chore: migrate to Node.js 24 and update vega/canvas dependencies

.github/workflows/check.yml

@@ -2,7 +2,7 @@ name: Check CML GitHub Action
 on:
   schedule:
     - cron: 0 0 * * *
-  pull_request:
+  pull_request: {}
 
 permissions:
   contents: write
@@ -13,7 +13,10 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
       - run: |
           npm ci
           npm run format
@@ -33,12 +36,16 @@ jobs:
           - windows-latest
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - name: run action with latest
         uses: ./
       - name: test
         run: cml --version
+      # cml comment/check create need a write-scoped token, which PRs from forks
+      # don't get (read-only GITHUB_TOKEN). Run this step only where the token can
+      # write: same-repo PRs and the scheduled run on the default branch.
       - name: test CML
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -58,7 +65,7 @@ jobs:
           - windows-latest
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - name: run action with latest
         uses: ./
         with:
@@ -82,7 +89,7 @@ jobs:
           - windows-latest
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - name: run action with latest
         uses: ./
         with:

README.md

@@ -30,7 +30,7 @@ Note that CML does not include DVC and its dependencies (see the
 ## Note on v2
 
 `v1` of setup-cml was a wrapper around a set of npm installs. `v2` installs CML from its
-pre-packaged binaries. Then attempts to run `npm install --global canvas@2 vega@5 vega-cli@5 vega-lite@5`
+pre-packaged binaries. Then attempts to run `npm install --global canvas@3 vega@6 vega-cli@6 vega-lite@6`
 if you do not wish to install these tools pass `vega: false` to the action.
 
 link to [`v1`](https://github.com/iterative/setup-cml/tree/v1)
@@ -74,7 +74,9 @@ The following inputs are supported.
   to `latest` for the
   [most recent CML release](https://github.com/iterative/cml/releases).
 - `vega` - (optional) Whether to install vega dependencies. Defaults to `true`.
-  runs command `npm install --global canvas@2 vega@5 vega-cli@5 vega-lite@5`
+  runs command `npm install --global canvas@3 vega@6 vega-cli@6 vega-lite@6`
+- `token` - (optional) GitHub token used to look up the CML release to install.
+  Defaults to `${{ github.token }}`; authenticating avoids GitHub API rate limits.
 
 ## A complete example
 

action.yml

@@ -10,8 +10,12 @@ inputs:
     description: Whether to install Vega tools
     default: 'true'
     required: false
+  token:
+    description: GitHub token used to look up CML releases (avoids API rate limits).
+    default: ${{ github.token }}
+    required: false
 runs:
-  using: node16
+  using: node24
   main: dist/index.js
 branding:
   icon: terminal

dist/index.js

@@ -14906,10 +14906,10 @@ function run() {
             }
             if (vega) {
                 try {
-                    (0, exec_1.exec)('npm install --global canvas@2 vega@5 vega-cli@5 vega-lite@5');
+                    yield (0, exec_1.exec)('npm install --global canvas@3 vega@6 vega-cli@6 vega-lite@6');
                 }
                 catch (error) {
-                    core.warning('Failed to intall vega tools');
+                    core.warning('Failed to install vega tools');
                 }
             }
         }
@@ -14921,7 +14921,7 @@ function run() {
 function getCmlDownloadUrl(version, assetName) {
     return __awaiter(this, void 0, void 0, function* () {
         const octokit = new rest_1.Octokit({
-            token: process.env.GITHUB_TOKEN,
+            auth: core.getInput('token') || process.env.GITHUB_TOKEN,
             request: {
                 fetch: node_fetch_1.default
             }