From 20609358ad1da34392e261fc47d99b94c7a2464d Mon Sep 17 00:00:00 2001 From: Alex Eagle Date: Mon, 22 Jun 2026 10:27:29 -0700 Subject: [PATCH 1/2] Bump pinned actions to Node 24 releases GitHub now forces Node 20 actions onto the deprecated Node 24 shim. Pin to the current major releases, which target node24 natively: actions/checkout v4.1.1 -> v7.0.0 actions/upload-artifact v4.0.0 -> v7.0.1 actions/download-artifact v4.3.0 -> v8.0.1 Ref: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/ Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/figma-release.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/figma-release.yml b/.github/workflows/figma-release.yml index 963291aaa27634..930733d8bc27da 100644 --- a/.github/workflows/figma-release.yml +++ b/.github/workflows/figma-release.yml @@ -96,7 +96,7 @@ jobs: embed_label: ${{ steps.resolve.outputs.embed_label }} steps: - name: Checkout ${{ inputs.ref }} - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ inputs.ref }} fetch-depth: 0 @@ -186,7 +186,7 @@ jobs: # Check out the exact commit resolved by `setup` so every platform builds # an identical tree even if the branch moves mid-run. - name: Checkout ${{ needs.setup.outputs.sha }} - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ needs.setup.outputs.sha }} fetch-depth: 0 @@ -242,7 +242,7 @@ jobs: ls -l - name: Upload artifacts - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ matrix.platform }} path: dist/* @@ -256,13 +256,13 @@ jobs: contents: write steps: - name: Checkout ${{ needs.setup.outputs.sha }} - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ needs.setup.outputs.sha }} fetch-depth: 0 - name: Download all artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: dist merge-multiple: true From a63f0b79a787e7383bd99c23206895271312c4ef Mon Sep 17 00:00:00 2001 From: Alex Eagle Date: Mon, 22 Jun 2026 10:43:13 -0700 Subject: [PATCH 2/2] Target the fork explicitly when creating the release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous run built all three platforms successfully but the release job failed with: HTTP 403: Resource not accessible by integration (https://api.github.com/repos/bazelbuild/bazel/releases) The "Generate release notes" step adds an `upstream` remote, and an unqualified `gh release create` resolves to the base repo (upstream bazelbuild/bazel) instead of this fork — hence the 403. Pass --repo "$GITHUB_REPOSITORY" so the release is always created here. Also re-applies the Node 24 action pin bump, which was dropped from the PR #2 merge. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/figma-release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/figma-release.yml b/.github/workflows/figma-release.yml index 930733d8bc27da..d90c6c2869d682 100644 --- a/.github/workflows/figma-release.yml +++ b/.github/workflows/figma-release.yml @@ -331,10 +331,14 @@ jobs: TARGET_SHA: ${{ needs.setup.outputs.sha }} run: | set -euo pipefail + # --repo is required: the notes step adds an `upstream` remote, and an + # unqualified `gh` resolves to the base repo (upstream bazelbuild/bazel) + # rather than this fork. Pin it to this repo explicitly. # Tag == embed_label so the download URL matches what Bazelisk derives # from USE_BAZEL_VERSION=figma/. Target the exact commit # the whole run was pinned to in the `setup` job. gh release create "$EMBED_LABEL" \ + --repo "$GITHUB_REPOSITORY" \ --target "$TARGET_SHA" \ --title "Bazel $EMBED_LABEL" \ --notes-file RELEASE_NOTES.md \