From 4559222bc7516003c8fe76a1f2b1f0f930073cd1 Mon Sep 17 00:00:00 2001 From: scottf Date: Tue, 25 Aug 2026 10:27:50 -0400 Subject: [PATCH 1/4] Update GitHub Actions to Node 24 compatible majors The runners now warn that checkout@v4, setup-java@v4, setup-go@v5 and setup-gradle@v4 declare node20 and are being forced onto Node.js 24. - actions/checkout v4 -> v5 - actions/setup-java v4 -> v5 - actions/setup-go v5 -> v6 - gradle/actions/setup-gradle v4 -> v5 Each of these is the first major of that action to declare node24. Deliberately not going to gradle/actions@v6, which moves the caching logic into the proprietary gradle-actions-caching component. coverallsapp/github-action@v2 is a composite action with no Node runtime of its own and was not flagged. --- .github/workflows/branch-snapshot.yml | 8 ++++---- .github/workflows/build-main.yml | 8 ++++---- .github/workflows/build-pr.yml | 8 ++++---- .github/workflows/build-release.yml | 8 ++++---- 4 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/branch-snapshot.yml b/.github/workflows/branch-snapshot.yml index 90e24b384..844faa082 100644 --- a/.github/workflows/branch-snapshot.yml +++ b/.github/workflows/branch-snapshot.yml @@ -17,16 +17,16 @@ jobs: COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }} steps: - name: Setup JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '8' distribution: 'temurin' - name: Setup Gradle - uses: gradle/actions/setup-gradle@v4 + uses: gradle/actions/setup-gradle@v5 with: gradle-version: '8.14' # Quotes required to prevent YAML converting to number - name: Setup GO - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: stable - name: Install Nats Server @@ -39,7 +39,7 @@ jobs: go build -o ~/.local/bin/nats-server nats-server -v - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Build run: chmod +x gradlew && ./gradlew clean compileJava - name: Verify Javadoc diff --git a/.github/workflows/build-main.yml b/.github/workflows/build-main.yml index 80f6b542a..b9f99c625 100644 --- a/.github/workflows/build-main.yml +++ b/.github/workflows/build-main.yml @@ -18,16 +18,16 @@ jobs: SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }} steps: - name: Setup JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '8' distribution: 'temurin' - name: Setup Gradle - uses: gradle/actions/setup-gradle@v4 + uses: gradle/actions/setup-gradle@v5 with: gradle-version: '8.14' # Quotes required to prevent YAML converting to number - name: Setup GO - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: stable - name: Install Nats Server @@ -40,7 +40,7 @@ jobs: go build -o ~/.local/bin/nats-server nats-server -v - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Build and Test run: chmod +x gradlew && ./gradlew clean test jacocoTestReport - name: Verify Javadoc diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index 94dc2bbb1..ebb48481f 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -16,16 +16,16 @@ jobs: SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }} steps: - name: Setup JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '8' distribution: 'temurin' - name: Setup Gradle - uses: gradle/actions/setup-gradle@v4 + uses: gradle/actions/setup-gradle@v5 with: gradle-version: '8.14' # Quotes required to prevent YAML converting to number - name: Setup GO - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: stable - name: Install Nats Server @@ -38,7 +38,7 @@ jobs: go build -o ~/.local/bin/nats-server nats-server -v - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Build and Test run: chmod +x gradlew && ./gradlew clean test jacocoTestReport - name: Verify Javadoc diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 8acc3e576..628b5c2cf 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -18,16 +18,16 @@ jobs: SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }} steps: - name: Setup JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '8' distribution: 'temurin' - name: Setup Gradle - uses: gradle/actions/setup-gradle@v4 + uses: gradle/actions/setup-gradle@v5 with: gradle-version: '8.14' # Quotes required to prevent YAML converting to number - name: Setup GO - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: stable - name: Install Nats Server @@ -40,7 +40,7 @@ jobs: go build -o ~/.local/bin/nats-server nats-server -v - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Build and Test run: chmod +x gradlew && ./gradlew clean test - name: Verify, Sign and Publish Release From 1e7ceb5bfb1c61109b58791672e4dff2987b43d9 Mon Sep 17 00:00:00 2001 From: scottf Date: Tue, 25 Aug 2026 10:43:40 -0400 Subject: [PATCH 2/4] Set GOTOOLCHAIN=auto on the nats-server build step setup-go@v6 unconditionally exports GOTOOLCHAIN=local, so a go.mod that requires a toolchain newer than 'stable' would fail the build instead of fetching one. Restore the pre-v6 behavior for the nats-server build only. The override goes on the 'Install Nats Server' step rather than the 'Setup GO' step: setGoToolchain() ignores any pre-existing value and exports 'local' to $GITHUB_ENV for all subsequent steps, so only a step-level env on the step that actually runs 'go build' takes effect. --- .github/workflows/branch-snapshot.yml | 4 ++++ .github/workflows/build-main.yml | 4 ++++ .github/workflows/build-pr.yml | 4 ++++ .github/workflows/build-release.yml | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/.github/workflows/branch-snapshot.yml b/.github/workflows/branch-snapshot.yml index 844faa082..3be9d67b4 100644 --- a/.github/workflows/branch-snapshot.yml +++ b/.github/workflows/branch-snapshot.yml @@ -30,6 +30,10 @@ jobs: with: go-version: stable - name: Install Nats Server + env: + # setup-go@v6 exports GOTOOLCHAIN=local. Allow the nats-server build to + # fetch a newer toolchain if its go.mod ever requires one. + GOTOOLCHAIN: auto run: | pkill -9 nats-server 2>/dev/null || true mkdir -p ~/.local/bin diff --git a/.github/workflows/build-main.yml b/.github/workflows/build-main.yml index b9f99c625..bc7f6ba0c 100644 --- a/.github/workflows/build-main.yml +++ b/.github/workflows/build-main.yml @@ -31,6 +31,10 @@ jobs: with: go-version: stable - name: Install Nats Server + env: + # setup-go@v6 exports GOTOOLCHAIN=local. Allow the nats-server build to + # fetch a newer toolchain if its go.mod ever requires one. + GOTOOLCHAIN: auto run: | pkill -9 nats-server 2>/dev/null || true mkdir -p ~/.local/bin diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index ebb48481f..458ee8f88 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -29,6 +29,10 @@ jobs: with: go-version: stable - name: Install Nats Server + env: + # setup-go@v6 exports GOTOOLCHAIN=local. Allow the nats-server build to + # fetch a newer toolchain if its go.mod ever requires one. + GOTOOLCHAIN: auto run: | pkill -9 nats-server 2>/dev/null || true mkdir -p ~/.local/bin diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 628b5c2cf..3ec4a3319 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -31,6 +31,10 @@ jobs: with: go-version: stable - name: Install Nats Server + env: + # setup-go@v6 exports GOTOOLCHAIN=local. Allow the nats-server build to + # fetch a newer toolchain if its go.mod ever requires one. + GOTOOLCHAIN: auto run: | pkill -9 nats-server 2>/dev/null || true mkdir -p ~/.local/bin From ada4864fb0bf1ec2a244bc667b8c836f4d1ac731 Mon Sep 17 00:00:00 2001 From: scottf Date: Tue, 25 Aug 2026 10:50:17 -0400 Subject: [PATCH 3/4] Add dependabot config for GitHub Actions updates Monthly, grouped into a single PR. This is the drift that produced the node20 deprecation warning in the first place. Only the github-actions ecosystem is enabled. gradle is left off on purpose: bcprov-lts8on is an api dependency pinned to the Java 8 LTS line, and equalsverifier 4.x requires Java 17, so automated bumps would either change our published transitive surface or fail to compile against sourceCompatibility 1.8. --- .github/dependabot.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..b5f029316 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,13 @@ +version: 2 +updates: + # GitHub Actions only. The gradle ecosystem is deliberately not enabled: + # bcprov-lts8on is an api dependency on the Java 8 LTS line and equalsverifier + # 4.x requires Java 17, so automated bumps would either change our published + # transitive surface or fail against sourceCompatibility 1.8. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + groups: + github-actions: + patterns: ["*"] From fa955b6bd8959a3879af619590228dc150711a69 Mon Sep 17 00:00:00 2001 From: scottf Date: Tue, 25 Aug 2026 11:00:12 -0400 Subject: [PATCH 4/4] Install nats-server via the shared synadia-io/workflows action Replaces the inlined clone-and-build block in all four workflows, and drops actions/setup-go entirely: the composite action calls 'go build' directly and relies on the Go preinstalled on the runner image. This also removes the GOTOOLCHAIN concern from the previous commit. Nothing sets GOTOOLCHAIN now, so it defaults to 'auto' and the nats-server build fetches the toolchain its go.mod names. Also drops the dependabot config added earlier on this branch. --- .github/dependabot.yml | 13 ------------- .github/workflows/branch-snapshot.yml | 17 +---------------- .github/workflows/build-main.yml | 17 +---------------- .github/workflows/build-pr.yml | 17 +---------------- .github/workflows/build-release.yml | 17 +---------------- 5 files changed, 4 insertions(+), 77 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index b5f029316..000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,13 +0,0 @@ -version: 2 -updates: - # GitHub Actions only. The gradle ecosystem is deliberately not enabled: - # bcprov-lts8on is an api dependency on the Java 8 LTS line and equalsverifier - # 4.x requires Java 17, so automated bumps would either change our published - # transitive surface or fail against sourceCompatibility 1.8. - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "monthly" - groups: - github-actions: - patterns: ["*"] diff --git a/.github/workflows/branch-snapshot.yml b/.github/workflows/branch-snapshot.yml index 3be9d67b4..dcc329cc9 100644 --- a/.github/workflows/branch-snapshot.yml +++ b/.github/workflows/branch-snapshot.yml @@ -25,23 +25,8 @@ jobs: uses: gradle/actions/setup-gradle@v5 with: gradle-version: '8.14' # Quotes required to prevent YAML converting to number - - name: Setup GO - uses: actions/setup-go@v6 - with: - go-version: stable - name: Install Nats Server - env: - # setup-go@v6 exports GOTOOLCHAIN=local. Allow the nats-server build to - # fetch a newer toolchain if its go.mod ever requires one. - GOTOOLCHAIN: auto - run: | - pkill -9 nats-server 2>/dev/null || true - mkdir -p ~/.local/bin - cd $GITHUB_WORKSPACE - git clone https://github.com/nats-io/nats-server.git - cd nats-server - go build -o ~/.local/bin/nats-server - nats-server -v + uses: synadia-io/workflows/.github/actions/install_nats_server@main - name: Check out code uses: actions/checkout@v5 - name: Build diff --git a/.github/workflows/build-main.yml b/.github/workflows/build-main.yml index bc7f6ba0c..aea46ff62 100644 --- a/.github/workflows/build-main.yml +++ b/.github/workflows/build-main.yml @@ -26,23 +26,8 @@ jobs: uses: gradle/actions/setup-gradle@v5 with: gradle-version: '8.14' # Quotes required to prevent YAML converting to number - - name: Setup GO - uses: actions/setup-go@v6 - with: - go-version: stable - name: Install Nats Server - env: - # setup-go@v6 exports GOTOOLCHAIN=local. Allow the nats-server build to - # fetch a newer toolchain if its go.mod ever requires one. - GOTOOLCHAIN: auto - run: | - pkill -9 nats-server 2>/dev/null || true - mkdir -p ~/.local/bin - cd $GITHUB_WORKSPACE - git clone https://github.com/nats-io/nats-server.git - cd nats-server - go build -o ~/.local/bin/nats-server - nats-server -v + uses: synadia-io/workflows/.github/actions/install_nats_server@main - name: Check out code uses: actions/checkout@v5 - name: Build and Test diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index 458ee8f88..47593af9c 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -24,23 +24,8 @@ jobs: uses: gradle/actions/setup-gradle@v5 with: gradle-version: '8.14' # Quotes required to prevent YAML converting to number - - name: Setup GO - uses: actions/setup-go@v6 - with: - go-version: stable - name: Install Nats Server - env: - # setup-go@v6 exports GOTOOLCHAIN=local. Allow the nats-server build to - # fetch a newer toolchain if its go.mod ever requires one. - GOTOOLCHAIN: auto - run: | - pkill -9 nats-server 2>/dev/null || true - mkdir -p ~/.local/bin - cd $GITHUB_WORKSPACE - git clone https://github.com/nats-io/nats-server.git - cd nats-server - go build -o ~/.local/bin/nats-server - nats-server -v + uses: synadia-io/workflows/.github/actions/install_nats_server@main - name: Check out code uses: actions/checkout@v5 - name: Build and Test diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 3ec4a3319..2a140a09d 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -26,23 +26,8 @@ jobs: uses: gradle/actions/setup-gradle@v5 with: gradle-version: '8.14' # Quotes required to prevent YAML converting to number - - name: Setup GO - uses: actions/setup-go@v6 - with: - go-version: stable - name: Install Nats Server - env: - # setup-go@v6 exports GOTOOLCHAIN=local. Allow the nats-server build to - # fetch a newer toolchain if its go.mod ever requires one. - GOTOOLCHAIN: auto - run: | - pkill -9 nats-server 2>/dev/null || true - mkdir -p ~/.local/bin - cd $GITHUB_WORKSPACE - git clone https://github.com/nats-io/nats-server.git - cd nats-server - go build -o ~/.local/bin/nats-server - nats-server -v + uses: synadia-io/workflows/.github/actions/install_nats_server@main - name: Check out code uses: actions/checkout@v5 - name: Build and Test