ci: drop preview sticky comment + fix Node 20 deprecation warnings

.github/workflows/ci.yml

@@ -22,7 +22,6 @@ jobs:
     permissions:
       contents: read
       deployments: write
-      pull-requests: write
     steps:
       - uses: actions/checkout@v6
 
@@ -86,18 +85,19 @@ jobs:
       - name: Deploy preview to Cloudflare Workers
         if: github.head_ref != 'dev' && github.head_ref != 'main'
         id: deploy_preview
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           command: versions upload --env preview --preview-alias pr-${{ github.event.pull_request.number }}
 
       - name: Branch preview deployment
         if: github.head_ref != 'dev' && github.head_ref != 'main'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           # Prefer the alias URL wrangler actually printed (robust to subdomain
-          # changes); fall back to the deterministic constructed URL.
+          # changes); fall back to the deterministic constructed URL. The URL is
+          # surfaced on the PR via the GitHub deployment/Environments UI.
           COMMAND_OUTPUT: ${{ steps.deploy_preview.outputs['command-output'] || '' }}
           FALLBACK_ALIAS_URL: https://pr-${{ github.event.pull_request.number }}-wingdex-app-preview.lianguanlun.workers.dev
         with:
@@ -120,30 +120,3 @@ jobs:
               state: 'success',
               environment_url: previewUrl || undefined,
             });
-
-      # Sticky comment so reviewers always have the per-PR preview URL.
-      - name: Comment preview URL on PR
-        if: github.head_ref != 'dev' && github.head_ref != 'main'
-        uses: actions/github-script@v7
-        env:
-          COMMAND_OUTPUT: ${{ steps.deploy_preview.outputs['command-output'] || '' }}
-          FALLBACK_ALIAS_URL: https://pr-${{ github.event.pull_request.number }}-wingdex-app-preview.lianguanlun.workers.dev
-        with:
-          script: |
-            const out = process.env.COMMAND_OUTPUT || '';
-            const m = out.match(/https:\/\/pr-[a-z0-9-]+-wingdex-app-preview\.[a-z0-9-]+\.workers\.dev/i);
-            const url = (m && m[0]) || process.env.FALLBACK_ALIAS_URL;
-            const marker = '<!-- preview-url -->';
-            const body = `${marker}\n🔎 **Preview for this PR:** ${url}\n\n_Isolated per-PR alias, no longer shared/overwritten across PRs. Updates on every push._`;
-            // Paginate: the sticky marker may be beyond the first page on busy PRs.
-            const comments = await github.paginate(github.rest.issues.listComments, {
-              ...context.repo,
-              issue_number: context.issue.number,
-              per_page: 100,
-            });
-            const existing = comments.find(c => c.body && c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({ ...context.repo, comment_id: existing.id, body });
-            } else {
-              await github.rest.issues.createComment({ ...context.repo, issue_number: context.issue.number, body });
-            }

.github/workflows/cleanup-preview.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Deactivate preview deployments
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const branch = context.payload.pull_request.head.ref;

.github/workflows/release.yml

@@ -67,7 +67,7 @@ jobs:
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
 
       - name: Deploy to Cloudflare Workers
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

.github/workflows/rotate-apple-secret.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Generate Apple client secret JWT
         id: jwt
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const crypto = require('crypto');