ci: Update GitHub Actions and add Dependabot configuration - #405
Merged
Conversation
GitHub warns that actions/checkout@v4 and pnpm/action-setup@v4 target Node.js 20 and are being forced onto Node.js 24. Move every action in both workflows to its current major, which run on node24 natively: - actions/checkout v4 -> v7 - pnpm/action-setup v4 -> v6 - actions/setup-node v6 -> v7 - actions/setup-java v3/v4 -> v5 - android-actions/setup-android v3 -> v4 - actions/upload-artifact v4 -> v7 - actions/cache v4 -> v6 (in the commented-out AVD cache step) hendrikmuhs/ccache-action is the exception: its floating v1 and v1.2 tags still resolve to a Node.js 20 build, so it is pinned to the exact v1.2.23 patch until upstream moves them. aminya/setup-cpp@v1, reactivecircus/android-emulator-runner@v2 and changesets/action@v2 already resolve to node24 builds and are unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE
Weekly checks against .github/workflows, grouped into a single pull request so the whole set moves together instead of one pull request per action. Only the github-actions ecosystem is enabled: the pnpm workspace is deliberately left out for now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE
kraenhansen
added
C++
Apple 🍎
check.yml only runs on opened/synchronize/reopened, so adding a label does not re-trigger it on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE
v6 rewrote the self-installer to shell out to `npm ci`. Our self-hosted
Linux runner has no npm on PATH other than the one in the runner's own
Node.js 24 externals, and that copy is broken:
Error: Cannot find module '../lib/cli.js'
Require stack:
- .../externals.2.336.0/node24/bin/npm
so "Test app (Android)" failed at the setup step. v4 and v5 bootstrap
from a pnpm bundled inside the action and never invoke npm, and v5 is
already a node24 action, so it clears the deprecation warning without
taking on the new npm dependency.
Also collapses the per-step ccache pin comments into one note per
workflow, now covering both held-back actions.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE
kraenhansen
added a commit
that referenced
this pull request
Aug 12, 2026
* ci: set Node.js up before pnpm and move to pnpm/action-setup v6 #405 held pnpm/action-setup at v5 because v6 bootstraps pnpm by shelling out to `npm ci`, and the self-hosted Linux runner's only npm is the broken copy in the runner's own Node.js 24 externals: Error: Cannot find module '../lib/cli.js' v6 resolves npm through PATH and merely appends that externals directory, so running actions/setup-node first — which prepends its own Node.js installation — puts a working npm ahead of it. The reason pnpm came first was setup-node's `cache: pnpm`, which shells out to `pnpm store path` and so needs pnpm to already exist. v6 caches the pnpm store itself, keyed on the lockfile, so that input moves from setup-node to `cache: true` on pnpm/action-setup and the ordering constraint disappears. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE * ci: re-run checks for the newly applied labels check.yml only runs on opened/synchronize/reopened, so the label-gated jobs — including the self-hosted Android one this change needs to prove itself on — do not start from labelling alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE --------- Co-authored-by: Claude <noreply@anthropic.com>
kraenhansen
pushed a commit
that referenced
this pull request
Aug 12, 2026
host-cpp-tests was added on next (#398), so the Node.js 20 deprecation sweep on main (#405, #407) never reached it: it is the one job in the workflow still on actions/checkout@v4, pnpm/action-setup@v4 and actions/setup-node@v6, and so the only remaining source of the runner's "targets Node.js 20" warning. Merges main to pick up #407 and gives the job the same arrangement as its siblings: Node.js set up before pnpm, pnpm/action-setup v6 owning the store cache, and ccache-action pinned to an exact patch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE
kraenhansen
added a commit
that referenced
this pull request
Aug 12, 2026
* ci: bring host-cpp-tests in line with the rest of the workflow host-cpp-tests was added on next (#398), so the Node.js 20 deprecation sweep on main (#405, #407) never reached it: it is the one job in the workflow still on actions/checkout@v4, pnpm/action-setup@v4 and actions/setup-node@v6, and so the only remaining source of the runner's "targets Node.js 20" warning. Merges main to pick up #407 and gives the job the same arrangement as its siblings: Node.js set up before pnpm, pnpm/action-setup v6 owning the store cache, and ccache-action pinned to an exact patch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE * ci: re-run checks for the newly applied labels check.yml only runs on opened/synchronize/reopened, so the host-gated job this change is about does not start from labelling alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE --------- Co-authored-by: Claude <noreply@anthropic.com>
kraenhansen
added a commit
that referenced
this pull request
Aug 13, 2026
* ci: bring host-cpp-tests in line with the rest of the workflow host-cpp-tests was added on next (#398), so the Node.js 20 deprecation sweep on main (#405, #407) never reached it: it is the one job in the workflow still on actions/checkout@v4, pnpm/action-setup@v4 and actions/setup-node@v6, and so the only remaining source of the runner's "targets Node.js 20" warning. Merges main to pick up #407 and gives the job the same arrangement as its siblings: Node.js set up before pnpm, pnpm/action-setup v6 owning the store cache, and ccache-action pinned to an exact patch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE * ci: re-run checks for the newly applied labels check.yml only runs on opened/synchronize/reopened, so the host-gated job this change is about does not start from labelling alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates GitHub Actions to their latest versions across all workflows and adds Dependabot configuration to keep actions synchronized with upstream releases.
Changes
Action version updates:
actions/checkout: v4 → v7pnpm/action-setup: v4 → v6actions/setup-node: v6 → v7actions/setup-java: v3/v4 → v5android-actions/setup-android: v3 → v4actions/upload-artifact: v4 → v7hendrikmuhs/ccache-action: v1.2 → v1.2.23 (pinned to exact patch to avoid Node.js 20 build)Dependabot configuration:
.github/dependabot.ymlto automatically track GitHub Actions updatesciprefix for commit messages andDependencieslabelImplementation Details
The
ccache-actionupdate includes a comment explaining the pin to v1.2.23: the floating v1 and v1.2 tags still point to a Node.js 20 build, which will become problematic when Node.js 20 is removed from runners. The pin can be relaxed once upstream moves those tags to v1.2.22 or later.Dependabot is configured to group all GitHub Actions updates into a single pull request rather than creating separate PRs per action, since these are typically updated together anyway.
https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE