Skip to content

ci: move off Node 20 actions (checkout v7, setup-dotnet v6) - #7

Merged
coccor merged 1 commit into
mainfrom
worktree-actions-bump
Aug 21, 2026
Merged

ci: move off Node 20 actions (checkout v7, setup-dotnet v6)#7
coccor merged 1 commit into
mainfrom
worktree-actions-bump

Conversation

@coccor

@coccor coccor commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

Why

actions/checkout@v4 and actions/setup-dotnet@v4 run on Node 20, which GitHub deprecated. The runner already force-runs them on Node 24 and annotates every job with a warning. Force-running is a grace period, not a contract — when it ends, these steps fail rather than warn.

What

Action Before After Latest release
actions/checkout v4 v7 v7.0.1
actions/setup-dotnet v4 v6 v6.0.0
NuGet/login v1 v1 (unchanged) v1.2.0, tracked by v1

Both majors are input-compatible with what this repo passes (fetch-depth, dotnet-version), so this is version-only — no workflow logic changed.

Breaking changes checked, none apply

  • checkout v7.0.0 blocks fork-PR checkout under pull_request_target and workflow_run. Neither workflow uses those triggers — ci.yml is push + plain pull_request, release.yml is a v* tag push.
  • setup-dotnet v5.4 added strict sdk.version validation for global.json when rollForward is set. This repo has no global.json.
  • setup-dotnet v6.0.0 is an ESM + dependency migration with no input changes.

Verification

CI on this PR is the test: build-test (ubuntu-latest), build-test (windows-latest) and pack-and-verify all exercise the bumped steps, and the Node 20 deprecation annotation should be gone from the run.

release.yml is tag-triggered, so its bump cannot be exercised by this PR. It changed identically to ci.yml's and shares the same two actions and inputs.

actions/checkout@v4 and actions/setup-dotnet@v4 both run on Node 20,
which GitHub deprecated: the runner already force-runs them on Node 24
and annotates every job with a warning. Force-running is a grace period,
not a contract -- when it ends these steps fail rather than warn.

Both majors are input-compatible with what this repo passes
(fetch-depth, dotnet-version), so the bump is version-only.

checkout v7's one breaking change blocks fork-PR checkout under
`pull_request_target` and `workflow_run`. Neither workflow uses those
triggers -- ci.yml is push + plain `pull_request`, release.yml is a `v*`
tag push -- so nothing here is affected.

setup-dotnet v5.4 added strict `sdk.version` validation for global.json
when rollForward is set; this repo has no global.json, so that path is
never taken.

NuGet/login stays at v1: v1 already tracks the newest release (v1.2.0).
@coccor
coccor merged commit 08b8821 into main Aug 21, 2026
3 checks passed
@coccor
coccor deleted the worktree-actions-bump branch August 21, 2026 08:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant