ci: move GitHub Actions to their Node 24 majors - #82
Conversation
Node 20 reached end-of-life on 2026-04-30 and GitHub's own actions now ship node24 majors. Moves every pin in ci.yml and data-url-guard.yml to its current major, each of which declares node24 in its action.yml (for the composite upload-pages-artifact, its inner upload-artifact v7.0.0 does): - actions/checkout v4 -> v7 - actions/setup-node v4 -> v7 - actions/github-script v7 -> v9 - actions/upload-pages-artifact v3 -> v5 - actions/deploy-pages v4 -> v5 Also moves the job's own Node from 20.x (end-of-life) to 24, and adds a grouped weekly github-actions Dependabot config so pins stay current. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
❌ Deploy Preview for beautiful-dodol-cb9543 failed.
|
|
📖 Netlify Preview Ready! Preview URL: https://pr-82--beautiful-dodol-cb9543.netlify.app (cc52c10) ✨ Browse the preview at the URL above. |
There was a problem hiding this comment.
🟡 Changes recommended
The CI workflow’s node-version: 24 should be expressed as a version spec (e.g., 24.x) to avoid accidentally pinning an exact Node version and to match the prior 20.x behavior.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This PR updates the repository’s GitHub Actions workflows to Node 24–compatible major versions (and runs the build job itself on Node 24) to eliminate Node 20 deprecation warnings, and adds Dependabot configuration to keep action pins current going forward.
Changes:
- Bump GitHub Actions used in workflows (checkout, setup-node, upload-pages-artifact, deploy-pages, github-script) to their Node 24 majors.
- Update the CI job’s Node version from
20.xto Node 24. - Add
.github/dependabot.ymlto maintain GitHub Actions dependency updates with grouped minor/patch vs major PRs.
File summaries
| File | Description |
|---|---|
| .github/workflows/data-url-guard.yml | Updates checkout action to the Node 24 major. |
| .github/workflows/ci.yml | Moves workflow action majors to Node 24 and updates the job’s Node version selection. |
| .github/dependabot.yml | Adds Dependabot config to keep GitHub Actions pins up to date with grouped updates. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Matches the quoted '24' used across the rest of the fleet's Node 24 move. Behaviour is unchanged: setup-node treats a bare major as a semver range and resolves the latest 24.x, as 20.x did before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
📖 Netlify Preview Ready! Preview URL: https://pr-82--beautiful-dodol-cb9543.netlify.app (c834ed4) ✨ Browse the preview at the URL above. |
Moves every GitHub Actions pin in this repository onto its Node 24 major, moves the build job's own Node from 20.x to 24, and adds a Dependabot config so the pins stay current. Node 20 reached end-of-life on 2026-04-30, and runners have been forcing node20-declared actions onto Node 24 since June, which is why every run here currently carries the "Node 20 is being deprecated" annotation. This is part of the fleet-wide Node 24 upgrade approved on 2026-09-18.
Pins
build-and-deploynode-versionEach target was checked by reading its
action.ymlat the pinned tag:runs.usingisnode24for all of them except upload-pages-artifact, which is composite and whose only inneruses:is actions/upload-artifact at the v7.0.0 SHA, itselfnode24.What crossing these majors changes here
$RUNNER_TEMPrather than in.git/config, and nothing here reads it from there. The v7 fork-PR block applies only topull_request_targetandworkflow_run, which neither workflow uses. Theref,tokenandsubmodulesinputs are unchanged.packageManagerfield inpackage.json, and this repository has nopackage.json.always-authand the placeholderNODE_AUTH_TOKENare gone, and neither workflow setsalways-authorregistry-url.github.rest.issues.*andcontext, so the ESM-onlyrequire('@actions/github')change and the injectedgetOctokitdo not touch it.include-hidden-files: trueis set. The archive listing from the last main deploy (run 35028367716, 1,596 entries) has no dotfiles in it, so nothing currently published is dropped.Dependabot
Adds
.github/dependabot.ymlfor the github-actions ecosystem, weekly, with the two groups QuantEcon/actions uses (minor and patch together, majors on their own), so there are at most two update PRs a week. There is no conda stanza because this repository has noenvironment.yml. This is the lecture-wasm half of item 1 in QuantEcon/workspace-lectures#59; data-lectures carries the other half, so that issue stays open.What this PR's CI proves, and what only the merge run proves
Run by this PR's own CI: both changed workflows run on
pull_request. data-url-guard.yml exercises checkout v7. ci.yml's PR path exercises checkout v7, setup-node v7 with Node 24, the mystmd build on Node 24, upload-pages-artifact v5, the Netlify CLI on Node 24 with the preview deploy, and github-script v9 posting the preview comment.Proven only after merge: deploy-pages v5 and the push-to-main build (the one with
BASE_URLset) run only on push to main. The merge run is the proof, and it publishes: it deploys the live site at https://quantecon.github.io/lecture-wasm/. If that run goes red, revert this PR rather than patching forward on main. The Dependabot config also takes effect only once it is on main.Result of this PR's run: build-and-deploy and data-url-guard both passed. The job log shows every new pin downloaded at its tag's SHA, Node v24.20.0, the Pages archive uploaded through upload-artifact v7.0.0 with the same 1,596 entries as the last main deploy and no dotfiles, the Netlify preview deployed, and the preview comment posted by github-script v9. The "Node 20 is being deprecated" annotation no longer appears. The four
beautiful-dodol-cb9543checks from the Netlify app (its own Git-integration build, separate from the CLI preview this workflow deploys) fail with "Deploy failed", as they do on every recent PR here, including the merged #77, #78, #80 and the open #81, so they are unrelated to this change.Known exceptions: none in this repository. The fleet's one approved hold-back, rossjrw/pr-preview-action (kept until its upstream node24 release, review date 2026-10-31), is not used here.
🤖 Generated with Claude Code