From d51806606cc5589b8225075e03b4270ff4c1b377 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 09:10:27 +0000 Subject: [PATCH 1/5] ci: update GitHub Actions off the deprecated Node.js 20 runtime GitHub warns that actions/checkout@v4 and pnpm/action-setup@v4 target Node.js 20 and are being forced onto Node.js 24. Move every action in both workflows to its current major, which run on node24 natively: - actions/checkout v4 -> v7 - pnpm/action-setup v4 -> v6 - actions/setup-node v6 -> v7 - actions/setup-java v3/v4 -> v5 - android-actions/setup-android v3 -> v4 - actions/upload-artifact v4 -> v7 - actions/cache v4 -> v6 (in the commented-out AVD cache step) hendrikmuhs/ccache-action is the exception: its floating v1 and v1.2 tags still resolve to a Node.js 20 build, so it is pinned to the exact v1.2.23 patch until upstream moves them. aminya/setup-cpp@v1, reactivecircus/android-emulator-runner@v2 and changesets/action@v2 already resolve to node24 builds and are unchanged. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE --- .github/workflows/check.yml | 96 ++++++++++++++++++++--------------- .github/workflows/release.yml | 26 +++++----- 2 files changed, 69 insertions(+), 53 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 533bdece..a0ae6a0c 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -30,9 +30,9 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -41,18 +41,20 @@ jobs: with: clang-format: true - name: ccache - uses: hendrikmuhs/ccache-action@v1.2 + # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a + # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. + uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} # Set up JDK and Android SDK only because we need weak-node-api, to build ferric-example and to run the linting # TODO: Remove this once we have a way to run linting without building the native code - name: Set up JDK 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: java-version: "17" distribution: "temurin" - name: Setup Android SDK - uses: android-actions/setup-android@v3 + uses: android-actions/setup-android@v4 with: packages: tools platform-tools ndk;${{ env.NDK_VERSION }} - run: rustup target add x86_64-linux-android @@ -79,9 +81,9 @@ jobs: runs-on: ${{ matrix.runner }} name: Unit tests (${{ matrix.runner }}) steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -90,16 +92,18 @@ jobs: with: clang-format: true - name: ccache - uses: hendrikmuhs/ccache-action@v1.2 + # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a + # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. + uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: "17" distribution: "temurin" - name: Setup Android SDK - uses: android-actions/setup-android@v3 + uses: android-actions/setup-android@v4 with: packages: tools platform-tools ndk;${{ env.NDK_VERSION }} - run: rustup target add x86_64-linux-android aarch64-linux-android armv7-linux-androideabi i686-linux-android aarch64-apple-ios-sim @@ -118,9 +122,9 @@ jobs: runs-on: ${{ matrix.runner }} name: Weak Node-API tests (${{ matrix.runner }}) steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -129,7 +133,9 @@ jobs: with: clang-format: true - name: ccache - uses: hendrikmuhs/ccache-action@v1.2 + # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a + # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. + uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} - run: pnpm install @@ -147,9 +153,9 @@ jobs: name: Test app (iOS) runs-on: macos-latest steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -158,16 +164,18 @@ jobs: with: clang-format: true - name: ccache - uses: hendrikmuhs/ccache-action@v1.2 + # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a + # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. + uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} - name: Set up JDK 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: java-version: "17" distribution: "temurin" - name: Setup Android SDK - uses: android-actions/setup-android@v3 + uses: android-actions/setup-android@v4 with: packages: tools platform-tools ndk;${{ env.NDK_VERSION }} - run: rustup target add x86_64-linux-android aarch64-linux-android armv7-linux-androideabi i686-linux-android aarch64-apple-ios-sim @@ -191,9 +199,9 @@ jobs: name: Test app (macOS) runs-on: macos-latest steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -202,11 +210,13 @@ jobs: with: clang-format: true - name: ccache - uses: hendrikmuhs/ccache-action@v1.2 + # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a + # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. + uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} - name: Set up JDK 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: java-version: "17" distribution: "temurin" @@ -239,9 +249,9 @@ jobs: name: Test app (Android) runs-on: ubuntu-self-hosted steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -250,16 +260,18 @@ jobs: with: clang-format: true - name: ccache - uses: hendrikmuhs/ccache-action@v1.2 + # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a + # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. + uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: "17" distribution: "temurin" - name: Setup Android SDK - uses: android-actions/setup-android@v3 + uses: android-actions/setup-android@v4 with: packages: tools platform-tools ndk;${{ env.NDK_VERSION }} cmake;${{ env.CMAKE_VERSION }} - run: rustup target add x86_64-linux-android aarch64-linux-android armv7-linux-androideabi i686-linux-android aarch64-apple-ios-sim @@ -275,7 +287,7 @@ jobs: echo "REACT_NATIVE_OVERRIDE_HERMES_DIR=$REACT_NATIVE_OVERRIDE_HERMES_DIR" >> $GITHUB_ENV working-directory: apps/test-app # - name: Setup Android Emulator cache - # uses: actions/cache@v4 + # uses: actions/cache@v6 # id: avd-cache # with: # path: | @@ -320,7 +332,7 @@ jobs: kill $LOGCAT_PID || true - name: Upload device logs if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: emulator-logcat path: apps/test-app/emulator-logcat.txt @@ -329,9 +341,9 @@ jobs: name: Test ferric Apple triplets runs-on: macos-latest steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -340,11 +352,13 @@ jobs: with: clang-format: true - name: ccache - uses: hendrikmuhs/ccache-action@v1.2 + # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a + # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. + uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} - name: Set up JDK 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: java-version: "17" distribution: "temurin" @@ -363,7 +377,7 @@ jobs: run: lipo -info ferric_example.apple.node/*/libferric_example.framework/libferric_example > lipo-info.txt working-directory: packages/ferric-example - name: Upload lipo info - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: lipo-info path: packages/ferric-example/lipo-info.txt diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dd1414da..c563f5cc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,9 +35,9 @@ jobs: outputs: mode: ${{ steps.select.outputs.mode }} steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -67,9 +67,9 @@ jobs: contents: write # the version branch pull-requests: write # the "Version Packages" pull request steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -94,9 +94,9 @@ jobs: contents: write # git tags and GitHub releases id-token: write # NPM trusted publishing steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@v7 + - uses: pnpm/action-setup@v6 + - uses: actions/setup-node@v7 with: node-version: lts/krypton cache: pnpm @@ -105,16 +105,18 @@ jobs: with: clang-format: true - name: ccache - uses: hendrikmuhs/ccache-action@v1.2 + # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a + # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. + uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} - name: Set up JDK 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: java-version: "17" distribution: "temurin" - name: Setup Android SDK - uses: android-actions/setup-android@v3 + uses: android-actions/setup-android@v4 with: packages: tools platform-tools ndk;${{ env.NDK_VERSION }} - run: rustup target add x86_64-linux-android aarch64-linux-android armv7-linux-androideabi i686-linux-android aarch64-apple-ios-sim From ce819d76f59679d542981a12121900d086a2fa61 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 09:14:27 +0000 Subject: [PATCH 2/5] ci: let Dependabot keep the GitHub Actions up to date Weekly checks against .github/workflows, grouped into a single pull request so the whole set moves together instead of one pull request per action. Only the github-actions ecosystem is enabled: the pnpm workspace is deliberately left out for now. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE --- .github/dependabot.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..686adb77 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,18 @@ +version: 2 + +updates: + # Keeps the actions used by .github/workflows in step with their upstream + # releases. Without this, majors drift until a runner deprecation (such as the + # Node.js 20 removal) turns the drift into a warning on every run. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + # One pull request for the whole set: these are updated together anyway, and + # a separate pull request per action would drown the queue. + groups: + github-actions: + patterns: + - "*" + commit-message: + prefix: "ci" From 6542e150adf082d7a31473ae7da19b666b8cbbba Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 09:21:50 +0000 Subject: [PATCH 3/5] ci: label Dependabot pull requests Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 686adb77..0752c15f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,3 +16,5 @@ updates: - "*" commit-message: prefix: "ci" + labels: + - Dependencies From 3c44a0d0ff08104e732dda9a4aef4c030ba1f0a6 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 09:23:21 +0000 Subject: [PATCH 4/5] ci: re-run checks for newly applied labels check.yml only runs on opened/synchronize/reopened, so adding a label does not re-trigger it on its own. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE From 9a929ffb31199c002a8a3bc704a652728ff62d06 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 09:29:20 +0000 Subject: [PATCH 5/5] ci: hold pnpm/action-setup at v5 for the self-hosted runner v6 rewrote the self-installer to shell out to `npm ci`. Our self-hosted Linux runner has no npm on PATH other than the one in the runner's own Node.js 24 externals, and that copy is broken: Error: Cannot find module '../lib/cli.js' Require stack: - .../externals.2.336.0/node24/bin/npm so "Test app (Android)" failed at the setup step. v4 and v5 bootstrap from a pnpm bundled inside the action and never invoke npm, and v5 is already a node24 action, so it clears the deprecation warning without taking on the new npm dependency. Also collapses the per-step ccache pin comments into one note per workflow, now covering both held-back actions. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01W14eEfXdK5DYzv43MazryE --- .github/workflows/check.yml | 41 +++++++++++++++++------------------ .github/workflows/release.yml | 11 +++++----- 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index a0ae6a0c..04e15188 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -25,13 +25,26 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# Two actions below are deliberately held back from their newest release, both +# because of the Node.js 20 deprecation: +# +# - pnpm/action-setup is pinned to v5, not v6. v6 rewrote the self-installer to +# shell out to `npm ci`, and our self-hosted Linux runner has no npm on PATH +# beyond the runner's own Node.js 24 externals — where it is broken. v5 is a +# Node.js 24 action too, and still bootstraps from a bundled pnpm, so it +# clears the deprecation without the new npm dependency. Move to v6 once that +# runner has a working npm. +# - hendrikmuhs/ccache-action is pinned to an exact patch because its floating +# v1 / v1.2 tags still point at a Node.js 20 build. Float again once upstream +# moves them to >= v1.2.22. + jobs: lint: name: Lint runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -41,8 +54,6 @@ jobs: with: clang-format: true - name: ccache - # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a - # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} @@ -82,7 +93,7 @@ jobs: name: Unit tests (${{ matrix.runner }}) steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -92,8 +103,6 @@ jobs: with: clang-format: true - name: ccache - # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a - # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} @@ -123,7 +132,7 @@ jobs: name: Weak Node-API tests (${{ matrix.runner }}) steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -133,8 +142,6 @@ jobs: with: clang-format: true - name: ccache - # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a - # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} @@ -154,7 +161,7 @@ jobs: runs-on: macos-latest steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -164,8 +171,6 @@ jobs: with: clang-format: true - name: ccache - # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a - # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} @@ -200,7 +205,7 @@ jobs: runs-on: macos-latest steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -210,8 +215,6 @@ jobs: with: clang-format: true - name: ccache - # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a - # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} @@ -250,7 +253,7 @@ jobs: runs-on: ubuntu-self-hosted steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -260,8 +263,6 @@ jobs: with: clang-format: true - name: ccache - # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a - # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} @@ -342,7 +343,7 @@ jobs: runs-on: macos-latest steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -352,8 +353,6 @@ jobs: with: clang-format: true - name: ccache - # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a - # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c563f5cc..29ba7a4c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,6 +20,9 @@ on: # refreshing the "Version Packages" pull request until someone approves. The # two jobs that must not overlap carry their own groups instead. +# pnpm/action-setup is pinned to v5 and hendrikmuhs/ccache-action to an exact +# patch, both for Node.js 20 deprecation reasons. See the note in check.yml. + jobs: # changesets/action's sub-actions split the "what should happen?" decision out # of the doing, which is what lets only the publish half sit behind the "main" @@ -36,7 +39,7 @@ jobs: mode: ${{ steps.select.outputs.mode }} steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -68,7 +71,7 @@ jobs: pull-requests: write # the "Version Packages" pull request steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -95,7 +98,7 @@ jobs: id-token: write # NPM trusted publishing steps: - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v7 with: node-version: lts/krypton @@ -105,8 +108,6 @@ jobs: with: clang-format: true - name: ccache - # Pinned to an exact patch: the floating v1 / v1.2 tags still point at a - # Node.js 20 build. Float again once upstream moves them to >= v1.2.22. uses: hendrikmuhs/ccache-action@v1.2.23 with: key: ${{ github.job }}-${{ runner.os }}