From 8560aa693f0deeebc4e21602f697fa1eb86b3ae3 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 23 Oct 2026 08:42:58 +0000 Subject: [PATCH] Move compat workflows off Node 20 action pins Every compatibility workflow still pinned download-artifact v4, setup-node v4 and setup-python v5, which target Node.js 20. GitHub already forces them onto Node 24 with a deprecation warning; once it drops Node 20 action support, every bun, gradle, npm, pdm, pnpm, poetry, sbt and vlt compatibility leg breaks at once. ci.yml moved to newer pins in #1590. Reuse exactly those SHAs (already trusted and running in this repo) so the compatibility workflows match: download-artifact v7.0.0, setup-node v6.4.0, setup-python v6.3.0. Every download here goes by name pattern with merge-multiple, so download-artifact's by-ID extraction change doesn't apply. There's no root package.json, so setup-node's automatic npm cache stays off. release.yml keeps its pins; #1588 leaves that bump for a human. Refs #1588 Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01Df8ucZKAaQPFLu8QXdBGL2 --- .github/workflows/bun-compatibility.yml | 6 +++--- .github/workflows/gradle-compatibility.yml | 2 +- .github/workflows/npm-compatibility.yml | 6 +++--- .github/workflows/pdm-compatibility.yml | 8 ++++---- .github/workflows/pnpm-compatibility.yml | 6 +++--- .github/workflows/poetry-compatibility.yml | 4 ++-- .github/workflows/sbt-compatibility.yml | 4 ++-- .github/workflows/vlt-compatibility.yml | 22 +++++++++++----------- 8 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/workflows/bun-compatibility.yml b/.github/workflows/bun-compatibility.yml index a16bb4a9c..591311980 100644 --- a/.github/workflows/bun-compatibility.yml +++ b/.github/workflows/bun-compatibility.yml @@ -183,14 +183,14 @@ jobs: persist-credentials: false - name: Download CLI - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: bun-cli-${{ matrix.os }}* merge-multiple: true path: native-cli - name: Setup Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' @@ -390,7 +390,7 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Setup Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' diff --git a/.github/workflows/gradle-compatibility.yml b/.github/workflows/gradle-compatibility.yml index 07f3f498e..a3a555035 100644 --- a/.github/workflows/gradle-compatibility.yml +++ b/.github/workflows/gradle-compatibility.yml @@ -256,7 +256,7 @@ jobs: persist-credentials: false - name: Download the Gradle suites - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: gradle-bin-${{ matrix.os }}* merge-multiple: true diff --git a/.github/workflows/npm-compatibility.yml b/.github/workflows/npm-compatibility.yml index f7ad21e3d..789ea63e6 100644 --- a/.github/workflows/npm-compatibility.yml +++ b/.github/workflows/npm-compatibility.yml @@ -123,12 +123,12 @@ jobs: steps: # Same workspace path as the build job, so the socket-patch path # compiled into the tests (CARGO_BIN_EXE_socket-patch) resolves. - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: npm-e2e* merge-multiple: true path: target/debug - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24.11.1' - name: Install the pinned npm @@ -137,7 +137,7 @@ jobs: run: | npm install --prefix "$RUNNER_TEMP/npm-tool" --no-audit --no-fund "npm@$NPM_TEST_VERSION" echo "SOCKET_PATCH_NPM_E2E_BIN=$RUNNER_TEMP/npm-tool/node_modules/.bin/npm" >> "$GITHUB_ENV" - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node }} - name: Hosted + vendored installs, manifest-less VEX diff --git a/.github/workflows/pdm-compatibility.yml b/.github/workflows/pdm-compatibility.yml index 9ab38d3b9..df6b1c553 100644 --- a/.github/workflows/pdm-compatibility.yml +++ b/.github/workflows/pdm-compatibility.yml @@ -134,12 +134,12 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: pdm-cli-${{ matrix.os }}* merge-multiple: true path: native-cli - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' # uv bootstraps every pinned PDM release (and its interpreter) itself; @@ -233,12 +233,12 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: pdm-cli-${{ matrix.os }}* merge-multiple: true path: target/pdm-e2e - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - run: scripts/pip-install-retry.sh uv==0.11.19 diff --git a/.github/workflows/pnpm-compatibility.yml b/.github/workflows/pnpm-compatibility.yml index 06bec0175..135e525ff 100644 --- a/.github/workflows/pnpm-compatibility.yml +++ b/.github/workflows/pnpm-compatibility.yml @@ -111,12 +111,12 @@ jobs: - node: '24.11.1' pnpm: 9.0.0 9.15.9 10.0.0 10.33.0 10.34.5 11.0.0 11.27.0 12.0.0 12.4.2 steps: - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: pnpm-e2e* merge-multiple: true path: bin - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24.11.1' - name: Install the pinned package managers @@ -126,7 +126,7 @@ jobs: for v in $PNPM_TEST_VERSIONS; do npm install --prefix "$RUNNER_TEMP/pnpm-$v" --no-audit --no-fund "pnpm@$v" done - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node }} # Per version: installation, verified VEX, rollback and integrity diff --git a/.github/workflows/poetry-compatibility.yml b/.github/workflows/poetry-compatibility.yml index e1f40c991..50815da29 100644 --- a/.github/workflows/poetry-compatibility.yml +++ b/.github/workflows/poetry-compatibility.yml @@ -103,12 +103,12 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: poetry-cli-${{ matrix.os }}* merge-multiple: true path: native-cli - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - name: Pin the production patch hosts (macOS) diff --git a/.github/workflows/sbt-compatibility.yml b/.github/workflows/sbt-compatibility.yml index 80726c17a..560b39a53 100644 --- a/.github/workflows/sbt-compatibility.yml +++ b/.github/workflows/sbt-compatibility.yml @@ -223,7 +223,7 @@ jobs: persist-credentials: false - name: Download the sbt image and Linux binaries - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: sbt-* merge-multiple: true @@ -274,7 +274,7 @@ jobs: persist-credentials: false - name: Download the sbt image and Linux binaries - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: sbt-* merge-multiple: true diff --git a/.github/workflows/vlt-compatibility.yml b/.github/workflows/vlt-compatibility.yml index 473d8f8f3..3df73e0e1 100644 --- a/.github/workflows/vlt-compatibility.yml +++ b/.github/workflows/vlt-compatibility.yml @@ -299,12 +299,12 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: vlt-e2e-${{ matrix.os }}* merge-multiple: true path: target/vlt-e2e - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node || '24.21.0' }} - name: Install vlt ${{ matrix.vlt }} @@ -450,15 +450,15 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: vlt-e2e-${{ matrix.os }}* merge-multiple: true path: native-cli - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24.21.0' - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - name: Pin the production patch hosts (macOS) @@ -514,7 +514,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: vlt-results-* path: results @@ -561,15 +561,15 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: vlt-e2e-${{ matrix.os }}* merge-multiple: true path: target/vlt-e2e - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24.21.0' - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - name: vlt@latest through every capstone @@ -630,12 +630,12 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: pattern: vlt-e2e-ubuntu-latest* merge-multiple: true path: target/vlt-e2e - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24.21.0' - name: The published release meets vlt ledgers