From 733921d4e1eb2f325e241f3c199c0871c0ff3a69 Mon Sep 17 00:00:00 2001 From: Jacob Cable Date: Thu, 27 Aug 2026 11:52:17 +0100 Subject: [PATCH] fix(ci): pin actions/checkout and setup-node to v7 in release workflows The v4 SHAs pinned in release-kit.yaml and npm_publish_bq_scripts.yml declare a Node 20 runtime, which GitHub is deprecating. checkout v7.0.1 and setup-node v7.0.0 run on Node 24. setup-node v7 dropped the always-auth input, so remove it (false was the default behaviour). The read-only test job no longer persists git credentials. Fixes #2977 --- .github/workflows/npm_publish_bq_scripts.yml | 4 ++-- .github/workflows/release-kit.yaml | 11 ++++++----- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/npm_publish_bq_scripts.yml b/.github/workflows/npm_publish_bq_scripts.yml index 8b2aa3db0..fbd04881d 100644 --- a/.github/workflows/npm_publish_bq_scripts.yml +++ b/.github/workflows/npm_publish_bq_scripts.yml @@ -14,11 +14,11 @@ jobs: runs-on: ubuntu-latest name: publish_if_newer_version steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup node - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - name: NPM install diff --git a/.github/workflows/release-kit.yaml b/.github/workflows/release-kit.yaml index 2ea8f0388..4dee4e561 100644 --- a/.github/workflows/release-kit.yaml +++ b/.github/workflows/release-kit.yaml @@ -51,10 +51,12 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # zizmor: ignore[artipacked] + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "24" @@ -75,14 +77,13 @@ jobs: contents: write # Needed to push version commit, git tag & create GitHub Release steps: - name: Checkout repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # zizmor: ignore[artipacked] + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # zizmor: ignore[artipacked] - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "24" registry-url: "https://wombat-dressing-room.appspot.com" - always-auth: false - name: Configure Git User if: ${{ !inputs.dry_run }}