From d7304b6f34e1fe81e9fa8f477bbb413e46110e06 Mon Sep 17 00:00:00 2001 From: Mathieu Piton <27002047+mpiton@users.noreply.github.com> Date: Sun, 19 Jul 2026 14:13:10 +0200 Subject: [PATCH 1/2] ci: bump Node 20 actions to their Node 24 majors The v0.3.0-beta.1 release run flagged actions/checkout v4.3.1 and actions/setup-node v4.4.0 (release.yml), actions/cache v4.3.0 (ci.yml) and moonrepo/setup-rust v0 (codspeed.yml) as targeting deprecated Node 20. Bump them to v7.0.0 / v7.0.0 / v6.1.0 / v1.3.0, and give mutants.yml the same treatment (checkout v4, upload-artifact v4) before its scheduled runs start annotating too. All pins are commit SHAs with a version comment, matching ci.yml and plugin-ci.yml which were already on v7. --- .github/workflows/ci.yml | 2 +- .github/workflows/codspeed.yml | 4 ++-- .github/workflows/mutants.yml | 8 ++++---- .github/workflows/release.yml | 22 +++++++++++----------- CHANGELOG.md | 4 ++++ 5 files changed, 22 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0f723b92..63433371 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -278,7 +278,7 @@ jobs: - name: Cache tauri-pilot CLI id: cache-pilot - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cargo/bin/tauri-pilot key: tauri-pilot-cli-0.7.2-${{ runner.os }} diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml index dd84b6d0..6095b69b 100644 --- a/.github/workflows/codspeed.yml +++ b/.github/workflows/codspeed.yml @@ -24,7 +24,7 @@ jobs: run: working-directory: src-tauri steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Linux dependencies working-directory: . @@ -37,7 +37,7 @@ jobs: patchelf - name: Setup rust toolchain, cache and cargo-codspeed binary - uses: moonrepo/setup-rust@v0 + uses: moonrepo/setup-rust@abb2d32350334249b178c401e5ec5836e0cd88d3 # v1.3.0 with: channel: stable cache-target: release diff --git a/.github/workflows/mutants.yml b/.github/workflows/mutants.yml index 1eaa6e61..8efdb396 100644 --- a/.github/workflows/mutants.yml +++ b/.github/workflows/mutants.yml @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 @@ -66,7 +66,7 @@ jobs: -vV \ --in-diff mutants.diff - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: mutants-incremental @@ -82,7 +82,7 @@ jobs: matrix: shard: [0, 1, 2, 3] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Linux dependencies run: | @@ -113,7 +113,7 @@ jobs: -vV \ --shard ${{ matrix.shard }}/4 - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: mutants-full-shard-${{ matrix.shard }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ea1a832e..f47ced9e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: outputs: version: ${{ steps.tag.outputs.version }} steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -60,7 +60,7 @@ jobs: release_id: ${{ steps.create_release.outputs.id }} upload_url: ${{ steps.create_release.outputs.upload_url }} steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -106,7 +106,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -120,7 +120,7 @@ jobs: libappindicator3-dev \ librsvg2-dev - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 cache: npm @@ -183,11 +183,11 @@ jobs: TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 cache: npm @@ -263,11 +263,11 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 cache: npm @@ -322,7 +322,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -352,7 +352,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -422,7 +422,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false diff --git a/CHANGELOG.md b/CHANGELOG.md index bb19797b..ef8073ac 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed +- CI/release workflows: bumped all actions still targeting Node.js 20 to + their Node 24 majors (`actions/checkout` v7, `actions/setup-node` v7, + `actions/cache` v6, `actions/upload-artifact` v7, `moonrepo/setup-rust` + v1), pinned by commit SHA. - Bug report template: version dropdown now lists `v0.3.0-beta.1` as the latest beta. - README: feedback section links to the v0.3.0-beta.1 discussion thread. From d38162340e505e1a2988ed3c70810f4a41dd75fe Mon Sep 17 00:00:00 2001 From: Mathieu Piton <27002047+mpiton@users.noreply.github.com> Date: Sun, 19 Jul 2026 14:34:00 +0200 Subject: [PATCH 2/2] ci: bump contributor.yml actions off Node 20 actions/labeler v6.2.0, actions/first-interaction v3.1.0 and actions/stale v10.4.0, SHA-pinned like the rest. labeler@v5 was the last action still annotating PR runs with the Node 20 deprecation. first-interaction v3 renamed its inputs to snake_case (repo_token, pr_message, issue_message), so those move too. --- .github/workflows/contributor.yml | 16 ++++++++-------- CHANGELOG.md | 3 ++- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/workflows/contributor.yml b/.github/workflows/contributor.yml index c8578691..12d36cf0 100644 --- a/.github/workflows/contributor.yml +++ b/.github/workflows/contributor.yml @@ -17,7 +17,7 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/labeler@v5 + - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0 welcome-pr: name: Welcome New Contributors (PR) @@ -26,10 +26,10 @@ jobs: permissions: pull-requests: write steps: - - uses: actions/first-interaction@v1 + - uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d # v3.1.0 with: - repo-token: ${{ secrets.GITHUB_TOKEN }} - pr-message: | + repo_token: ${{ secrets.GITHUB_TOKEN }} + pr_message: | Thanks for your first pull request! Please make sure you've gone through this checklist: - [ ] `cargo fmt --manifest-path src-tauri/Cargo.toml --check` passes @@ -44,10 +44,10 @@ jobs: permissions: issues: write steps: - - uses: actions/first-interaction@v1 + - uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d # v3.1.0 with: - repo-token: ${{ secrets.GITHUB_TOKEN }} - issue-message: | + repo_token: ${{ secrets.GITHUB_TOKEN }} + issue_message: | Thanks for opening your first issue! We'll take a look as soon as possible. In the meantime, please make sure you've provided enough context for us to reproduce or understand the problem. stale: @@ -58,7 +58,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@v9 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 with: stale-issue-message: > This issue has been automatically marked as stale because it has not had diff --git a/CHANGELOG.md b/CHANGELOG.md index ef8073ac..8da04b5b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,7 +12,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - CI/release workflows: bumped all actions still targeting Node.js 20 to their Node 24 majors (`actions/checkout` v7, `actions/setup-node` v7, `actions/cache` v6, `actions/upload-artifact` v7, `moonrepo/setup-rust` - v1), pinned by commit SHA. + v1, `actions/labeler` v6, `actions/first-interaction` v3, `actions/stale` + v10), pinned by commit SHA. - Bug report template: version dropdown now lists `v0.3.0-beta.1` as the latest beta. - README: feedback section links to the v0.3.0-beta.1 discussion thread.