CI: bump actions off deprecated Node.js 20 runtime - #766
Merged
Conversation
GitHub is deprecating the Node.js 20 runtime for actions. Bump the flagged actions to versions that target Node.js 24: - actions/checkout v4 -> v5 - actions/cache/restore, actions/cache/save v4 -> v5 - codecov/codecov-action v4 -> v5 (now a composite action) - mamba-org/setup-micromamba v2 -> v3 All input names and usage are unchanged; these are drop-in updates.
Contributor
📝 WalkthroughWalkthroughChangesCI action upgrades
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8).github/actions/mamba-install-dascore/action.ymlTraceback (most recent call last): .github/workflows/build_deploy_master_docs.yamlTraceback (most recent call last): .github/workflows/build_deploy_stable_docs.yamlTraceback (most recent call last):
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/runtests.yml (1)
82-88: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse Codecov Action v6 for Node.js 24 support.
Codecov Action v6 is the release that officially supports Node.js 24; update these pinned uses to
codecov/codecov-action@v6unless the workflow is intentionally constrained to v5/non-Node24 environments.
.github/workflows/runtests.yml.github/workflows/get_coverage.yml🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/runtests.yml around lines 82 - 88, Update the Codecov action references from v5 to v6 in the upload steps of .github/workflows/runtests.yml (lines 82-88) and .github/workflows/get_coverage.yml (lines 32-38), preserving their existing configuration.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build_deploy_master_docs.yaml:
- Around line 34-37: Disable checkout credential persistence for every listed
actions/checkout site by setting persist-credentials to false within each
existing with block; for the single-line checkout steps in
.github/workflows/run_min_dep_tests.yml#36 and
.github/workflows/runtests.yml#38, add a with block containing that setting.
Apply this to .github/workflows/build_deploy_master_docs.yaml#34-37,
.github/workflows/build_deploy_stable_docs.yaml#29-32,
.github/workflows/lint.yml#19-22, .github/workflows/profile.yml#30-33, both
sites in .github/workflows/run_min_dep_tests.yml#36 and `#54-57`, both sites in
.github/workflows/runtests.yml#38 and `#60-63`,
.github/workflows/test_doc_build.yml#18-21,
.github/workflows/upload_pypi.yml#12-15, and
.github/workflows/get_coverage.yml#13-16.
---
Outside diff comments:
In @.github/workflows/runtests.yml:
- Around line 82-88: Update the Codecov action references from v5 to v6 in the
upload steps of .github/workflows/runtests.yml (lines 82-88) and
.github/workflows/get_coverage.yml (lines 32-38), preserving their existing
configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 19a487bf-72c7-4f32-b315-a506fc69c935
📒 Files selected for processing (10)
.github/actions/mamba-install-dascore/action.yml.github/workflows/build_deploy_master_docs.yaml.github/workflows/build_deploy_stable_docs.yaml.github/workflows/get_coverage.yml.github/workflows/lint.yml.github/workflows/profile.yml.github/workflows/run_min_dep_tests.yml.github/workflows/runtests.yml.github/workflows/test_doc_build.yml.github/workflows/upload_pypi.yml
Comment on lines
+34
to
37
| - uses: actions/checkout@v5 | ||
| with: | ||
| fetch-tags: "true" | ||
| fetch-depth: '0' |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable unnecessary checkout credential persistence across all workflows.
Every upgraded checkout still uses the default persist-credentials: true, and subsequent steps execute repository or local action code. Add persist-credentials: false at each site unless authenticated Git operations are explicitly required. (raw.githubusercontent.com)
.github/workflows/build_deploy_master_docs.yaml#L34-L37: addpersist-credentials: false..github/workflows/build_deploy_stable_docs.yaml#L29-L32: addpersist-credentials: false..github/workflows/lint.yml#L19-L22: addpersist-credentials: false..github/workflows/profile.yml#L30-L33: addpersist-credentials: false..github/workflows/run_min_dep_tests.yml#L36-L36: add awithblock containingpersist-credentials: false..github/workflows/run_min_dep_tests.yml#L54-L57: addpersist-credentials: false..github/workflows/runtests.yml#L38-L38: add awithblock containingpersist-credentials: false..github/workflows/runtests.yml#L60-L63: addpersist-credentials: false..github/workflows/test_doc_build.yml#L18-L21: addpersist-credentials: false..github/workflows/upload_pypi.yml#L12-L15: addpersist-credentials: false..github/workflows/get_coverage.yml#L13-L16: addpersist-credentials: false.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 34-37: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 9 files
.github/workflows/build_deploy_master_docs.yaml#L34-L37(this comment).github/workflows/build_deploy_stable_docs.yaml#L29-L32.github/workflows/lint.yml#L19-L22.github/workflows/profile.yml#L30-L33.github/workflows/run_min_dep_tests.yml#L36-L36.github/workflows/run_min_dep_tests.yml#L54-L57.github/workflows/runtests.yml#L38-L38.github/workflows/runtests.yml#L60-L63.github/workflows/test_doc_build.yml#L18-L21.github/workflows/upload_pypi.yml#L12-L15.github/workflows/get_coverage.yml#L13-L16
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build_deploy_master_docs.yaml around lines 34 - 37,
Disable checkout credential persistence for every listed actions/checkout site
by setting persist-credentials to false within each existing with block; for the
single-line checkout steps in .github/workflows/run_min_dep_tests.yml#36 and
.github/workflows/runtests.yml#38, add a with block containing that setting.
Apply this to .github/workflows/build_deploy_master_docs.yaml#34-37,
.github/workflows/build_deploy_stable_docs.yaml#29-32,
.github/workflows/lint.yml#19-22, .github/workflows/profile.yml#30-33, both
sites in .github/workflows/run_min_dep_tests.yml#36 and `#54-57`, both sites in
.github/workflows/runtests.yml#38 and `#60-63`,
.github/workflows/test_doc_build.yml#18-21,
.github/workflows/upload_pypi.yml#12-15, and
.github/workflows/get_coverage.yml#13-16.
Source: Linters/SAST tools
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #766 +/- ##
=======================================
Coverage 99.93% 99.93%
=======================================
Files 145 145
Lines 12857 12857
=======================================
Hits 12849 12849
Misses 8 8
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
d-chambers
added a commit
that referenced
this pull request
Jul 24, 2026
* Improve draft-release skill effectiveness (#745) * Raise CoordError instead of assert for non-1D coord operations (#747) * Raise CoordError instead of assert for non-1D coord operations Several coordinate operations that only support 1D coords guarded their input with `assert`, which raises a bare AssertionError and is stripped entirely under `python -O` (so the check silently vanishes in optimized runs). Convert the user-reachable ones -- select-by-sample-array, align_to, get_sample_count, CoordPartial.change_length, and CoordRange construction -- to raise CoordError. Genuine internal invariants that are impossible by construction (CoordRange.change_length) stay as asserts. Add tests covering each new error path. * Extend assert->raise cleanup to proc, viz, and wav IO Apply the same treatment repo-wide to user-reachable asserts that validate caller input, converting them to ParameterError: - proc/taper: taper window must be a length-2 sequence - proc/detrend: dim must be in the patch - proc/correlate: patch must be 2D - viz/map_fiber: x/y/color must be existing coords; scale_type and scale validated - io/wav: only single-patch spools can be written to wav Internal invariants (impossible-by-construction shape/postcondition checks, binary-format parser consistency) are left as asserts. Adds tests for every new error path; the five changed modules keep 100% line coverage. * Fix/fbe decibel (#755) * fixed decibel scaling factore to 20 (was 10) * fixed test to match new decibel factor * implemented gap-sensistive waterfall plot (#753) * implemented gap-sensistive waterfall plot * added 3 more tests * refactor gap_detection and mesh-coordinates; handle datetime64 natively * Add no-op fast paths for transpose/squeeze and idempotent coordinate snapping (#765) * CI: bump actions off deprecated Node.js 20 runtime (#766) * Skip reparsing canonical CoordRange coords in CoordManager update/select (#768) --------- Co-authored-by: Andreas Wuestefeld <115324323+andreas-wuestefeld@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
GitHub is deprecating the Node.js 20 runtime for JavaScript actions
(changelog).
Recent CI runs emitted:
This bumps exactly those actions to releases that target Node.js 24, clearing
the warning before the runtime is removed.
Changes
actions/checkoutactions/cache/restore,actions/cache/savepath,key)codecov/codecov-actionfiles,flags,name,token,fail_ci_if_error) are unchangedmamba-org/setup-micromambamicromamba-version,environment-file,init-shell,cache-environment,cache-environment-key,post-cleanup,create-args) still presentNo inputs or behavior changed — these are drop-in version bumps verified against
each action's current
action.yml.Verification
pre-commit(YAML check + actionlint "Lint GitHub Actions workflow files") passes.TestCode,TestCodeMinDeps, and the docbuild all trigger and will exercise
checkout@v5,cache@v5,setup-micromamba@v3, andcodecov-action@v5end to end.Out of scope
Other pinned actions still on the node20 runtime (e.g.
actions/setup-python,actions/upload-artifact,astral-sh/setup-uv,conda-incubator/setup-miniconda,release/docs actions) will surface the same warning when their workflows run;
those can be bumped in a follow-up. This PR is limited to the four actions named
in the deprecation warning.
Summary by CodeRabbit
Chores
Tests
Documentation