Conversation
GitHub Actions warned that Node 20 actions are deprecated and will be forced to Node 24 by June 2, 2026. Bump to latest majors that ship on Node 24: - actions/checkout v4 → v6 - actions/setup-node v4 → v6 - pnpm/action-setup v4 → v5 - peter-evans/create-pull-request v7 → v8 Major-only tags so future patch/minor updates flow in automatically. None of these majors introduce behavioral breaks for this repo (no `packageManager` field, so setup-node v5+ auto-cache detection won't trigger; existing `cache: 'pnpm'` config is unaffected). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (2)
WalkthroughThis PR upgrades GitHub Actions versions across workflow files: Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
22-33: Optional hardening: pin third-party actions to immutable commit SHAs.Using major version tags (
@v6,@v5, etc.) is convenient but mutable. Consider pinning actions to their commit SHAs for supply-chain integrity, then automate refreshes using Dependabot or similar tooling.The actions in this workflow can be pinned to:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddpnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release.yml around lines 22 - 33, Replace the mutable action tags with the provided immutable commit SHAs to harden the workflow: update the "uses" entries for actions/checkout, pnpm/action-setup, and actions/setup-node (the steps named "Checkout", "Setup pnpm", and "Setup Node") to use the specific SHAs de0fac2e4500dabe0009e67214ff5f5447ce83dd, a8198c4bff370c8506180b035930dea56dbd5288, and 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e respectively; after pinning, add or document Dependabot (or similar) automation to periodically update those SHAs so they can be refreshed safely.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 22-28: Update the GitHub Actions usages that still run on Node 20:
replace actions/deploy-pages@v4 with v5.0.0+ (deploy-pages@v5), replace
actions/download-artifact@v4 with v7+ (download-artifact@v7), and replace
actions/upload-artifact@v4 with v6+ (upload-artifact@v6); also update
actions/upload-pages-artifact to a newer major that no longer pulls
upload-artifact@v3 (e.g., upload-pages-artifact@v4+ or whichever release
references upload-artifact@v6+). Locate these action entries by their action
identifiers (actions/deploy-pages, actions/download-artifact,
actions/upload-artifact, actions/upload-pages-artifact) in the workflow and bump
the version tags accordingly to Node 24-compatible releases.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 22-33: Replace the mutable action tags with the provided immutable
commit SHAs to harden the workflow: update the "uses" entries for
actions/checkout, pnpm/action-setup, and actions/setup-node (the steps named
"Checkout", "Setup pnpm", and "Setup Node") to use the specific SHAs
de0fac2e4500dabe0009e67214ff5f5447ce83dd,
a8198c4bff370c8506180b035930dea56dbd5288, and
48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e respectively; after pinning, add or
document Dependabot (or similar) automation to periodically update those SHAs so
they can be refreshed safely.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8861dd40-917e-430a-924f-d7f0adcdf233
📒 Files selected for processing (5)
.github/workflows/ci.yml.github/workflows/docs.yml.github/workflows/release.yml.github/workflows/schema-drift.yml.github/workflows/token-check.yml
Follow-up to prior commit — the green CI run revealed additional Node 20 deprecation warnings for actions not flagged by the original GitHub warning we acted on. - actions/upload-artifact v4 → v7 - actions/download-artifact v4 → v8 - actions/upload-pages-artifact v3 → v5 - actions/deploy-pages v4 → v5 download-artifact v5 introduced a breaking change for downloads-by-ID; this repo downloads by name, so the change is a no-op here. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Addressing CodeRabbit feedback before merge: Inline comment (ci.yml line 28) — stale. CodeRabbit reviewed the first commit ( Nitpick (release.yml SHA pinning) — declining for this PR. SHA pinning is a legitimate hardening practice but inverts this PR's stated intent of using major-only tags so patch/minor updates flow automatically, and would require Dependabot to keep SHAs fresh. Worth doing as a separate, repo-wide hardening pass with the Dependabot setup, not piecemeal in one workflow. |
release.yml runs on every push to main. changesets/action only opens a "Version Packages" PR when there are pending changesets — on infra-only merges (e.g. CI tweaks like #17 and #19), the action falls through to the publish step. The previous `pnpm release` script invoked `npm publish` directly, which errors out with "You cannot publish over the previously published versions" and fails the release job for every non-changeset merge. Add a `publish-if-new.mjs` guard that: - reads the version from packages/whisper/package.json - queries `npm view <name>@<version>` to check the registry - skips with a clean message if already published - runs `npm publish --access public --provenance` otherwise Trusted publishing + provenance flags preserved verbatim — no change to the publish path itself, just a registry-aware gate around it. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 participant
Summary
GitHub Actions warned that Node 20 actions are deprecated — they'll be forced to Node 24 by June 2, 2026 and Node 20 removed from runners September 16, 2026. Bumping to the latest majors that ship on Node 24:
Using major-only tags so patch/minor updates flow in automatically.
Behavioral check
None of these majors introduce breaks for this repo:
setup-node@v5added auto-cache detection via thepackageManagerpackage.json field — this repo has no such field, so it's a no-op.setup-node@v6further limits auto-cache to npm anyway.cache: 'pnpm'config is unchanged.Test plan
🤖 Generated with Claude Code
Upgrade GitHub Actions to Node 24-compatible versions
Update workflow actions across five files (.github/workflows/ci.yml, docs.yml, release.yml, schema-drift.yml, token-check.yml) to majors that run on Node 24 and avoid Node 20 deprecation:
Notes: