CI — bump GitHub Actions off Node 20 to clear deprecation warnings - #37
Merged
Conversation
actions/checkout v4.2.2->v5.1.0, actions/upload-artifact v4.6.2->v5.0.0, actions/download-artifact v4.3.0->v5.0.0, actions/setup-node v4->v5.0.0, astral-sh/setup-uv v5->v9.0.0, and pypa/gh-action-pypi-publish v1.14.0->v1.14.2, all re-pinned by commit SHA per the existing convention. site.yml's checkout/setup-node were moved from bare tags to SHA pins for consistency with publish.yml and tests.yml. Verified against each release's notes that none of the breaking changes in these majors apply here: no pull_request_target/workflow_run triggers (checkout v5.1.0's fork-PR restriction), no by-ID artifact downloads (download-artifact v5's path-nesting fix), no manifest-file/server-url inputs (setup-uv v7/v8). gh-action-pypi-publish stays on the same 1.14.x Trusted Publisher + attestations flow that published bc-cli 0.7.0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Commit
ea1de6a, authored 2026-08-05, had been sitting on a local branch thatwas never pushed — no remote branch, no PR.
mainstill carries every one ofthe old pins, so the Node 20 deprecation warnings are still live in CI.
Opening it now, unchanged, as its author wrote it.
Business Impact
Clears the Node 20 deprecation warnings on every workflow run. GitHub eventually
force-migrates Node 20 actions and then unpinned/older majors start failing, so
this is maintenance that gets more urgent, not less.
Touches
publish.yml, so it is worth landing while there is no release inflight rather than discovering a problem mid-release.
Changes
Action bumps, all re-pinned by commit SHA per the existing convention:
actions/checkoutactions/upload-artifactactions/download-artifactactions/setup-nodeastral-sh/setup-uvpypa/gh-action-pypi-publishsite.yml'scheckout/setup-nodealso move from bare tags (@v4) to SHApins, matching
publish.ymlandtests.yml.Obsoleted Objects
None.
Verification
Done as part of opening this PR:
all six against the GitHub API (dereferencing annotated tags). All match.
This is the check that matters most for SHA-pinned actions — a pin that
doesn't correspond to its comment is either a footgun or worse.
main(
git apply --check). The workflow files are byte-identical between thiscommit's parent and
main, so nothing has drifted underneath it in the12 days it sat unpushed.
Carried over from the original commit message, not independently re-verified
by me — a reviewer may want to confirm:
pull_request_target/workflow_runtriggers (checkout v5.1.0's fork-PRrestriction), no by-ID artifact downloads (download-artifact v5's
path-nesting change), no manifest-file / server-url inputs (setup-uv
v7/v8).
gh-action-pypi-publishstays on the same 1.14.x TrustedPublisher + attestations flow that published bc-cli 0.7.0.
astral-sh/setup-uvv5 → v9 is a four-major jump; worth a skim of itschangelog even though the claim is that no removed inputs are used here.
Note this branch is based on an older
main(c564308). It was left unrebasedso the authored commit is preserved byte-for-byte; the diff against the merge
base is exactly the table above, and there are no conflicts. Say the word if you
want it rebased for a linear history.
https://claude.ai/code/session_01SfwmhstQdh7c9mB6w3mYUs