Conversation
Every build job currently emits a deprecation warning: Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4 The workflows under .github/workflows/ were already moved to Node 24 runtimes, but the two local composite actions under .github/actions/ were left behind on v4: .github/actions/checkout-qmk_firmware actions/checkout@v4 .github/actions/release-archive actions/download-artifact@v4 This happened because Dependabot does not scan composite actions in subdirectories. With `directory: "/"` it only searches .github/workflows and a root-level action.yml, so no update PR is ever opened for these two files. For example, "Bump actions/checkout from 4 to 6" (0a4b8aa) updated build-firmware.yml and release.yml but left the composite action on v4, even though all three referenced actions/checkout@v4 at that moment. Move both to the majors already in use by the workflows, which run on Node 24 (verified via each action's action.yml `using:` field): actions/checkout v4 (node20) -> v6 (node24) actions/download-artifact v4 (node20) -> v8 (node24) All inputs used here are still supported in the new majors.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every build job currently emits this deprecation warning:
The workflows under
.github/workflows/have already been moved to Node 24 runtimes, but the two local composite actions under.github/actions/were left behind on v4:.github/actions/checkout-qmk_firmware/action.ymlactions/checkout@v4.github/actions/release-archive/action.ymlactions/download-artifact@v4Why this was missed
Dependabot does not scan composite actions in subdirectories. With
directory: "/"it only searches.github/workflowsand a root-levelaction.yml, so no update PR is ever opened for these two files.Concretely, 0a4b8aa ("Bump actions/checkout from 4 to 6") updated
build-firmware.ymlandrelease.ymlbut left the composite action on v4 — even though all three referencedactions/checkout@v4at that moment. The same happened with b7b427e fordownload-artifact.This is a known Dependabot limitation, reported for exactly this layout and closed as not planned:
Change
Move both to the majors already in use by the workflows. Node runtimes verified from each action's own
action.ymlusing:field:actions/checkoutnode20)node24)actions/download-artifactnode20)node24)All inputs used here (
path,repository,submodules,ref,pattern,merge-multiple) are still supported in the new majors.Verification
Built on a fork using the
pull_requestevent (the same event this PR uses):Build all firmwares: all 19 build jobs plusCheck sizegreenBuild all firmwares: 19 → 0Optional follow-up (not included in this PR)
To stop this from silently recurring,
.github/dependabot.ymlcould cover the composite action directories:I have not verified this config myself, so I left it out of this PR. Note that globstar paths have been reported to produce duplicate PRs (dependabot/dependabot-core#10884), so listing the directories explicitly looks safer than
/.github/actions/*.