ci: move off the Node 20 actions, and let Dependabot keep them current - #85
Merged
Conversation
Every job on every run was annotated with "Node.js 20 is deprecated … being forced to run on Node.js 24", plus a separate "setup-java v4 is deprecated" notice. The pinned majors had drifted a long way behind: actions/checkout v4 -> v7 actions/setup-java v4 -> v6 actions/upload-artifact v4 -> v7 actions/download-artifact v4 -> v8 All four usages are default ones (name/path on upload; pattern + merge-multiple on download), and both of those inputs still exist in v7/v8, so nothing in the workflows needed rewriting. The behaviour changes in the newer majors are opt-in (`archive`, `skip-decompress`) except download-artifact v8's digest-mismatch enforcement, which is a strictness we want on release assets. Add .github/dependabot.yml so this doesn't drift three majors again. Scoped to github-actions only — the pub tree is deliberately pinned (file_picker 10.x per issue #2, the intl and path_provider_foundation overrides, the Flutter 3.41.9 pin), so version-bump PRs there would be noise closed by hand. Security alerts are unaffected. CI-only, so no version bump (standing rule 9). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LKDdZmyggGAvaakLhAaNEM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every job on every run carried the annotation "Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24", plus a separate "setup-java v4 is deprecated" notice. Those were the only warnings on the release run.
The pinned majors had drifted a long way behind:
actions/checkoutactions/setup-javaactions/upload-artifactactions/download-artifactAll four usages are default ones —
name/pathon upload,pattern+merge-multipleon download — and I checked both inputs still exist in v7/v8, so nothing in the workflows needed rewriting. The behaviour changes in the newer majors are opt-in (archive,skip-decompress); the one default change is download-artifact v8 erroring on digest mismatch, which is strictness worth having on release assets.Also adds
.github/dependabot.ymlso this doesn't drift three majors again. Scoped togithub-actionsonly — the pub tree is deliberately pinned (file_picker10.x per #2, theintlandpath_provider_foundationoverrides, the Flutter 3.41.9 pin), so version-bump PRs there would be noise closed by hand. Dependabot security alerts are unaffected by this file.For the record: there are currently no open Dependabot alerts on the repo, and no code scanning is configured.
CI-only, so no version bump (standing rule 9).
Verification
This PR's own CI run exercises checkout, setup-java and upload-artifact across all four platform builds.
release.yml'sdownload-artifactisn't covered by PR CI — I'd like to prove it with aworkflow_dispatchrun on this branch, whichRELEASING.mddocuments as a dry run that builds everything but publishes nothing.🤖 Generated with Claude Code
https://claude.ai/code/session_01LKDdZmyggGAvaakLhAaNEM