From 728a89f9ae5a3a2289971268d2ca92129a063648 Mon Sep 17 00:00:00 2001 From: James Fry Date: Thu, 8 Oct 2026 14:09:07 -0600 Subject: [PATCH] Bump the GitHub Actions to checkout@v7 and setup-node@v7 Both ran on the deprecated Node 20 runtime (GitHub forces Node 24 on them and warns). v5 moved them to node24; v7 is current. Checked against the breaking changes of v5 to v7: neither workflow uses pull_request_target / workflow_run (checkout v7); the sync-version job's `git push` keeps working with the credentials checkout v6 now keeps in a file under RUNNER_TEMP; package.json has no `packageManager` field, so no cache is enabled implicitly (setup-node v5/v6); the removed dummy NODE_AUTH_TOKEN (setup-node v7) does not concern npm Trusted Publishing (OIDC), which is how the release publishes. The release workflow only runs when a release is published, so the only way to find out that an action or npm change broke it was to cut a release. The new `release` CI job runs its setup (registry-url without a token, the latest npm, a version taken from a tag, the prepublishOnly build) up to a `npm publish --dry-run`, on every run, and is part of the required `CI` check. The release workflow also stops setup-node from restoring a package-manager cache in a job that can publish. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/ci.yml | 51 +++++++++++++++++++++++-------- .github/workflows/npm-publish.yml | 8 +++-- 2 files changed, 43 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5d47c2a..3112a5c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,9 +29,9 @@ jobs: matrix: node: [20, 22, 24] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: ${{ matrix.node }} cache: npm @@ -47,9 +47,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -64,9 +64,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -85,9 +85,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -103,9 +103,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -138,20 +138,45 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: 22 cache: npm - run: npm audit --omit=dev --audit-level=high + release: + # The release workflow (npm-publish.yml) only runs when a release is published, so a change to the actions or to npm it relies on + # would only show up then. This runs its setup (registry-url without a token, the latest npm, the version taken from a tag, the build + # of prepublishOnly) up to the point of publishing, which is a dry run: no credentials, nothing is sent. + name: Release dry run + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v7 + + - uses: actions/setup-node@v7 + with: + node-version: '22' + registry-url: 'https://registry.npmjs.org/' + package-manager-cache: false + + - run: npm install -g npm@latest + + - name: Set the package version, as the release does from the tag + run: npm version 3.0.0-ci.0 --no-git-tag-version + + - run: npm ci --no-audit --no-fund + + - run: npm publish --dry-run --tag ci + ci: # The one check to require in the branch protection rules: the names of the matrix jobs above can change. name: CI if: ${{ always() }} - needs: [test, coverage, build, types, php, audit] + needs: [test, coverage, build, types, php, audit, release] runs-on: ubuntu-latest steps: - name: Every job succeeded diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 4ee0c94..6bb8506 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -13,13 +13,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: '22' registry-url: 'https://registry.npmjs.org/' + # a job that can publish does not restore a cache that other runs could have written to + package-manager-cache: false - name: Upgrade NPM to latest run: npm install -g npm@latest @@ -65,7 +67,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout main - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: main