Skip to content

ci: upgrade GitHub Actions to Node 24 majors#6

Merged
Wuesteon merged 2 commits into
mainfrom
ci-node24-actions
Jul 22, 2026
Merged

ci: upgrade GitHub Actions to Node 24 majors#6
Wuesteon merged 2 commits into
mainfrom
ci-node24-actions

Conversation

@Wuesteon

Copy link
Copy Markdown
Owner

Summary

GitHub is deprecating Node 20 action runtimes (runners already force such actions onto Node 24 with a warning). This bumps every action in our three workflows to its current Node 24 major. Release notes were checked at each major hop; one bump required a behavioral fix.

Action From To Notes
actions/checkout v4 v7 v7's fork-PR restriction only affects pull_request_target/workflow_run triggers — none used here
actions/setup-python v5 v7 removed pip-install input was never used
actions/upload-artifact v4 v7 standard dir upload, no breaking behavior
actions/download-artifact v4 v8 v5's path break affects by-ID downloads only; release.yml downloads by name. v8 defaults digest-mismatch to error — a hardening win
astral-sh/setup-uv v5 v9.0.0 see below

setup-uv: the one real change

  • Since v6, python-version alone no longer auto-activates a venv. test.yml relied on that (the uv pip install -e / uv run pytest steps target the exported VIRTUAL_ENV), so activate-environment: true is now set explicitly, with comments updated.
  • Since v8, setup-uv stopped publishing major tags (supply-chain hardening after the tj-actions attack), so it's pinned to the full v9.0.0 tag.
  • v9 changed prune-cache default to false — neutral for us, enable-cache: true unchanged.

pypa/gh-action-pypi-publish@release/v1 is untouched: it's a Docker action (no Node runtime) and release/v1 is pypa's recommended ref.

Test plan

  • YAML parses for all three workflows
  • activate-environment input verified present in setup-uv v9.0.0 action.yml (default false, so the explicit true is required)
  • test workflow green on this PR — this is the real proof of the setup-uv venv-activation change (all 6 matrix legs, esp. the sqlite-extension assert step)
  • release.yml / publish-mcp.yml only run on v* tags or manual dispatch; their bumps are validated by release-notes review above and will get live confirmation at the next release

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pe2ssNxcoegYYz7AsUGHPr

Wuesteon added 2 commits July 22, 2026 15:04
GitHub deprecated Node 20 action runtimes; bump every workflow action to
its current Node 24 major, release notes checked at each hop:

- actions/checkout v4 -> v7 (fork-PR block only hits pull_request_target/
  workflow_run triggers, which no workflow here uses)
- actions/setup-python v5 -> v7 (removed pip-install input unused)
- actions/upload-artifact v4 -> v7, download-artifact v4 -> v8
  (v5 path break affects by-ID downloads only; release.yml downloads by
  name; v8 digest-mismatch=error is a hardening win)
- astral-sh/setup-uv v5 -> v9.0.0, pinned to the full tag since v8
  dropped major tags; add activate-environment: true because since v6
  python-version alone no longer activates the venv that the uv pip
  install / uv run steps depend on

pypa/gh-action-pypi-publish@release/v1 untouched: Docker action, no Node
runtime, and release/v1 is pypa's recommended ref.
@Wuesteon
Wuesteon merged commit 982aa51 into main Jul 22, 2026
6 checks passed
@Wuesteon
Wuesteon deleted the ci-node24-actions branch July 22, 2026 07:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant