         if: always() && 'true' == 'true'
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: threatcrush.sarif
           category: threatcrush
@@ -236,7 +236,7 @@ jobs:
 
       - name: Upload SARIF artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: threatcrush-sarif
           path: threatcrush.sarif
@@ -251,7 +251,7 @@ jobs:
       - name: Comment on PR
         if: always() && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/action.yml b/action.yml
index 3fa16d9..72f47a1 100644
--- a/action.yml
+++ b/action.yml
@@ -25,5 +25,5 @@ outputs:
   payment_id:
     description: 'CoinPayPortal payment id, when a payment was created.'
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'dist/index.js'
diff --git a/package.json b/package.json
index e0f1f48..e170bb5 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
   "type": "module",
   "license": "MIT",
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "scripts": {
     "build": "node scripts/build.mjs",
diff --git a/scripts/build.mjs b/scripts/build.mjs
index 2731532..d6aa171 100644
--- a/scripts/build.mjs
+++ b/scripts/build.mjs
@@ -6,7 +6,7 @@ await build({
   entryPoints: ['src/main.ts'],
   bundle: true,
   platform: 'node',
-  target: 'node20',
+  target: 'node24',
   format: 'esm',
   outfile: 'dist/index.js',
   banner: {