ci: update workflow actions for Node 24#98
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses deprecation warnings from GitHub Actions regarding JavaScript actions still relying on Node 20. The changes proactively update CI workflows to utilize Node 24, either by upgrading action versions that support it or by explicitly forcing Node 24 runtime for actions that haven't yet released a compatible version. This ensures future stability and prevents potential breaking changes when GitHub Actions eventually enforces Node 24. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the pnpm/action-setup GitHub Action from v4.2.0 to v4.4.0 in the .github/actions/setup-desktop-build/action.yml file. This change addresses the GitHub Actions deprecation warning for the Node 20 runtime by moving to a version that supports Node 24. The update is a necessary maintenance task to ensure the CI pipeline remains stable. The change is correct and I have no suggestions for improvement.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- If
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24is only required for thesoftprops/action-gh-releaseusage, consider scoping it to the specific job or step instead of setting it as a workflow-wide env var to reduce unintended coupling with other jobs.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- If `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` is only required for the `softprops/action-gh-release` usage, consider scoping it to the specific job or step instead of setting it as a workflow-wide env var to reduce unintended coupling with other jobs.
## Individual Comments
### Comment 1
<location path=".github/workflows/build-desktop-tauri.yml" line_range="112" />
<code_context>
- name: Setup pnpm
- uses: pnpm/action-setup@v4.2.0
+ uses: pnpm/action-setup@v4.4.0
with:
version: ${{ inputs.pnpm-version }}
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Pin `pnpm/action-setup` to a full commit SHA for better supply-chain security
Using a mutable tag means this workflow could change behavior without any code change here. To improve supply-chain security, pin this to the exact commit SHA for `v4.4.0` (e.g., `pnpm/action-setup@<sha>`) and optionally add a comment noting it corresponds to `v4.4.0`.
Suggested implementation:
```
- name: Setup pnpm
# pnpm/action-setup v4.4.0
uses: pnpm/action-setup@<pnpm-action-setup-v4.4.0-commit-sha>
with:
version: 10.28.2
```
Replace `<pnpm-action-setup-v4.4.0-commit-sha>` with the actual commit SHA of the `v4.4.0` tag from https://github.com/pnpm/action-setup (e.g., run `git ls-remote https://github.com/pnpm/action-setup refs/tags/v4.4.0` or check the tag in the GitHub UI and copy the full 40‑char SHA). Keep the comment in sync if you later bump the version.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
|
||
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v4.2.0 | ||
| uses: pnpm/action-setup@v4.4.0 |
There was a problem hiding this comment.
🚨 suggestion (security): Pin pnpm/action-setup to a full commit SHA for better supply-chain security
Using a mutable tag means this workflow could change behavior without any code change here. To improve supply-chain security, pin this to the exact commit SHA for v4.4.0 (e.g., pnpm/action-setup@<sha>) and optionally add a comment noting it corresponds to v4.4.0.
Suggested implementation:
- name: Setup pnpm
# pnpm/action-setup v4.4.0
uses: pnpm/action-setup@<pnpm-action-setup-v4.4.0-commit-sha>
with:
version: 10.28.2
Replace <pnpm-action-setup-v4.4.0-commit-sha> with the actual commit SHA of the v4.4.0 tag from https://github.com/pnpm/action-setup (e.g., run git ls-remote https://github.com/pnpm/action-setup refs/tags/v4.4.0 or check the tag in the GitHub UI and copy the full 40‑char SHA). Keep the comment in sync if you later bump the version.
1 participant
Summary
GitHub Actions is warning that this workflow still depends on JavaScript actions that declare a Node 20 runtime. The desktop build matrix reports the warning for
pnpm/action-setup@v4.2.0, and the release publishing job reports the same deprecation forsoftprops/action-gh-release@v2.5.0.The immediate user-facing effect is noisy CI across all desktop targets and a clear upgrade deadline from GitHub Actions. Left unchanged, these jobs will eventually be forced onto Node 24 by the runner platform anyway, which increases the risk of surprise behavior changes landing at the same time as a release build.
The root cause is that the workflow pins an older
pnpm/action-setuprelease that still declaresruns.using: node20, andsoftprops/action-gh-releasedoes not currently publish a released tag with a Node 24 runtime. That means a version bump alone is enough for pnpm setup, but not for the release publishing step.This PR applies the smallest safe fix for both cases. It upgrades both
pnpm/action-setupcall sites tov4.4.0, whose published action metadata switches tonode24, and it setsFORCE_JAVASCRIPT_ACTIONS_TO_NODE24=trueat thebuild-desktop-tauriworkflow level so the remainingsoftprops/action-gh-releasestep runs under Node 24 until that action ships a released Node 24 build.Verification
pnpm/action-setupreferences now point atv4.4.0pnpm/action-setup@v4.4.0publishesruns: using: node24softprops/action-gh-releasestill publishruns: using: node20git diff --checkSummary by Sourcery
Update CI workflows to run JavaScript GitHub Actions on Node 24 for desktop builds and releases.
CI: