Repository navigation
Bump checkout and setup-node to v7; dry-run the release job in CI - #60
Merged
Merged
Conversation
Both ran on the deprecated Node 20 runtime (GitHub forces Node 24 on them and warns). v5 moved them to node24; v7 is current. Checked against the breaking changes of v5 to v7: neither workflow uses pull_request_target / workflow_run (checkout v7); the sync-version job's `git push` keeps working with the credentials checkout v6 now keeps in a file under RUNNER_TEMP; package.json has no `packageManager` field, so no cache is enabled implicitly (setup-node v5/v6); the removed dummy NODE_AUTH_TOKEN (setup-node v7) does not concern npm Trusted Publishing (OIDC), which is how the release publishes. The release workflow only runs when a release is published, so the only way to find out that an action or npm change broke it was to cut a release. The new `release` CI job runs its setup (registry-url without a token, the latest npm, a version taken from a tag, the prepublishOnly build) up to a `npm publish --dry-run`, on every run, and is part of the required `CI` check. The release workflow also stops setup-node from restoring a package-manager cache in a job that can publish. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the workflows from
actions/checkout@v4/actions/setup-node@v4(Node 20 runtime, which GitHub now forces onto Node 24 with a deprecation warning) to@v7, the current major of both.Why it is safe to jump three majors
Read the breaking changes of v5, v6 and v7 of both actions against what the two workflows actually do:
RUNNER_TEMP, not.git/configsync-versiondoesgit push; the notes saygit pushkeeps working with no changepull_request_target/workflow_runpackageManageris set inpackage.jsoncache: npmexplicitly)always-authremovedNODE_AUTH_TOKENremoved whenregistry-urlhas no tokennpm-publish.ymlpublishesThe one workflow I can't run without releasing
npm-publish.ymlonly runs when a release is published, and the last row above is exactly the kind of change that would break it. So:releasejob in CI ("Release dry run"): the release job's setup (registry-urlwithout a token, latest npm, a version set from a tag,npm ci) up tonpm publish --dry-run. No credentials, nothing sent. It runs on every PR and is part of the aggregateCIcheck, so a future action or npm change that breaks the release job fails here instead of at release time.npm-publish.ymlalso getspackage-manager-cache: false(what the setup-node docs recommend for a job that holdsid-token: write+contents: write). It is a no-op today, a guard against it silently changing.OIDC itself (the token exchange) can only be exercised by a real release; the dry run covers everything around it.
Test plan
🤖 Generated with Claude Code