Move the workflows off the deprecated Node 20 actions - #19
Merged
Conversation
Every run has been annotating: "Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-dotnet@v4." Forced today, failing whenever the runners stop forcing it -- and the workflows that would fail are the two nobody exercises until a release is being published. To the current majors rather than the first one that clears the warning, so this is not done again in three months: checkout v4 -> v7, setup-dotnet v4 -> v6. The two behavioural changes in that range do not reach this repository, and both were checked rather than assumed. checkout v6 persists credentials to a separate file: no workflow here runs git after the checkout. checkout v7 blocks checking out a fork's PR under pull_request_target and workflow_run: no workflow here uses either trigger. setup-dotnet v5 drops support for older .NET versions; this builds .NET 10. Also records how a publish is verified, from the 0.13.0 release: install to a --tool-path so verifying cannot change the version you are running, and read the nuget.org index twice. It is cached per CDN edge, and two requests seconds apart returned 0.12.1 and 0.13.0 for the same package -- a single read looks exactly like a push that failed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Clearing the first two warnings made this one visible: init@v3 and analyze@v3 are the remaining Node 20 actions, and GitHub has put a date on them -- "CodeQL Action v4 will be deprecated in December 2026", which is not a warning to leave sitting in a security workflow that also runs on a weekly schedule nobody watches. Nothing in the v3-to-v4 range touches this workflow. The changes are to the config-file address format and to private registry support, and this initializes with two inline inputs and no config file. The build stays manual for the reason already recorded above it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every run has been carrying this annotation:
Forced today; failing whenever the runners stop forcing it. The workflows that would fail include
nuget.ymlandmcp-registry.yml, which nobody exercises until a release is being published — the worst moment to find out.What changed
actions/checkoutv4 → v7actions/setup-dotnetv4 → v6To the current majors rather than to the first version that clears the warning, so this does not come back in three months.
Why the jump is safe here
Checked rather than assumed — three majors is enough range to hide something:
checkout@v5: Node 24, requires runner ≥ v2.327.1checkout@v6: persists credentials to a separate filegitafter checkoutcheckout@v7: blocks checking out a fork PR underpull_request_target/workflow_runsetup-dotnet@v5: drops support for older .NET versionssetup-dotnet@v6: ESM migrationactions/upload-artifact@v4and the Pages actions are left alone: the deprecation names neither, and each additional bump is risk without a reason.CI and CodeQL exercise the changed files on this PR;
pages.ymlruns on the merge to main.nuget.ymlandmcp-registry.ymlare only reachable from a release, so they are the ones to watch on the next one.Also
docs/RELEASING.mdnow records how a publish is verified, from the 0.13.0 release:--tool-pathso verifying cannot leave you on a version you did not choose to run0.12.1and0.13.0for the same package. A single read looks exactly like a push that failed.