ci: bump actions/cache to the node24 v6.1.0 release - #458
Merged
Merged
Conversation
actions/cache was pinned at v4.3.0 (0057852), which runs on node20 and now emits a runner deprecation warning. It was also absent from the pin manifest and the dependabot anchor, so neither the consistency lint nor dependabot ever proposed a bump for it, letting it drift. Bring actions/cache under governance and move it to v6.1.0 (55cc8345863c7cc4c66a329aec7e433d2d1c52a9), the latest release whose action.yml declares using: node24: add it to internal/generate/action_pins.yaml as an emit:false maintainer-only pin, list it in the dependabot anchor, and update the setup-cli composite action ref. The consistency guard now locks the cache pin like every other action. Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
actions/cachewas pinned at0057852bfaa89a56745cba8c7296529d2fc39830(v4.3.0) in.github/actions/setup-cli/action.yaml. That release runs onnode20, which now triggers the runner deprecation warning ("actions/cache targets Node.js 20 but is being forced to run on Node.js 24").Root cause:
actions/cachewas the only pinned action absent from both the pin manifest (internal/generate/action_pins.yaml) and the dependabot anchor. Because nothing governed it, neither the consistency lint nor dependabot ever proposed a bump, so it silently fell behind on node20 while every manifest-governed action (checkout, github-script, upload/download-artifact, create-github-app-token, setup-go/node, deploy-pages) is already node24.Fix
Bring
actions/cacheunder governance and move it to the latest release whoseaction.ymldeclaresusing: node24:0057852bfaa89a56745cba8c7296529d2fc39830(v4.3.0, node20)55cc8345863c7cc4c66a329aec7e433d2d1c52a9(v6.1.0, node24)actions/cachetointernal/generate/action_pins.yamlas anemit:falsemaintainer-only pin (used only by cascade's own composite action, never generated into user workflows)..github/workflows/action-pins.ymlso dependabot has a tracked bump entrypoint.setup-clicomposite ref to the new SHA and precise# v6.1.0comment.TestActionPinsManifest_EmitFlagsto expect the newly governed action.v6.1.0 is what GitHub marks as
releases/latest(non-prerelease) and is where thev6major tag points. The consistency guard now locks the cache pin exactly like every other action.Verification
go build ./...cleango test ./internal/generate/...green (incl.TestWorkflowsConsistentWithActionPins,TestActionPinsAnchorCoversManifest,TestActionPinsManifest_EmitFlags,TestDefaultActionPins_MatchesPriorHardcodedTable)golangci-lint run ./internal/generate/...0 issuesactionlintclean on the anchor workflow