[Mikola Lysenko (mikolalysenko)]

Problem

#1588: the 8 package-manager compatibility workflows still pin actions that target Node.js 20:

Pin (old)	Uses in compat workflows
actions/download-artifact@d3f86a1… # v4	14
actions/setup-node@49933ea… # v4	8
actions/setup-python@a26af69… # v5	7

GitHub currently forces these actions onto Node 24 and logs a deprecation warning. Once it drops Node 20 action support, every bun, gradle, npm, pdm, pnpm, poetry, sbt and vlt compatibility leg fails at the same moment, on PRs, on main pushes and in nightlies. #1590 already moved ci.yml off these pins; the compatibility workflows were not part of it.

This run found the queue and CI healthy: no queued runs, main green, and both merge-queue evictions in the last 24h were Depot runner losses, already logged on #1660. So this is a priority-4 robustness fix rather than an unblocker.

Fix

Swap each old pin for the exact SHA ci.yml already runs, so this adds no new third-party code to the repo:

• actions/download-artifact@37930b1… # v7.0.0
• actions/setup-node@48b55a0… # v6.4.0
• actions/setup-python@ece7cb0… # v6.3.0

Breaking changes checked:

• download-artifact v5+ changed the extraction path for downloads by artifact ID. Every download here uses pattern: (with merge-multiple: true except vlt's vlt-results-* collector, which keeps per-artifact dirs as before), never artifact-ids.
• setup-node v5+ turns on npm caching automatically when package.json has a packageManager field. The repo has no root package.json, and no step passes cache:. ci.yml runs v6.4.0 under the same checkout.
• setup-python v6 needs runner ≥ 2.327.1. These jobs use the same hosted/Depot images as ci.yml, which already runs v6.3.0.

release.yml keeps its v4 pins (3 uses), since #1588/#1590 leave the release workflow for a human call.

Proof

• Each SHA matches its upstream tag (git ls-remote): download-artifact v7.0.0 → 37930b1c, setup-node v6.4.0 → 48b55a01, setup-python v6.3.0 → ece7cb06.
• No old pin is left outside release.yml (grep -rnE 'd3f86a1|49933ea|a26af69' .github).
• actionlint output on the 8 files matches main exactly (6 lines, all pre-existing YAML-anchor complaints from actionlint 1.7.7). zizmor --offline matches main too: 55 findings, all pre-existing, none of them new.
• Correction (after CI): I expected this PR to run all 8 compatibility workflows, but none ran. All 11 *-compatibility.yml workflows are disabled_manually in the repo's Actions settings, so this change cannot be exercised until someone re-enables them (a workflow_dispatch on this branch after re-enabling would do it). The only evidence for the new pins is that ci.yml runs the same SHAs, on the same runner images, for the same kinds of steps. Required CI on this head is green (ci-ok, clippy, 35 successes, 0 failures).

Decision for a maintainer

With the compatibility workflows disabled, this PR only matters if they get turned back on. Either merge it so that re-enabling them doesn't start with a Node 20 break, or close it. If the workflows are retired for good, deleting them is the better cleanup.

No tests were removed or moved.

https://claude.ai/code/session_01Df8ucZKAaQPFLu8QXdBGL2

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8560aa6. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down] Labeled Ready for review at head 8560aa69.

• CI: every check on this head passed (ci-ok, clippy, e2e, coverage, Audit GitHub Actions). Path-filtered jobs were skipped. Nothing failed.
• Bugbot: reviewed 8560aa69 with no findings and no open review threads.
• Mergeable against main aa691254, with no conflicts.
• Reviewer note: all *-compatibility.yml workflows are disabled in Actions settings, so none of the new pins ran on this PR. The only evidence they work is that ci.yml already runs the same SHAs. The decision: merge as prep for re-enabling those workflows, or close the PR if they are retired.
• Slack announcement not sent this run (Slack send unavailable).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review (burn-down agent).

• Head: 8560aa69
• CI: 55/55 settled (36 success, 19 skipped), no failures; mergeable, waiting only on human review.
• Bugbot: reviewed this head, no issues; no open review threads.
• Reviewer focus: the compat workflows this touches are currently disabled_manually, so the call is whether to merge this as prep for re-enabling them, or close it.
• Slack announcement could not be sent from this run (no Slack send tool available).

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. Swaps the Node-20-era action pins (download-artifact v4, setup-node v4, setup-python v5) in the 8 package-manager compatibility workflows for the exact SHAs ci.yml already runs (v7.0.0, v6.4.0, v6.3.0). That way the compat legs won't all break at once when GitHub drops Node 20 actions (#1588). release.yml is left alone on purpose.

Risk: low. It's YAML only, no new third-party code (the SHAs are byte-identical to ci.yml's), and no Rust changes. Note that all *-compatibility.yml workflows are currently disabled_manually, so CI here couldn't exercise them.

Look here

• vlt-compatibility.yml:302: the most-touched file (11 swaps). Its vlt-results-* collector (L517) downloads by pattern without merge-multiple, and v5+'s extraction-path change applies only to downloads by artifact ID, so it's unaffected.
• npm-compatibility.yml:126-142: setup-node v6 auto-cache only kicks in with a root package.json packageManager field, and the repo has none.
• Reference pins: ci.yml:181, ci.yml:813.

Verified

• Every new SHA matches the one in ci.yml on this head.
• No old pin remains outside release.yml:254.
• The diff is a pure 1:1 pin swap (29/29 lines).
• CHANGELOG.md is untouched.
• CI: 36/36 run checks green (19 skipped), ci-ok and clippy green.
• Bugbot found no issues on this head, and there are no review threads.

Changes I made: none.

Open questions: the compat workflows are disabled in Actions settings. Merging is harmless and keeps re-enabling them from starting with a Node 20 break. If they're retired for good, deleting them is the cleaner follow-up (the author's note in the description).

Auto-merge is armed, so approving sends it straight to the merge queue.

---

Generated by Claude Code