From db1e58e3870e291961fe9c6c1bcd380d95f77463 Mon Sep 17 00:00:00 2001 From: Wuesteon Date: Wed, 22 Jul 2026 15:04:08 +0800 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=91=B7=20ci:=20upgrade=20actions=20to?= =?UTF-8?q?=20Node=2024=20majors?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub deprecated Node 20 action runtimes; bump every workflow action to its current Node 24 major, release notes checked at each hop: - actions/checkout v4 -> v7 (fork-PR block only hits pull_request_target/ workflow_run triggers, which no workflow here uses) - actions/setup-python v5 -> v7 (removed pip-install input unused) - actions/upload-artifact v4 -> v7, download-artifact v4 -> v8 (v5 path break affects by-ID downloads only; release.yml downloads by name; v8 digest-mismatch=error is a hardening win) - astral-sh/setup-uv v5 -> v9.0.0, pinned to the full tag since v8 dropped major tags; add activate-environment: true because since v6 python-version alone no longer activates the venv that the uv pip install / uv run steps depend on pypa/gh-action-pypi-publish@release/v1 untouched: Docker action, no Node runtime, and release/v1 is pypa's recommended ref. --- .github/workflows/publish-mcp.yml | 2 +- .github/workflows/release.yml | 16 ++++++++-------- .github/workflows/test.yml | 11 ++++++++--- 3 files changed, 17 insertions(+), 12 deletions(-) diff --git a/.github/workflows/publish-mcp.yml b/.github/workflows/publish-mcp.yml index af63d52..86f5c96 100644 --- a/.github/workflows/publish-mcp.yml +++ b/.github/workflows/publish-mcp.yml @@ -26,7 +26,7 @@ jobs: contents: read steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install mcp-publisher run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cf7d6fa..701ed32 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,9 +19,9 @@ jobs: name: Build sdist + wheel (core) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.13" @@ -31,7 +31,7 @@ jobs: python -m build - name: Upload dist artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: dist path: dist/ @@ -40,9 +40,9 @@ jobs: name: Build sdist + wheel (console) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.13" @@ -52,7 +52,7 @@ jobs: python -m build console/ --outdir console-dist/ - name: Upload console dist artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: console-dist path: console-dist/ @@ -66,7 +66,7 @@ jobs: id-token: write steps: - name: Download dist artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: dist path: dist/ @@ -85,7 +85,7 @@ jobs: id-token: write steps: - name: Download console dist artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: console-dist path: console-dist/ diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 9579349..fd757d8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,18 +28,23 @@ jobs: - os: ubuntu-latest python-version: "3.12" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # Provision Python via uv (python-build-standalone). Unlike # actions/setup-python, these builds are compiled with loadable-sqlite # extensions enabled, which sqlite-vec needs to load — the macOS # setup-python builds are not, so extension loading fails there. # One code path for both OSes. + # setup-uv stopped publishing major tags in v8 (supply-chain hardening), + # so this must pin a full release tag. - name: Set up uv + Python ${{ matrix.python-version }} - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@v9.0.0 with: python-version: ${{ matrix.python-version }} enable-cache: true + # Since setup-uv v6, python-version alone no longer activates a venv; + # this input restores the exported VIRTUAL_ENV the steps below rely on. + activate-environment: true env: # Force uv's managed python-build-standalone builds and NEVER a # system/toolcache interpreter: runner images vary in whether their @@ -53,7 +58,7 @@ jobs: - name: Assert loadable-sqlite-extensions support run: uv run python -c "import sqlite3; assert hasattr(sqlite3.Connection, 'enable_load_extension'), 'CPython built without --enable-loadable-sqlite-extensions'" - # setup-uv with a python-version input already provisions and activates a + # setup-uv with activate-environment: true provisions and activates a # venv (it exports VIRTUAL_ENV), so no explicit `uv venv` step is needed — # the install below targets that activated environment. - name: Install (editable, dev + mcp extras) From c3ef0a1ff88674e2f40f651a565c76d879164465 Mon Sep 17 00:00:00 2001 From: Wuesteon Date: Wed, 22 Jul 2026 15:08:03 +0800 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=93=9D=20docs:=20log=20CI=20actions?= =?UTF-8?q?=20bump=20under=20Unreleased?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1adefaa..cf5700e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] -Nothing yet. +### Changed + +- CI: all workflow actions bumped to their Node 24 majors (checkout v7, + setup-python v7, upload-artifact v7, download-artifact v8, setup-uv + v9.0.0 with explicit `activate-environment: true`), clearing GitHub's + Node 20 runtime deprecation warnings. No user-facing changes. ## [0.2.1] - 2026-07-21