ci(l1,l2): bump deprecated GitHub Actions to v6#6554
ci(l1,l2): bump deprecated GitHub Actions to v6#6554avilagaston9 wants to merge 3 commits intomainfrom
Conversation
from v4 to v6 across every workflow and composite action. Silences the Node.js 20 deprecation warnings emitted on every release run. GitHub will force Node.js 24 by default starting June 2nd, 2026 and remove the Node.js 20 runner on September 16th, 2026; v6 is the latest stable major for all three actions and runs on Node.js 24. Affects 27 files, 107 occurrences, all pure version-string changes. Verified locally with `actionlint -ignore SC2086 -ignore SC2006 -ignore SC2046`, exit status 0.
🤖 Kimi Code ReviewCritical Issue: Non-existent Action Versions The PR upgrades
Recommendation: Verify the target version. If upgrading artifact actions, note that Pre-existing Typo (Not Critical) The typo "etherex" (instead of "ethrex") persists in Automated review by Kimi (Moonshot AI) · kimi-k2.5 · custom prompt |
🤖 Claude Code ReviewHere is the review for PR #6554: PR #6554 —
|
Greptile SummaryThis PR is a mechanical CI maintenance update that bumps three GitHub Actions from Confidence Score: 5/5Safe to merge — purely mechanical version bump with no logic changes. All 107 changes are identical find-and-replace version bumps. The PR description correctly identifies and dismisses the only relevant v5/v6 breaking change (artifact immutability) by auditing every artifact name. No duplicate artifact names exist within any single run. No files require special attention.
|
| Filename | Overview |
|---|---|
| .github/workflows/tag_release.yaml | 9 action bumps (checkout×4, upload-artifact×5, download-artifact×6); all artifact names are unique or matrix-templated, so immutability constraint is satisfied. |
| .github/workflows/pr-main_l2.yaml | Most-changed workflow file; checkout, upload-artifact, and download-artifact all bumped to v6 with no logic changes. |
| .github/workflows/pr-main_l1.yaml | Routine bump of checkout×5, upload-artifact×2, download-artifact×2; artifact names are unique per run. |
| .github/actions/snapsync-run/action.yml | Single checkout bump inside the composite action; no issues. |
| .github/workflows/pr_loc.yaml | Three separate checkout steps all bumped to v6; no behavior change expected. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A["GitHub Actions Runner\n(Node.js 24 enforced Jun 2026)"] --> B{Action version}
B -- "v4 (before)" --> C["⚠️ Node.js 20 deprecation warning\nRemoved Sep 16 2026"]
B -- "v6 (after)" --> D["✅ Node.js 24 compatible\nNo deprecation warning"]
D --> E["actions/checkout@v6\n66 refs → 24 files"]
D --> F["actions/upload-artifact@v6\n17 refs → immutable backend"]
D --> G["actions/download-artifact@v6\n24 refs → immutable backend"]
F --> H{Artifact names unique\nper run?}
H -- "Yes (matrix-templated or\nconditional)" --> I["✅ No immutability conflict"]
H -- "No" --> J["❌ Workflow would fail"]
Reviews (1): Last reviewed commit: "Bump GitHub Actions checkout, upload-art..." | Re-trigger Greptile
There was a problem hiding this comment.
Pull request overview
Updates GitHub Actions workflow dependencies to eliminate Node.js 20 deprecation warnings and ensure compatibility with the upcoming default switch to Node.js 24 on GitHub-hosted runners.
Changes:
- Bump
actions/checkoutfrom@v4to@v6across workflows and a composite action. - Bump
actions/upload-artifactandactions/download-artifactfrom@v4to@v6across workflows.
Reviewed changes
Copilot reviewed 27 out of 27 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/tag_release.yaml | Bump checkout/upload/download artifact actions to @v6 in the release workflow. |
| .github/workflows/pr_upgradeability.yaml | Bump actions/checkout to @v6. |
| .github/workflows/pr_perf_levm.yaml | Bump checkout/upload/download artifact actions to @v6 for perf benchmarking workflows. |
| .github/workflows/pr_perf_build_block_bench.yml | Bump actions/checkout to @v6. |
| .github/workflows/pr_perf_blocks_exec.yaml | Bump checkout/upload-artifact actions to @v6. |
| .github/workflows/pr_nostd.yaml | Bump actions/checkout to @v6. |
| .github/workflows/pr_loc.yaml | Bump actions/checkout to @v6 for all checkouts used in LOC reporting. |
| .github/workflows/pr_lint_readme.yaml | Bump actions/checkout to @v6. |
| .github/workflows/pr_lint_license.yaml | Bump actions/checkout to @v6. |
| .github/workflows/pr_lint_gha.yaml | Bump actions/checkout to @v6. |
| .github/workflows/pr_github_status_l1.yaml | Bump actions/checkout to @v6. |
| .github/workflows/pr_github_metadata.yaml | Bump actions/checkout to @v6. |
| .github/workflows/pr_check_l2_genesis.yml | Bump actions/checkout to @v6. |
| .github/workflows/pr-main_mdbook.yml | Bump checkout/upload/download artifact actions to @v6 for docs build/deploy. |
| .github/workflows/pr-main_levm.yaml | Bump checkout/upload/download artifact actions to @v6 for LEVM PR/main comparison. |
| .github/workflows/pr-main_l2_tdx_build.yaml | Bump actions/checkout to @v6. |
| .github/workflows/pr-main_l2_prover.yaml | Bump actions/checkout to @v6 across L2 prover jobs. |
| .github/workflows/pr-main_l2.yaml | Bump checkout/upload/download artifact actions to @v6 across L2 workflow jobs. |
| .github/workflows/pr-main_l1_l2_dev.yaml | Bump actions/checkout to @v6. |
| .github/workflows/pr-main_l1.yaml | Bump checkout/upload/download artifact actions to @v6 across L1 workflow jobs. |
| .github/workflows/manual_docker_performance_publish.yaml | Bump actions/checkout to @v6. |
| .github/workflows/main_prover.yaml | Bump actions/checkout to @v6. |
| .github/workflows/daily_snapsync.yaml | Bump actions/checkout to @v6. |
| .github/workflows/daily_loc_report.yaml | Bump actions/checkout to @v6. |
| .github/workflows/daily_hive_report.yaml | Bump checkout/upload/download artifact actions to @v6 for daily hive reporting. |
| .github/workflows/common_failure_alerts.yaml | Bump actions/checkout to @v6. |
| .github/actions/snapsync-run/action.yml | Bump actions/checkout to @v6 inside the composite action. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
🤖 Codex Code Review
Assuming Automated review by OpenAI Codex · gpt-5.4 · custom prompt |
Benchmark Results ComparisonNo significant difference was registered for any benchmark run. Detailed ResultsBenchmark Results: BubbleSort
Benchmark Results: ERC20Approval
Benchmark Results: ERC20Mint
Benchmark Results: ERC20Transfer
Benchmark Results: Factorial
Benchmark Results: FactorialRecursive
Benchmark Results: Fibonacci
Benchmark Results: FibonacciRecursive
Benchmark Results: ManyHashes
Benchmark Results: MstoreBench
Benchmark Results: Push
Benchmark Results: SstoreBench_no_opt
|
…r latest Node.js 24 majors so every workflow stops emitting the Node.js 20 deprecation warning. Updates actions/cache and actions/cache/{restore,save} to v5, actions/setup-node to v6, actions/github-script to v8, and actions/create-github-app-token to v3. None of the call sites use the breaking-change surface of these majors (no packageManager field for setup-node auto-cache, no proxy env vars for create-github-app-token, no require('@actions/github') or getOctokit redeclaration for github-script). After this change, a static scan of .github/ reports zero references to first-party Node.js 20 actions, down from 12 on the previous PR commit and 119 on main.
|
RE: Codex's review |
…s 20 to their latest Node-24 majors so every workflow that has an upstream fix stops emitting the deprecation warning. Each bump was audited for breaking changes and security posture before applying. Updates dorny/paths-filter to v4, docker/build-push-action to v7, docker/login-action to v4, docker/setup-buildx-action to v4, docker/setup-qemu-action to v4, peter-evans/find-comment to v4, peter-evans/create-or-update-comment to v5, amannn/action-semantic-pull-request to v6, Jimver/cuda-toolkit to v0.2.35, and softprops/action-gh-release to v3. arduino/setup-protoc is intentionally left at v3 because no Node-24 release exists upstream yet (open PR arduino/setup-protoc#113), so its single call site in tag_release.yaml will continue to emit the warning until that PR merges. After this change, a static scan of .github/ reports a single Node-20 action reference (down from 31 on the previous PR commit and 150 on main), and that reference is the unavoidable arduino/setup-protoc one.
Motivation
Silence the Node.js 20 deprecation warnings emitted on every workflow run. GitHub forces Node.js 24 on June 2nd, 2026 and removes the Node.js 20 runner on September 16th, 2026.
Description
Bumps every first-party
actions/*reference still on Node 20 to its latest Node-24 major:actions/checkoutv4v6actions/download-artifactv4v6actions/upload-artifactv4v6actions/github-scriptv7v8actions/setup-nodev4v6actions/cache/restorev3v5actions/cachev4v5actions/cache/restorev4v5actions/cache/savev4v5actions/create-github-app-tokenv2v3119 references → 0 for first-party actions on Node 20. Third-party actions still on Node 20 (
dorny/paths-filter@v3,docker/{build-push,login,setup-buildx,setup-qemu}-action,softprops/action-gh-release@v2,peter-evans/*, etc.) are deliberately out of scope — separate upstreams, separate breaking-change review.Breaking-change check (all verified safe for our usage):
upload-artifactname:is unique or matrix-templated.setup-nodev5/v6: auto-cache only triggers whenpackage.jsonhas apackageManagerfield. Ours doesn't.github-scriptv8: pure runtime bump (v9 changesgetOctokit/require('@actions/github')— held back).create-github-app-tokenv3: removes custom proxy handling; we don't setHTTP_PROXY.actions/cachev5: pure runtime bump.Checklist
STORE_SCHEMA_VERSION(crates/storage/lib.rs) — N/A