From f9a7d20b47b86a95931faa246d3d13b5f28d0706 Mon Sep 17 00:00:00 2001 From: RNT56 Date: Sun, 12 Jul 2026 05:17:02 +0200 Subject: [PATCH] chore: move workflows to Node 24 actions Upgrade the official checkout, setup-go, upload-artifact, and download-artifact majors to their current Node 24 implementations so CI no longer relies on GitHub runner compatibility shims. --- .github/workflows/ci.yml | 38 +++++++++++++++++------------------ .github/workflows/release.yml | 10 ++++----- CHANGELOG.md | 2 ++ 3 files changed, 26 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 92771c8..be68113 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,8 +20,8 @@ jobs: name: govulncheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true @@ -35,8 +35,8 @@ jobs: name: release + installer integrity (local E2E) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true @@ -60,8 +60,8 @@ jobs: GIT_COMMITTER_NAME: nilcore-ci GIT_COMMITTER_EMAIL: ci@nilcore.local steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true @@ -82,8 +82,8 @@ jobs: GIT_COMMITTER_NAME: nilcore-ci GIT_COMMITTER_EMAIL: ci@nilcore.local steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true @@ -107,8 +107,8 @@ jobs: GIT_COMMITTER_NAME: nilcore-ci GIT_COMMITTER_EMAIL: ci@nilcore.local steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true @@ -119,13 +119,13 @@ jobs: name: golangci-lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true - name: golangci-lint - uses: golangci/golangci-lint-action@v7 + uses: golangci/golangci-lint-action@v9 with: version: v2.12.2 @@ -138,8 +138,8 @@ jobs: name: namespace sandbox (linux confinement) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true @@ -170,8 +170,8 @@ jobs: GIT_COMMITTER_NAME: nilcore-ci GIT_COMMITTER_EMAIL: ci@nilcore.local steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true @@ -195,8 +195,8 @@ jobs: name: browser behavioral verification (D1 live run) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 48e821f..289ed38 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,8 +20,8 @@ jobs: goos: [darwin, linux] goarch: [amd64, arm64] steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 with: go-version-file: go.mod cache: true @@ -52,7 +52,7 @@ jobs: # before running the downloaded binary. The file holds " " so a # consumer can `sha256sum -c` it directly. ( cd dist && sha256sum "${out}" > "${out}.sha256" ) - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: nilcore-${{ matrix.goos }}-${{ matrix.goarch }} path: dist/* @@ -63,8 +63,8 @@ jobs: if: startsWith(github.ref, 'refs/tags/') runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/download-artifact@v4 + - uses: actions/checkout@v7 + - uses: actions/download-artifact@v8 with: path: dist merge-multiple: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 60d9cdd..82e3b87 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,6 +30,8 @@ the distribution gap: patched Go and system dependencies, reachable-vulnerabilit fail-closed checksums and installer tests, complete four-platform asset verification, and version identity stamped and executed before publication. +- **ci-node24-actions** — Move the CI and release workflows to the current Node 24 action majors (`checkout@v7`, `setup-go@v6`, `upload-artifact@v7`, `download-artifact@v8`, `golangci-lint-action@v9`), eliminating the runner's forced Node 20 compatibility shims before v1.2.0. _Owns:_ `.github/workflows/{ci,release}.yml`, `CHANGELOG.md`. _(CI maintenance)_ + - **release-v1.2.0** — Cut the v1.2.0 changelog boundary, refresh the public release/reference metrics from the live tree, and record the fully gated release baseline; tag publication remains a separately approved irreversible action. _Owns:_ `CHANGELOG.md`, `README.md`, `STATE.md`, `docs/REFERENCE.md`. _(release)_ - **release-version-stamp** — Stamp validated version tags into every release binary, execute the native matrix asset to prove `nilcore version` matches the tag, and refuse malformed release refs before publication; the release E2E now verifies identity as well as checksums and completeness. _Owns:_ `.github/workflows/release.yml`, `test/release-assets-e2e.sh`, `CHANGELOG.md`. _(release hardening)_