From 08c1183ffcb227585d4594954a2ab461a970843d Mon Sep 17 00:00:00 2001 From: TheSaltyKorean Date: Tue, 25 Aug 2026 19:33:57 -0500 Subject: [PATCH] ci: move off the Node 20 actions, and let Dependabot keep them current MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every job on every run was annotated with "Node.js 20 is deprecated … being forced to run on Node.js 24", plus a separate "setup-java v4 is deprecated" notice. The pinned majors had drifted a long way behind: actions/checkout v4 -> v7 actions/setup-java v4 -> v6 actions/upload-artifact v4 -> v7 actions/download-artifact v4 -> v8 All four usages are default ones (name/path on upload; pattern + merge-multiple on download), and both of those inputs still exist in v7/v8, so nothing in the workflows needed rewriting. The behaviour changes in the newer majors are opt-in (`archive`, `skip-decompress`) except download-artifact v8's digest-mismatch enforcement, which is a strictness we want on release assets. Add .github/dependabot.yml so this doesn't drift three majors again. Scoped to github-actions only — the pub tree is deliberately pinned (file_picker 10.x per issue #2, the intl and path_provider_foundation overrides, the Flutter 3.41.9 pin), so version-bump PRs there would be noise closed by hand. Security alerts are unaffected. CI-only, so no version bump (standing rule 9). Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01LKDdZmyggGAvaakLhAaNEM --- .github/dependabot.yml | 25 +++++++++++++++++++++++++ .github/workflows/ci.yml | 18 +++++++++--------- .github/workflows/release.yml | 22 +++++++++++----------- 3 files changed, 45 insertions(+), 20 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..cebecdc --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,25 @@ +version: 2 + +# Scoped to GitHub Actions on purpose. +# +# The `pub` ecosystem is deliberately left out: several dependencies here are +# pinned or overridden for reasons Dependabot can't see — file_picker is held +# at 10.x by appflowy_editor's API (issue #2), `intl` and +# `path_provider_foundation` are dependency_overrides, and the whole tree is +# constrained by the Flutter 3.41.9 pin in .fvmrc. Version-bump PRs against +# those would be noise that has to be closed by hand. Dependabot *security* +# alerts still cover pub packages; this file only controls version updates. +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + commit-message: + prefix: ci + # One PR for the routine bumps; a major version gets its own PR, since + # those carry the runtime/behaviour changes worth reviewing alone. + groups: + actions-minor: + update-types: + - minor + - patch diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a8dd951..2cc186f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ jobs: name: Analyze & test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: subosito/flutter-action@v2 with: flutter-version: ${{ env.FLUTTER_VERSION }} @@ -33,8 +33,8 @@ jobs: needs: analyze-test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-java@v6 with: distribution: temurin java-version: "17" @@ -46,7 +46,7 @@ jobs: - run: flutter pub get - run: flutter build apk --release - run: flutter build appbundle --release - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: android path: | @@ -58,7 +58,7 @@ jobs: needs: analyze-test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Linux build deps run: | sudo apt-get update @@ -70,7 +70,7 @@ jobs: cache: true - run: flutter pub get - run: flutter build linux --release - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: linux path: build/linux/x64/release/bundle/ @@ -80,7 +80,7 @@ jobs: needs: analyze-test runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: subosito/flutter-action@v2 with: flutter-version: ${{ env.FLUTTER_VERSION }} @@ -88,7 +88,7 @@ jobs: cache: true - run: flutter pub get - run: flutter build windows --release - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: windows path: build/windows/x64/runner/Release/ @@ -98,7 +98,7 @@ jobs: needs: analyze-test runs-on: macos-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: subosito/flutter-action@v2 with: flutter-version: ${{ env.FLUTTER_VERSION }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f5f9d60..a870e88 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,8 +39,8 @@ jobs: # and lose data). HAS_KEYSTORE: ${{ secrets.ANDROID_KEYSTORE_BASE64 != '' }} steps: - - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-java@v6 with: distribution: temurin java-version: "17" @@ -85,7 +85,7 @@ jobs: echo "::notice::ANDROID_KEYSTORE_* secrets not configured — Android artifacts skipped (a per-run debug key would change the signing certificate every release and break in-place updates)." - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 if: env.HAS_KEYSTORE == 'true' with: name: release-android @@ -99,7 +99,7 @@ jobs: # desktops. runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Compute package version # Dispatch dry-runs come from branches (no semver): package as 0.0.0. run: | @@ -166,7 +166,7 @@ jobs: sed -i 's/^ //' "$PKG/DEBIAN/control" dpkg-deb --build --root-owner-group "$PKG" \ "dist/markdown-studio-linux-amd64.deb" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: release-linux path: dist/ @@ -179,7 +179,7 @@ jobs: # exist; secrets can't be used in step `if:` directly. HAS_STORE_IDENTITY: ${{ secrets.MSIX_IDENTITY_NAME != '' && secrets.MSIX_PUBLISHER != '' && secrets.MSIX_PUBLISHER_DISPLAY_NAME != '' }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Compute package version shell: pwsh run: | @@ -280,7 +280,7 @@ jobs: --publisher-display-name $env:MSIX_PUBLISHER_DISPLAY_NAME Copy-Item build/windows/x64/runner/Release/markdown_studio.msix ` dist/markdown-studio-windows-store.msix - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: release-windows path: dist/ @@ -289,7 +289,7 @@ jobs: name: macOS + iOS (unsigned) runs-on: macos-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: subosito/flutter-action@v2 with: flutter-version: ${{ env.FLUTTER_VERSION }} @@ -310,7 +310,7 @@ jobs: mkdir -p Payload cp -R build/ios/iphoneos/Runner.app Payload/ zip -qry "dist/markdown-studio-ios-unsigned.ipa" Payload - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: release-apple path: dist/ @@ -326,8 +326,8 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 - - uses: actions/download-artifact@v4 + - uses: actions/checkout@v7 + - uses: actions/download-artifact@v8 with: pattern: release-* merge-multiple: true