fix: bump all node20 actions in action.yml to Node 24 versions - #2681
Conversation
|
This PR bumps
All of these already have queued major-version updates on the Dependency Dashboard (#191): Given Node 20 removal lands 2026-09-23, worth bundling these into this PR or opening a follow-up before that date. |
Follow-up to the checkout/github-script bump: move every other Node 20 (or Node 16) action pinned in action.yml to its current Node 24 major, keeping the SHA-pinned style. - actions/cache (restore + save) v4.3.0 -> v6.1.0 - aws-actions/configure-aws-credentials v4.3.1 -> v6.2.4 - google-github-actions/auth v2.1.13 -> v3.0.0 - google-github-actions/setup-gcloud v2.2.1 -> v3.0.1 - hashicorp/setup-terraform v3.1.2 -> v4.0.1 - pulumi/actions v4.5.1 -> v7.0.0 - actions/setup-go v5.5.0 -> v7.0.0 - azure/login v2.2.0 -> v3.1.0 - opentofu/setup-opentofu v1.0.5 -> v2.0.2 Every input this action passes to each of these still exists at the new version. Not bumped: autero1/action-terragrunt (v3.0.2, node20) and rhythmictech/actions-setup-tfenv (v0.1.2, node16) have no Node 24 release yet.
michael-salo
changed the title
|
Thanks for the thorough list — agreed, done in db36397. Bumped everything from your list plus three more node20 actions that were also pinned in
All SHA-pinned to the release tag, same style as before. I checked each major's release notes and confirmed every input Two I couldn't bump because there's no Node 24 release upstream yet:
Both are gated behind |
There was a problem hiding this comment.
Hey @joshuamkite-nfb , @michael-salo . Appreciate the work here. I had had to verify all 12 SHAs resolve to the tagged commits.
Thanks a bunch!
…ll steps GitHub removes Node 16 and Node 20 from Actions runners on 2026-09-23. Two actions used by setup-terragrunt and setup-tfenv have no Node 24 release upstream and are effectively unmaintained: - autero1/action-terragrunt v3.0.2 (node20, last release Feb 2024) - rhythmictech/actions-setup-tfenv v0.1.2 (node16, last release Jul 2022) Both are replaced with bash steps that reproduce their behaviour: - tfenv: clone tfutils/tfenv into $HOME/.tfenv if absent, add bin to PATH. - terragrunt: accept "0.73.7", "v0.73.7" or "latest"; download the release binary for linux/darwin/windows on amd64/arm64/386; add to PATH. Follows #2681 and #2708. Closes the remaining gap in #2707.
…ll steps (#2709) GitHub removes Node 16 and Node 20 from Actions runners on 2026-09-23. Two actions used by setup-terragrunt and setup-tfenv have no Node 24 release upstream and are effectively unmaintained: - autero1/action-terragrunt v3.0.2 (node20, last release Feb 2024) - rhythmictech/actions-setup-tfenv v0.1.2 (node16, last release Jul 2022) Both are replaced with bash steps that reproduce their behaviour: - tfenv: clone tfutils/tfenv into $HOME/.tfenv if absent, add bin to PATH. - terragrunt: accept "0.73.7", "v0.73.7" or "latest"; download the release binary for linux/darwin/windows on amd64/arm64/386; add to PATH. Follows #2681 and #2708. Closes the remaining gap in #2707.
3 participants
What
Bumps every Node 20 (or Node 16) action pinned inside
action.ymlto its current Node 24 major, same SHA-pinned style as the existing pins:actions/checkout34e11487(v4.3.1)d23441a4(v6.1.0)actions/github-scriptf28e40c7(v7.1.0)3a2844b7(v9.0.0)actions/cache/restore,actions/cache/save0057852b(v4.3.0)55cc8345(v6.1.0)aws-actions/configure-aws-credentials7474bc46(v4.3.1)cbe3b392(v6.2.4)google-github-actions/authc200f369(v2.1.13)7c6bc770(v3.0.0)google-github-actions/setup-gcloude427ad8a(v2.2.1)aa5489c8(v3.0.1)hashicorp/setup-terraformb9cd54a3(v3.1.2)dfe3c3f8(v4.0.1)pulumi/actionsa3f382e1(v4.5.1)8e5e406f(v7.0.0)actions/setup-god35c59ab(v5.5.0)b7ad1dad(v7.0.0)azure/logina65d910e(v2.2.0)a641126d(v3.1.0)opentofu/setup-opentofu592200bd(v1.0.5)a1320f89(v2.0.2)Not bumped (no Node 24 release exists upstream yet):
autero1/action-terragruntv3.0.2 (node20) — latest releaserhythmictech/actions-setup-tfenvv0.1.2 (node16) — latest releaseThese two only run when
setup-terragrunt/setup-tfenvare set totrue, so they don't affect the default path. They'll need an upstream release or a replacement before 2026-09-23.Why
GitHub is removing Node 20 from Actions runners on 2026-09-23 (changelog). After that date any step that declares
runs.using: node20fails outright. Today every workflow using this action already emits the forced-Node-24 warning for the steps that execute.All of these bumps are already queued (unchecked) on the Renovate Dependency Dashboard (#191) — this PR just lands them together. Follows the precedent of #2620, which manually bumped checkout to v4.3.1.
Compatibility review
Checked the major-version release notes and confirmed every input
action.ymlpasses still exists at the new SHA:google-github-actions/authv3 "removed old parameters" —credentials_json,token_format,service_account,workload_identity_provider,audienceall still present.google-github-actions/setup-gcloudv3 removedskip_tool_cache— not used here.aws-actions/configure-aws-credentialsv5 changed invalid-boolean input handling — no boolean inputs are passed here. v5 is still node20, so went straight to v6.pulumi/actionsv5/v6 are still node20, so went straight to v7. (Pre-existing, unrelated: the step passestofu_version:rather thanpulumi-version:; left as-is to keep this PR scoped.)actions/cachev6,actions/setup-gov7: ESM migration only, inputs unchanged.azure/loginv3,opentofu/setup-opentofuv2,hashicorp/setup-terraformv4: Node 24 bump only.Notes