From eafd3ba9c987ac1a619673595954030d698ff1fe Mon Sep 17 00:00:00 2001 From: Andrew Sazonov Date: Tue, 5 May 2026 11:11:17 +0200 Subject: [PATCH 1/7] Upgrade Node24-ready GitHub actions --- .../actions/setup-easyscience-bot/action.yml | 4 +- .github/actions/upload-codecov/action.yml | 4 +- .github/workflows/backmerge.yml | 5 - .github/workflows/cleanup.yml | 9 +- .github/workflows/issues-labels.yml | 5 - .github/workflows/lint-format.yml | 3 - .github/workflows/release-notes.yml | 4 +- .github/workflows/release-pr.yml | 3 - .github/workflows/security.yml | 5 - .github/workflows/test-trigger.yml | 5 - .github/workflows/tutorial-tests-trigger.yml | 5 - ...4-actions-migration_deepseek-v4-pro-max.md | 106 ++++++++++++ ..._node24-actions-migration_gpt-5-4-xhigh.md | 154 ++++++++++++++++++ 13 files changed, 267 insertions(+), 45 deletions(-) create mode 100644 docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md create mode 100644 docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md diff --git a/.github/actions/setup-easyscience-bot/action.yml b/.github/actions/setup-easyscience-bot/action.yml index 4b28eaf8a..e51eb01ac 100644 --- a/.github/actions/setup-easyscience-bot/action.yml +++ b/.github/actions/setup-easyscience-bot/action.yml @@ -22,9 +22,9 @@ runs: steps: - name: Create GitHub App installation token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@v3 with: - app-id: ${{ inputs.app-id }} + client-id: ${{ inputs.app-id }} private-key: ${{ inputs.private-key }} repositories: ${{ inputs.repositories }} diff --git a/.github/actions/upload-codecov/action.yml b/.github/actions/upload-codecov/action.yml index 37d6298aa..847a88b84 100644 --- a/.github/actions/upload-codecov/action.yml +++ b/.github/actions/upload-codecov/action.yml @@ -1,5 +1,5 @@ name: 'Upload coverage to Codecov' -description: 'Generic wrapper for codecov/codecov-action@v5' +description: 'Generic wrapper for codecov/codecov-action@v6' inputs: name: @@ -32,7 +32,7 @@ inputs: runs: using: composite steps: - - uses: codecov/codecov-action@v5 + - uses: codecov/codecov-action@v6 with: name: ${{ inputs.name }} flags: ${{ inputs.flags }} diff --git a/.github/workflows/backmerge.yml b/.github/workflows/backmerge.yml index d8569f058..47b3384a0 100644 --- a/.github/workflows/backmerge.yml +++ b/.github/workflows/backmerge.yml @@ -20,11 +20,6 @@ concurrency: group: backmerge-master-into-develop cancel-in-progress: false -# Opt into Node.js 24 for all JavaScript actions. -# Remove once all referenced actions natively target Node 24. -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: backmerge: runs-on: ubuntu-latest diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index d3ebf3a20..21c72b38d 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -15,11 +15,11 @@ on: days: description: 'Number of days.' required: true - default: 30 + default: '30' minimum_runs: description: 'The minimum runs to keep for each workflow.' required: true - default: 6 + default: '6' delete_workflow_pattern: description: 'The name or filename of the workflow. if not set then it will target all @@ -61,11 +61,6 @@ on: - 'false' - 'true' -# Opt into Node.js 24 for all JavaScript actions. -# Remove once all referenced actions natively target Node 24. -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: del-runs: runs-on: ubuntu-latest diff --git a/.github/workflows/issues-labels.yml b/.github/workflows/issues-labels.yml index ed9d1c8ba..df3c55f1d 100644 --- a/.github/workflows/issues-labels.yml +++ b/.github/workflows/issues-labels.yml @@ -11,11 +11,6 @@ on: permissions: issues: write -# Opt into Node.js 24 for all JavaScript actions. -# Remove once all referenced actions natively target Node 24. -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: check-labels: if: github.actor != 'easyscience[bot]' diff --git a/.github/workflows/lint-format.yml b/.github/workflows/lint-format.yml index 720c9a4ab..f1135fa5a 100644 --- a/.github/workflows/lint-format.yml +++ b/.github/workflows/lint-format.yml @@ -34,9 +34,6 @@ permissions: # Set the environment variables to be used in all jobs defined in this workflow env: CI_BRANCH: ${{ github.head_ref || github.ref_name }} - # Opt into Node.js 24 for all JavaScript actions. - # Remove once all referenced actions natively target Node 24. - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true jobs: lint-format: diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml index 3a7cf92ee..6a906a0d7 100644 --- a/.github/workflows/release-notes.yml +++ b/.github/workflows/release-notes.yml @@ -10,8 +10,6 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: -# Opt into Node.js 24 for all JavaScript actions. -# Remove once all referenced actions natively target Node 24. env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true @@ -66,7 +64,7 @@ jobs: GITHUB_TOKEN: ${{ steps.bot.outputs.token }} - name: Create GitHub draft release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: draft: true tag_name: ${{ steps.draft.outputs.tag_name }} diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml index 5694a2a0a..7e6fda49f 100644 --- a/.github/workflows/release-pr.yml +++ b/.github/workflows/release-pr.yml @@ -24,9 +24,6 @@ permissions: env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} SOURCE_BRANCH: ${{ inputs.source_branch || 'develop' }} - # Opt into Node.js 24 for all JavaScript actions. - # Remove once all referenced actions natively target Node 24. - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true jobs: create-pull-request: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index a53e9afc0..9b34cccf4 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -44,11 +44,6 @@ permissions: contents: read security-events: write -# Opt into Node.js 24 for all JavaScript actions. -# Remove once all referenced actions natively target Node 24. -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: codeql: name: Code scanning diff --git a/.github/workflows/test-trigger.yml b/.github/workflows/test-trigger.yml index f4a39e93d..ecf6b40c5 100644 --- a/.github/workflows/test-trigger.yml +++ b/.github/workflows/test-trigger.yml @@ -10,11 +10,6 @@ on: permissions: contents: read -# Opt into Node.js 24 for all JavaScript actions. -# Remove once all referenced actions natively target Node 24. -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: code-tests-trigger: runs-on: ubuntu-latest diff --git a/.github/workflows/tutorial-tests-trigger.yml b/.github/workflows/tutorial-tests-trigger.yml index f28d65279..1bc27f4fc 100644 --- a/.github/workflows/tutorial-tests-trigger.yml +++ b/.github/workflows/tutorial-tests-trigger.yml @@ -10,11 +10,6 @@ on: permissions: contents: read -# Opt into Node.js 24 for all JavaScript actions. -# Remove once all referenced actions natively target Node 24. -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: tutorial-tests-trigger: runs-on: ubuntu-latest diff --git a/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md b/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md new file mode 100644 index 000000000..aa5fc109d --- /dev/null +++ b/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md @@ -0,0 +1,106 @@ +# Plan: Migrate GitHub Actions to Node.js 24 + +**Branch:** `feature/node24-actions` +**Date:** 2026-05-05 + +## Context + +GitHub is deprecating Node.js 20 on actions runners: +- **June 2, 2026:** Node.js 24 becomes default +- **September 16, 2026:** Node.js 20 removed from runners + +We added `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` to 16 workflows as a +temporary measure, but warnings persist because the flag forces Node 24 at +runtime while the actions still *target* Node 20 internally. The long-term fix +is to upgrade every action to a version that natively targets Node 24, then +remove the flag. + +## Answers to extra questions + +### 1. Why do we see those warnings? + +GitHub Actions runners now detect JS actions whose `action.yml` declares +`runs.using: node20`. Even with `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` +(which coerces the runtime to Node 24), the deprecation warning still fires +because the action's *declared* target is Node 20. + +The first warning ("Node.js 20 actions are deprecated") appears for actions +declaring `node20` when the flag is NOT set. The second warning ("target +Node.js 20 but are being forced to run on Node.js 24") appears when the flag +IS set — it's telling you coercion is happening. + +### 2. What is needed to fix this? + +Upgrade every referenced action to a version whose `action.yml` declares +`runs.using: node24`. Three actions in this repo need attention: + +| Action | Current | Target | Status | +|--------|---------|--------|--------| +| `actions/create-github-app-token` | v2 | v3.1.1 | ✅ Available | +| `codecov/codecov-action` | v5 | v6.0.0 | ✅ Available | +| `Wandalen/wretry.action` | v3.8.0 | — | ❌ No Node 24 version | + +### 3. Is `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` a good long-term strategy? + +No. It's a **temporary bridge** to test Node 24 compatibility before actions +are updated. Long-term, every action should declare `node24` natively. The +flag will eventually be removed by GitHub after the transition period. Keeping +it masks the real problem and may hide breakage when Node 20 is removed +entirely (Sept 2026). + +## Changes + +### Step 1: Upgrade `actions/create-github-app-token` v2 → v3 + +**File:** `.github/actions/setup-easyscience-bot/action.yml` + +- Change `uses: actions/create-github-app-token@v2` → `@v3` +- v3.1.1 targets Node 24 (added in v3.0.0, Mar 2026) +- Breaking change: v3 requires runner ≥ v2.327.1 (already satisfied on + `ubuntu-latest`) +- No other input changes needed (`app-id`, `private-key`, `repositories` are + unchanged) + +### Step 2: Upgrade `codecov/codecov-action` v5 → v6 + +**File:** `.github/actions/upload-codecov/action.yml` + +- Change `uses: codecov/codecov-action@v5` → `@v6` +- v6.0.0 targets Node 24 (released Mar 2026) +- This also resolves the `actions/github-script@v7.0.1` (SHA + `60a0d83…`) sub-dependency warning, since v6 internally uses + `actions/github-script@v8` +- No input changes needed for our usage + +### Step 3: Replace `Wandalen/wretry.action@v3.8.0` with bash retry + +**File:** `.github/workflows/dashboard.yml` + +`wretry.action` has no Node 24-compatible release (latest v3.8.0 is from +Jan 2025). Replace the retry logic with a bash `while` loop that re-runs +the `peaceiris/actions-gh-pages@v4` deploy step on failure. + +The replacement step will: +- Use a bash loop with 3 attempts and 15-second delay between retries +- Call `peaceiris/actions-gh-pages@v4` (a Docker action, no Node.js concern) +- Preserve identical behavior + +### Step 4: Remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` + +Once all three actions are updated, no JS action in the repo targets Node 20. +Remove the env var from all 16 workflows that set it. + +## Verification (Phase 2) + +- [ ] Run `pixi run check` to ensure no lint/format regressions +- [ ] Manually inspect each workflow YAML for syntax validity +- [ ] Trigger a test run via `workflow_dispatch` on `dashboard.yml`, + `coverage.yml`, and `backmerge.yml` (the workflows most affected by the + changes) +- [ ] Confirm all deprecation warnings are gone from workflow run logs + +## Open Questions + +- [ ] Is there a `Wandalen/wretry.action` issue/PR tracking Node 24 support? + If yes, we could defer Step 3 and keep `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` + in `dashboard.yml` only until upstream ships. diff --git a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md new file mode 100644 index 000000000..9a511952c --- /dev/null +++ b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md @@ -0,0 +1,154 @@ +# Node24 Actions Migration Plan + +## Goal + +Eliminate GitHub Actions Node.js 20 deprecation warnings originating from +this repository's `.github/` configuration while preserving current workflow +behavior. Remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only after the relevant +actions are upgraded or replaced. + +## Current Findings + +### Confirmed warning sources + +| Surface | Current reference | Verified runtime status | Planned direction | +| --- | --- | --- | --- | +| `.github/actions/setup-easyscience-bot/action.yml` | `actions/create-github-app-token@v2` | Node 20 warning source | Upgrade to `@v3` | +| `.github/actions/upload-codecov/action.yml` | `codecov/codecov-action@v5` | Composite action; `v5` internally pins `actions/github-script@v7.0.1` (Node 20) | Upgrade to `@v6` | +| `.github/workflows/dashboard.yml` | `Wandalen/wretry.action@v3.8.0` | Composite action resolves to `v3.8.0_js_action`, which declares `node20` | Replace action chain | + +### Confirmed future warning sources in current workflow graph + +| Surface | Current reference | Verified runtime status | Planned direction | +| --- | --- | --- | --- | +| `.github/workflows/dashboard.yml` | `peaceiris/actions-gh-pages@v4` (wrapped by `wretry`) | Declares `node20` | Replace with local shell/git publish logic | +| `.github/workflows/release-notes.yml` | `enhantica/drafterino@v2` | Declares `node20` | Upgrade upstream or replace locally | +| `.github/workflows/release-notes.yml` | `softprops/action-gh-release@v2` | Declares `node20`; upstream `v3` is Node 24 | Upgrade to `@v3` | + +### Actions already aligned or not a Node warning risk + +| Reference | Status | +| --- | --- | +| `actions/checkout@v5` | Declares `node24` | +| `prefix-dev/setup-pixi@v0.9.4` | Declares `node24` | +| `.github/actions/github-script` -> `actions/github-script@v8` | Declares `node24` | +| `Mattraks/delete-workflow-runs@v2` | Major tag currently resolves to `node24` | +| `trstringer/require-label-prefix@v1` | Docker action, not a Node runtime warning source | +| `github/codeql-action@v4` | Composite stub at root; not part of the reported warning set | + +### Watchlist + +These are not part of the quoted warnings, but their current upstream action +manifests still declare `node20` and may need follow-up if GitHub starts +flagging them in this repository's runs: + +- `actions/setup-python@v5` +- `actions/upload-artifact@v4` +- `actions/download-artifact@v4` + +Do not churn on these in this repo until they either start warning in actual +runs or an obvious safe upgrade path exists. + +## Decisions Already Made + +- `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` is a temporary compatibility + switch, not a fix. It keeps workflows running but does not remove warnings. +- Upgrading only `Wandalen/wretry.action` is not sufficient, because the wrapped + `peaceiris/actions-gh-pages@v4` action also still targets Node 20. +- `actions/create-github-app-token@v3` can be adopted without an immediate + secret/variable migration because it still accepts the deprecated `app-id` + input. A later cleanup can move to `client-id` if desired. + +## Files Likely To Change + +- `.github/actions/setup-easyscience-bot/action.yml` +- `.github/actions/upload-codecov/action.yml` +- `.github/workflows/dashboard.yml` +- `.github/workflows/release-notes.yml` +- `.github/workflows/backmerge.yml` +- `.github/workflows/docs.yml` +- `.github/workflows/issues-labels.yml` +- `.github/workflows/pypi-test.yml` +- `.github/workflows/release-pr.yml` +- `.github/workflows/test-trigger.yml` +- `.github/workflows/tutorial-tests-trigger.yml` +- `.github/workflows/coverage.yml` +- `.github/workflows/test.yml` +- `.github/workflows/tutorial-tests.yml` +- Possibly a new helper under `.github/scripts/` for dashboard publishing + retries and push logic +- Possibly a local replacement script/action for Drafterino if upstream is not + updated in time + +## Open Questions + +- Should `enhantica/drafterino` be updated upstream as part of this effort, or + should this repository replace it locally to remove the dependency? +- Is it acceptable to replace the dashboard publish step with plain shell/git + logic instead of third-party publish actions? +- Should the watchlist actions be proactively replaced if warnings appear, or + should we wait for upstream major releases from the action maintainers? + +## Phase 1 — Implementation + +- [ ] Upgrade `.github/actions/setup-easyscience-bot/action.yml` from + `actions/create-github-app-token@v2` to `@v3`. +- [ ] Upgrade `.github/actions/upload-codecov/action.yml` from + `codecov/codecov-action@v5` to `@v6`. +- [ ] Replace the dashboard publish chain in `.github/workflows/dashboard.yml` + so it no longer depends on either `Wandalen/wretry.action` or + `peaceiris/actions-gh-pages`. +- [ ] Keep the replacement behaviorally equivalent: publish to the external + `dashboard` repository, preserve existing files, and retry transient push + failures. +- [ ] Upgrade `.github/workflows/release-notes.yml` from + `softprops/action-gh-release@v2` to `@v3`. +- [ ] Decide and implement one of the two Drafterino paths: + update `enhantica/drafterino` upstream to a Node 24-compatible release and + bump the dependency here, or replace it locally in this repository. +- [ ] Re-run the `.github/` action inventory after the above changes and remove + `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only from workflows that no longer + depend on Node 20 actions. +- [ ] Leave `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only where there is a known, + documented upstream blocker. + +Stop after Phase 1 and ask for review before starting verification. + +## Phase 2 — Verification + +- [ ] Validate workflow YAML after edits. +- [ ] Re-scan `.github/workflows/` and `.github/actions/` for external action + references and confirm the warning-causing refs are gone. +- [ ] Trigger or re-run the affected workflows and inspect logs for Node 20 + deprecation messages: + `coverage.yml`, reusable `dashboard.yml`, `release-notes.yml`, and any + workflow that uses `.github/actions/setup-easyscience-bot`. +- [ ] If warnings remain, record the exact action refs and classify them as + either upgradeable in-repo or blocked on upstream releases. +- [ ] Remove the remaining `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` entries only + after the corresponding workflows complete without Node 20 warnings. + +## Suggested Verification Commands + +These are the cheapest local checks before running workflows remotely: + +```bash +grep -R "uses:" .github/workflows .github/actions +grep -R "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24" .github/workflows +``` + +Remote verification is required for the actual warning condition because the +warnings are emitted by GitHub-hosted runners, not by local tooling. + +## Suggested Branch + +`feature/node24-actions-migration` + +## Suggested Commit Messages + +```text +Upgrade GitHub App token and Codecov actions +Replace dashboard publish actions with shell flow +Migrate release notes workflow off Node 20 actions +Remove temporary Node24 force overrides +``` From a7d7151ab090b0115a9568e25808b9ed6e3c1acf Mon Sep 17 00:00:00 2001 From: Andrew Sazonov Date: Tue, 5 May 2026 11:21:35 +0200 Subject: [PATCH 2/7] Upgrade upload-artifact action to v7 --- .github/actions/upload-artifact/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/upload-artifact/action.yml b/.github/actions/upload-artifact/action.yml index 825ac396c..4280c6b55 100644 --- a/.github/actions/upload-artifact/action.yml +++ b/.github/actions/upload-artifact/action.yml @@ -38,7 +38,7 @@ runs: using: 'composite' steps: - name: Upload artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ inputs.name }} path: ${{ inputs.path }} From 9f31c0532a7f6cd63dae330dfe9a99ce2a3a16b5 Mon Sep 17 00:00:00 2001 From: Andrew Sazonov Date: Tue, 5 May 2026 11:21:54 +0200 Subject: [PATCH 3/7] Update Node24 actions migration plans --- ...4-actions-migration_deepseek-v4-pro-max.md | 74 +++++---- ..._node24-actions-migration_gpt-5-4-xhigh.md | 153 +++++++++--------- 2 files changed, 119 insertions(+), 108 deletions(-) diff --git a/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md b/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md index aa5fc109d..d2b9c83aa 100644 --- a/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md +++ b/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md @@ -1,52 +1,53 @@ # Plan: Migrate GitHub Actions to Node.js 24 -**Branch:** `feature/node24-actions` -**Date:** 2026-05-05 +**Branch:** `feature/node24-actions` **Date:** 2026-05-05 ## Context GitHub is deprecating Node.js 20 on actions runners: + - **June 2, 2026:** Node.js 24 becomes default - **September 16, 2026:** Node.js 20 removed from runners We added `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` to 16 workflows as a -temporary measure, but warnings persist because the flag forces Node 24 at -runtime while the actions still *target* Node 20 internally. The long-term fix -is to upgrade every action to a version that natively targets Node 24, then -remove the flag. +temporary measure, but warnings persist because the flag forces Node 24 +at runtime while the actions still _target_ Node 20 internally. The +long-term fix is to upgrade every action to a version that natively +targets Node 24, then remove the flag. ## Answers to extra questions ### 1. Why do we see those warnings? GitHub Actions runners now detect JS actions whose `action.yml` declares -`runs.using: node20`. Even with `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` -(which coerces the runtime to Node 24), the deprecation warning still fires -because the action's *declared* target is Node 20. +`runs.using: node20`. Even with +`FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` (which coerces the runtime to +Node 24), the deprecation warning still fires because the action's +_declared_ target is Node 20. -The first warning ("Node.js 20 actions are deprecated") appears for actions -declaring `node20` when the flag is NOT set. The second warning ("target -Node.js 20 but are being forced to run on Node.js 24") appears when the flag -IS set — it's telling you coercion is happening. +The first warning ("Node.js 20 actions are deprecated") appears for +actions declaring `node20` when the flag is NOT set. The second warning +("target Node.js 20 but are being forced to run on Node.js 24") appears +when the flag IS set — it's telling you coercion is happening. ### 2. What is needed to fix this? Upgrade every referenced action to a version whose `action.yml` declares `runs.using: node24`. Three actions in this repo need attention: -| Action | Current | Target | Status | -|--------|---------|--------|--------| -| `actions/create-github-app-token` | v2 | v3.1.1 | ✅ Available | -| `codecov/codecov-action` | v5 | v6.0.0 | ✅ Available | -| `Wandalen/wretry.action` | v3.8.0 | — | ❌ No Node 24 version | +| Action | Current | Target | Status | +| --------------------------------- | ------- | ------ | --------------------- | +| `actions/create-github-app-token` | v2 | v3.1.1 | ✅ Available | +| `codecov/codecov-action` | v5 | v6.0.0 | ✅ Available | +| `Wandalen/wretry.action` | v3.8.0 | — | ❌ No Node 24 version | ### 3. Is `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` a good long-term strategy? -No. It's a **temporary bridge** to test Node 24 compatibility before actions -are updated. Long-term, every action should declare `node24` natively. The -flag will eventually be removed by GitHub after the transition period. Keeping -it masks the real problem and may hide breakage when Node 20 is removed -entirely (Sept 2026). +No. It's a **temporary bridge** to test Node 24 compatibility before +actions are updated. Long-term, every action should declare `node24` +natively. The flag will eventually be removed by GitHub after the +transition period. Keeping it masks the real problem and may hide +breakage when Node 20 is removed entirely (Sept 2026). ## Changes @@ -58,8 +59,8 @@ entirely (Sept 2026). - v3.1.1 targets Node 24 (added in v3.0.0, Mar 2026) - Breaking change: v3 requires runner ≥ v2.327.1 (already satisfied on `ubuntu-latest`) -- No other input changes needed (`app-id`, `private-key`, `repositories` are - unchanged) +- No other input changes needed (`app-id`, `private-key`, `repositories` + are unchanged) ### Step 2: Upgrade `codecov/codecov-action` v5 → v6 @@ -67,8 +68,8 @@ entirely (Sept 2026). - Change `uses: codecov/codecov-action@v5` → `@v6` - v6.0.0 targets Node 24 (released Mar 2026) -- This also resolves the `actions/github-script@v7.0.1` (SHA - `60a0d83…`) sub-dependency warning, since v6 internally uses +- This also resolves the `actions/github-script@v7.0.1` (SHA `60a0d83…`) + sub-dependency warning, since v6 internally uses `actions/github-script@v8` - No input changes needed for our usage @@ -81,26 +82,29 @@ Jan 2025). Replace the retry logic with a bash `while` loop that re-runs the `peaceiris/actions-gh-pages@v4` deploy step on failure. The replacement step will: + - Use a bash loop with 3 attempts and 15-second delay between retries -- Call `peaceiris/actions-gh-pages@v4` (a Docker action, no Node.js concern) +- Call `peaceiris/actions-gh-pages@v4` (a Docker action, no Node.js + concern) - Preserve identical behavior ### Step 4: Remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` -Once all three actions are updated, no JS action in the repo targets Node 20. -Remove the env var from all 16 workflows that set it. +Once all three actions are updated, no JS action in the repo targets +Node 20. Remove the env var from all 16 workflows that set it. ## Verification (Phase 2) - [ ] Run `pixi run check` to ensure no lint/format regressions - [ ] Manually inspect each workflow YAML for syntax validity - [ ] Trigger a test run via `workflow_dispatch` on `dashboard.yml`, - `coverage.yml`, and `backmerge.yml` (the workflows most affected by the - changes) + `coverage.yml`, and `backmerge.yml` (the workflows most affected + by the changes) - [ ] Confirm all deprecation warnings are gone from workflow run logs ## Open Questions -- [ ] Is there a `Wandalen/wretry.action` issue/PR tracking Node 24 support? - If yes, we could defer Step 3 and keep `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` - in `dashboard.yml` only until upstream ships. +- [ ] Is there a `Wandalen/wretry.action` issue/PR tracking Node 24 + support? If yes, we could defer Step 3 and keep + `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` in `dashboard.yml` only until + upstream ships. diff --git a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md index 9a511952c..f6679b074 100644 --- a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md +++ b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md @@ -2,62 +2,65 @@ ## Goal -Eliminate GitHub Actions Node.js 20 deprecation warnings originating from -this repository's `.github/` configuration while preserving current workflow -behavior. Remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only after the relevant -actions are upgraded or replaced. +Eliminate GitHub Actions Node.js 20 deprecation warnings originating +from this repository's `.github/` configuration while preserving current +workflow behavior. Remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only +after the relevant actions are upgraded or replaced. ## Current Findings ### Confirmed warning sources -| Surface | Current reference | Verified runtime status | Planned direction | -| --- | --- | --- | --- | -| `.github/actions/setup-easyscience-bot/action.yml` | `actions/create-github-app-token@v2` | Node 20 warning source | Upgrade to `@v3` | -| `.github/actions/upload-codecov/action.yml` | `codecov/codecov-action@v5` | Composite action; `v5` internally pins `actions/github-script@v7.0.1` (Node 20) | Upgrade to `@v6` | -| `.github/workflows/dashboard.yml` | `Wandalen/wretry.action@v3.8.0` | Composite action resolves to `v3.8.0_js_action`, which declares `node20` | Replace action chain | +| Surface | Current reference | Verified runtime status | Planned direction | +| -------------------------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------- | -------------------- | +| `.github/actions/setup-easyscience-bot/action.yml` | `actions/create-github-app-token@v2` | Node 20 warning source | Upgrade to `@v3` | +| `.github/actions/upload-codecov/action.yml` | `codecov/codecov-action@v5` | Composite action; `v5` internally pins `actions/github-script@v7.0.1` (Node 20) | Upgrade to `@v6` | +| `.github/workflows/dashboard.yml` | `Wandalen/wretry.action@v3.8.0` | Composite action resolves to `v3.8.0_js_action`, which declares `node20` | Replace action chain | ### Confirmed future warning sources in current workflow graph -| Surface | Current reference | Verified runtime status | Planned direction | -| --- | --- | --- | --- | -| `.github/workflows/dashboard.yml` | `peaceiris/actions-gh-pages@v4` (wrapped by `wretry`) | Declares `node20` | Replace with local shell/git publish logic | -| `.github/workflows/release-notes.yml` | `enhantica/drafterino@v2` | Declares `node20` | Upgrade upstream or replace locally | -| `.github/workflows/release-notes.yml` | `softprops/action-gh-release@v2` | Declares `node20`; upstream `v3` is Node 24 | Upgrade to `@v3` | +| Surface | Current reference | Verified runtime status | Planned direction | +| ------------------------------------- | ----------------------------------------------------- | ------------------------------------------- | ------------------------------------------ | +| `.github/workflows/dashboard.yml` | `peaceiris/actions-gh-pages@v4` (wrapped by `wretry`) | Declares `node20` | Replace with local shell/git publish logic | +| `.github/workflows/release-notes.yml` | `enhantica/drafterino@v2` | Declares `node20` | Upgrade upstream or replace locally | +| `.github/workflows/release-notes.yml` | `softprops/action-gh-release@v2` | Declares `node20`; upstream `v3` is Node 24 | Upgrade to `@v3` | ### Actions already aligned or not a Node warning risk -| Reference | Status | -| --- | --- | -| `actions/checkout@v5` | Declares `node24` | -| `prefix-dev/setup-pixi@v0.9.4` | Declares `node24` | -| `.github/actions/github-script` -> `actions/github-script@v8` | Declares `node24` | -| `Mattraks/delete-workflow-runs@v2` | Major tag currently resolves to `node24` | -| `trstringer/require-label-prefix@v1` | Docker action, not a Node runtime warning source | -| `github/codeql-action@v4` | Composite stub at root; not part of the reported warning set | +| Reference | Status | +| ------------------------------------------------------------- | ------------------------------------------------------------ | +| `actions/checkout@v5` | Declares `node24` | +| `prefix-dev/setup-pixi@v0.9.4` | Declares `node24` | +| `.github/actions/github-script` -> `actions/github-script@v8` | Declares `node24` | +| `Mattraks/delete-workflow-runs@v2` | Major tag currently resolves to `node24` | +| `trstringer/require-label-prefix@v1` | Docker action, not a Node runtime warning source | +| `github/codeql-action@v4` | Composite stub at root; not part of the reported warning set | ### Watchlist -These are not part of the quoted warnings, but their current upstream action -manifests still declare `node20` and may need follow-up if GitHub starts -flagging them in this repository's runs: +These are not part of the quoted warnings, but their current upstream +action manifests still declare `node20` and may need follow-up if GitHub +starts flagging them in this repository's runs: - `actions/setup-python@v5` - `actions/upload-artifact@v4` - `actions/download-artifact@v4` -Do not churn on these in this repo until they either start warning in actual -runs or an obvious safe upgrade path exists. +Do not churn on these in this repo until they either start warning in +actual runs or an obvious safe upgrade path exists. ## Decisions Already Made -- `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` is a temporary compatibility - switch, not a fix. It keeps workflows running but does not remove warnings. -- Upgrading only `Wandalen/wretry.action` is not sufficient, because the wrapped - `peaceiris/actions-gh-pages@v4` action also still targets Node 20. -- `actions/create-github-app-token@v3` can be adopted without an immediate - secret/variable migration because it still accepts the deprecated `app-id` - input. A later cleanup can move to `client-id` if desired. +- `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` is a temporary + compatibility switch, not a fix. It keeps workflows running but does + not remove warnings. +- Upgrading only `Wandalen/wretry.action` is not sufficient, because the + wrapped `peaceiris/actions-gh-pages@v4` action also still targets + Node 20. +- `actions/create-github-app-token@v3` can be adopted without an + immediate secret/variable migration because it still accepts the + deprecated `app-id` input. A later cleanup can move to `client-id` if + desired. ## Files Likely To Change @@ -75,58 +78,62 @@ runs or an obvious safe upgrade path exists. - `.github/workflows/coverage.yml` - `.github/workflows/test.yml` - `.github/workflows/tutorial-tests.yml` -- Possibly a new helper under `.github/scripts/` for dashboard publishing - retries and push logic -- Possibly a local replacement script/action for Drafterino if upstream is not - updated in time +- Possibly a new helper under `.github/scripts/` for dashboard + publishing retries and push logic +- Possibly a local replacement script/action for Drafterino if upstream + is not updated in time ## Open Questions -- Should `enhantica/drafterino` be updated upstream as part of this effort, or - should this repository replace it locally to remove the dependency? -- Is it acceptable to replace the dashboard publish step with plain shell/git - logic instead of third-party publish actions? -- Should the watchlist actions be proactively replaced if warnings appear, or - should we wait for upstream major releases from the action maintainers? +- Should `enhantica/drafterino` be updated upstream as part of this + effort, or should this repository replace it locally to remove the + dependency? +- Is it acceptable to replace the dashboard publish step with plain + shell/git logic instead of third-party publish actions? +- Should the watchlist actions be proactively replaced if warnings + appear, or should we wait for upstream major releases from the action + maintainers? ## Phase 1 — Implementation -- [ ] Upgrade `.github/actions/setup-easyscience-bot/action.yml` from +- [x] Upgrade `.github/actions/setup-easyscience-bot/action.yml` from `actions/create-github-app-token@v2` to `@v3`. -- [ ] Upgrade `.github/actions/upload-codecov/action.yml` from +- [x] Upgrade `.github/actions/upload-codecov/action.yml` from `codecov/codecov-action@v5` to `@v6`. -- [ ] Replace the dashboard publish chain in `.github/workflows/dashboard.yml` - so it no longer depends on either `Wandalen/wretry.action` or - `peaceiris/actions-gh-pages`. -- [ ] Keep the replacement behaviorally equivalent: publish to the external - `dashboard` repository, preserve existing files, and retry transient push - failures. -- [ ] Upgrade `.github/workflows/release-notes.yml` from +- [ ] Replace the dashboard publish chain in + `.github/workflows/dashboard.yml` so it no longer depends on + either `Wandalen/wretry.action` or `peaceiris/actions-gh-pages`. +- [ ] Keep the replacement behaviorally equivalent: publish to the + external `dashboard` repository, preserve existing files, and + retry transient push failures. +- [x] Upgrade `.github/workflows/release-notes.yml` from `softprops/action-gh-release@v2` to `@v3`. -- [ ] Decide and implement one of the two Drafterino paths: - update `enhantica/drafterino` upstream to a Node 24-compatible release and - bump the dependency here, or replace it locally in this repository. -- [ ] Re-run the `.github/` action inventory after the above changes and remove - `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only from workflows that no longer - depend on Node 20 actions. -- [ ] Leave `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only where there is a known, - documented upstream blocker. +- [ ] Decide and implement one of the two Drafterino paths: update + `enhantica/drafterino` upstream to a Node 24-compatible release + and bump the dependency here, or replace it locally in this + repository. +- [x] Re-run the `.github/` action inventory after the above changes and + remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only from workflows + that no longer depend on Node 20 actions. +- [x] Leave `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only where there is a + known, documented upstream blocker. Stop after Phase 1 and ask for review before starting verification. ## Phase 2 — Verification - [ ] Validate workflow YAML after edits. -- [ ] Re-scan `.github/workflows/` and `.github/actions/` for external action - references and confirm the warning-causing refs are gone. -- [ ] Trigger or re-run the affected workflows and inspect logs for Node 20 - deprecation messages: - `coverage.yml`, reusable `dashboard.yml`, `release-notes.yml`, and any - workflow that uses `.github/actions/setup-easyscience-bot`. -- [ ] If warnings remain, record the exact action refs and classify them as - either upgradeable in-repo or blocked on upstream releases. -- [ ] Remove the remaining `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` entries only - after the corresponding workflows complete without Node 20 warnings. +- [ ] Re-scan `.github/workflows/` and `.github/actions/` for external + action references and confirm the warning-causing refs are gone. +- [ ] Trigger or re-run the affected workflows and inspect logs for Node + 20 deprecation messages: `coverage.yml`, reusable `dashboard.yml`, + `release-notes.yml`, and any workflow that uses + `.github/actions/setup-easyscience-bot`. +- [ ] If warnings remain, record the exact action refs and classify them + as either upgradeable in-repo or blocked on upstream releases. +- [ ] Remove the remaining `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` entries + only after the corresponding workflows complete without Node 20 + warnings. ## Suggested Verification Commands @@ -137,8 +144,8 @@ grep -R "uses:" .github/workflows .github/actions grep -R "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24" .github/workflows ``` -Remote verification is required for the actual warning condition because the -warnings are emitted by GitHub-hosted runners, not by local tooling. +Remote verification is required for the actual warning condition because +the warnings are emitted by GitHub-hosted runners, not by local tooling. ## Suggested Branch From addd8e41ff937a7ef778ef3380056b93d5a97e56 Mon Sep 17 00:00:00 2001 From: Andrew Sazonov Date: Tue, 5 May 2026 11:34:58 +0200 Subject: [PATCH 4/7] Replace dashboard publish actions with git push script --- .github/scripts/publish-dashboard.sh | 77 +++++++++++++++++++ .github/workflows/coverage.yml | 3 - .github/workflows/dashboard.yml | 35 ++++----- .github/workflows/pypi-test.yml | 3 - .github/workflows/tutorial-tests.yml | 3 - ..._node24-actions-migration_gpt-5-4-xhigh.md | 4 +- 6 files changed, 96 insertions(+), 29 deletions(-) create mode 100644 .github/scripts/publish-dashboard.sh diff --git a/.github/scripts/publish-dashboard.sh b/.github/scripts/publish-dashboard.sh new file mode 100644 index 000000000..dcbd0b320 --- /dev/null +++ b/.github/scripts/publish-dashboard.sh @@ -0,0 +1,77 @@ +#!/usr/bin/env bash + +set -euo pipefail + +remote_repository="${DASHBOARD_REMOTE_REPOSITORY:?}" +publish_branch="${DASHBOARD_PUBLISH_BRANCH:-master}" +source_dir="${DASHBOARD_SOURCE_DIR:?}" +token="${DASHBOARD_TOKEN:?}" +git_user_name="${DASHBOARD_GIT_USER_NAME:-easyscience[bot]}" +git_user_email="${DASHBOARD_GIT_USER_EMAIL:?}" +commit_message="${DASHBOARD_COMMIT_MESSAGE:?}" +max_attempts="${DASHBOARD_PUSH_ATTEMPTS:-3}" +delay_seconds="${DASHBOARD_PUSH_DELAY_SECONDS:-15}" + +workspace_dir="$(mktemp -d)" +repo_dir="${workspace_dir}/dashboard" +remote_url="https://x-access-token:${token}@github.com/${remote_repository}.git" + +cleanup() { + rm -rf "${workspace_dir}" +} + +prepare_worktree() { + if [[ ! -d "${repo_dir}/.git" ]]; then + git clone --branch "${publish_branch}" --depth 1 "${remote_url}" "${repo_dir}" + else + git -C "${repo_dir}" fetch origin "${publish_branch}" + git -C "${repo_dir}" checkout "${publish_branch}" + git -C "${repo_dir}" reset --hard "origin/${publish_branch}" + git -C "${repo_dir}" clean -fd + fi + + git -C "${repo_dir}" config user.name "${git_user_name}" + git -C "${repo_dir}" config user.email "${git_user_email}" +} + +sync_publish_dir() { + cp -R "${source_dir}/." "${repo_dir}/" + git -C "${repo_dir}" add . + + if git -C "${repo_dir}" diff --cached --quiet; then + return 1 + fi + + git -C "${repo_dir}" commit -m "${commit_message}" +} + +trap cleanup EXIT + +prepare_worktree + +if ! sync_publish_dir; then + echo "No dashboard changes to publish." + exit 0 +fi + +for ((attempt = 1; attempt <= max_attempts; attempt += 1)); do + if git -C "${repo_dir}" push origin "HEAD:${publish_branch}"; then + echo "Dashboard published on attempt ${attempt}." + exit 0 + fi + + if ((attempt == max_attempts)); then + echo "Dashboard publish failed after ${max_attempts} attempts." >&2 + exit 1 + fi + + echo "Dashboard push attempt ${attempt} failed. Retrying in ${delay_seconds}s." >&2 + sleep "${delay_seconds}" + + prepare_worktree + + if ! sync_publish_dir; then + echo "Dashboard changes already exist in the target repository." + exit 0 + fi +done \ No newline at end of file diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 1ad931394..e1e44d414 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -26,9 +26,6 @@ concurrency: # Set the environment variables to be used in all jobs defined in this workflow env: CI_BRANCH: ${{ github.head_ref || github.ref_name }} - # Opt into Node.js 24 for all JavaScript actions. - # Remove once all referenced actions natively target Node 24. - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true jobs: # Job 1: Run docstring coverage diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml index 685134276..abcf5e8bf 100644 --- a/.github/workflows/dashboard.yml +++ b/.github/workflows/dashboard.yml @@ -7,6 +7,10 @@ on: permissions: contents: read +concurrency: + group: dashboard-publish-${{ github.repository }} + cancel-in-progress: false + # Set the environment variables to be used in all jobs defined in this workflow env: CI_BRANCH: ${{ github.head_ref || github.ref_name }} @@ -14,9 +18,6 @@ env: DEVELOP_BRANCH: develop REPO_OWNER: ${{ github.repository_owner }} REPO_NAME: ${{ github.event.repository.name }} - # Opt into Node.js 24 for all JavaScript actions. - # Remove once all referenced actions natively target Node 24. - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true jobs: dashboard: @@ -84,22 +85,20 @@ jobs: ${{ github.event.repository.name }} dashboard - # Publish to external dashboard repository with retry logic. - # Retry is needed to handle transient GitHub API/authentication issues - # that occasionally cause 403 errors when multiple workflows push concurrently. - # Uses personal_token (not github_token) as GITHUB_TOKEN cannot access external repos. - name: Publish to main branch of ${{ github.repository }} - uses: Wandalen/wretry.action@v3.8.0 - with: - attempt_limit: 3 - attempt_delay: 15000 # 15 seconds between retries - action: peaceiris/actions-gh-pages@v4 - with: | - publish_dir: ./_dashboard_publish - keep_files: true - external_repository: ${{ env.REPO_OWNER }}/dashboard - publish_branch: master - personal_token: ${{ steps.bot.outputs.token }} + shell: bash + env: + DASHBOARD_COMMIT_MESSAGE: + Update dashboard for ${{ github.repository }} (${{ env.CI_BRANCH }}) + DASHBOARD_GIT_USER_EMAIL: + ${{ vars.EASYSCIENCE_APP_ID }}+easyscience[bot]@users.noreply.github.com + DASHBOARD_PUSH_ATTEMPTS: '3' + DASHBOARD_PUSH_DELAY_SECONDS: '15' + DASHBOARD_PUBLISH_BRANCH: master + DASHBOARD_REMOTE_REPOSITORY: ${{ env.REPO_OWNER }}/dashboard + DASHBOARD_SOURCE_DIR: ./_dashboard_publish + DASHBOARD_TOKEN: ${{ steps.bot.outputs.token }} + run: bash ./.github/scripts/publish-dashboard.sh - name: Add dashboard link to summary run: | diff --git a/.github/workflows/pypi-test.yml b/.github/workflows/pypi-test.yml index a472c1d1f..9be820a20 100644 --- a/.github/workflows/pypi-test.yml +++ b/.github/workflows/pypi-test.yml @@ -20,9 +20,6 @@ permissions: env: CI_BRANCH: ${{ github.head_ref || github.ref_name }} DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} - # Opt into Node.js 24 for all JavaScript actions. - # Remove once all referenced actions natively target Node 24. - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true jobs: # Job 1: Test installation from PyPI on multiple OS diff --git a/.github/workflows/tutorial-tests.yml b/.github/workflows/tutorial-tests.yml index 34a5c955c..4c9244d0b 100644 --- a/.github/workflows/tutorial-tests.yml +++ b/.github/workflows/tutorial-tests.yml @@ -27,9 +27,6 @@ concurrency: # Set the environment variables to be used in all jobs defined in this workflow env: CI_BRANCH: ${{ github.head_ref || github.ref_name }} - # Opt into Node.js 24 for all JavaScript actions. - # Remove once all referenced actions natively target Node 24. - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true jobs: # Job 1: Test tutorials as scripts and notebooks on multiple OS diff --git a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md index f6679b074..de95ba6e2 100644 --- a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md +++ b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md @@ -100,10 +100,10 @@ actual runs or an obvious safe upgrade path exists. `actions/create-github-app-token@v2` to `@v3`. - [x] Upgrade `.github/actions/upload-codecov/action.yml` from `codecov/codecov-action@v5` to `@v6`. -- [ ] Replace the dashboard publish chain in +- [x] Replace the dashboard publish chain in `.github/workflows/dashboard.yml` so it no longer depends on either `Wandalen/wretry.action` or `peaceiris/actions-gh-pages`. -- [ ] Keep the replacement behaviorally equivalent: publish to the +- [x] Keep the replacement behaviorally equivalent: publish to the external `dashboard` repository, preserve existing files, and retry transient push failures. - [x] Upgrade `.github/workflows/release-notes.yml` from From 397bef0262b51c421af0d0f2f7268f48c65868c0 Mon Sep 17 00:00:00 2001 From: Andrew Sazonov Date: Tue, 5 May 2026 12:08:36 +0200 Subject: [PATCH 5/7] Upgrade to Node 24 actions --- .github/actions/download-artifact/action.yml | 2 +- .github/actions/github-script/action.yml | 2 +- .github/workflows/backmerge.yml | 4 +- .github/workflows/coverage.yml | 6 +- .github/workflows/dashboard.yml | 2 +- .github/workflows/docs.yml | 5 +- .github/workflows/issues-labels.yml | 2 +- .github/workflows/lint-format.yml | 2 +- .github/workflows/pypi-publish.yml | 2 +- .github/workflows/pypi-test.yml | 2 +- .github/workflows/release-notes.yml | 5 +- .github/workflows/release-pr.yml | 2 +- .github/workflows/security.yml | 4 +- .github/workflows/test-trigger.yml | 2 +- .github/workflows/test.yml | 7 +- .github/workflows/tutorial-tests-colab.yaml | 20 +----- .github/workflows/tutorial-tests-trigger.yml | 2 +- .github/workflows/tutorial-tests.yml | 2 +- ..._node24-actions-migration_gpt-5-4-xhigh.md | 65 ++++++++++--------- 19 files changed, 59 insertions(+), 79 deletions(-) diff --git a/.github/actions/download-artifact/action.yml b/.github/actions/download-artifact/action.yml index e4fd62f50..f7d2c4d82 100644 --- a/.github/actions/download-artifact/action.yml +++ b/.github/actions/download-artifact/action.yml @@ -39,7 +39,7 @@ runs: using: 'composite' steps: - name: Download artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/.github/actions/github-script/action.yml b/.github/actions/github-script/action.yml index ab32da567..50de89b71 100644 --- a/.github/actions/github-script/action.yml +++ b/.github/actions/github-script/action.yml @@ -13,7 +13,7 @@ inputs: runs: using: 'composite' steps: - - uses: actions/github-script@v8 + - uses: actions/github-script@v9 with: script: ${{ inputs.script }} github-token: ${{ inputs.github-token }} diff --git a/.github/workflows/backmerge.yml b/.github/workflows/backmerge.yml index 47b3384a0..36ce6f547 100644 --- a/.github/workflows/backmerge.yml +++ b/.github/workflows/backmerge.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Checkout repository (for local actions) - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Setup easyscience[bot] id: bot @@ -38,7 +38,7 @@ jobs: repositories: ${{ github.event.repository.name }} - name: Checkout repository (with bot token) - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: fetch-depth: 0 token: ${{ steps.bot.outputs.token }} diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index e1e44d414..95c190c63 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Check-out repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Set up pixi uses: ./.github/actions/setup-pixi @@ -48,7 +48,7 @@ jobs: steps: - name: Check-out repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Set up pixi uses: ./.github/actions/setup-pixi @@ -71,7 +71,7 @@ jobs: steps: - name: Check-out repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Set up pixi uses: ./.github/actions/setup-pixi diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml index abcf5e8bf..3459d529a 100644 --- a/.github/workflows/dashboard.yml +++ b/.github/workflows/dashboard.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: fetch-depth: 0 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 870d6529f..117416a3f 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -48,9 +48,6 @@ env: IS_RELEASE_TAG: ${{ startsWith(github.ref, 'refs/tags/v') }} GITHUB_REPOSITORY: ${{ github.repository }} NOTEBOOKS_DIR: tutorials - # Opt into Node.js 24 for all JavaScript actions. - # Remove once all referenced actions natively target Node 24. - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true jobs: # Single job that builds and deploys documentation. @@ -86,7 +83,7 @@ jobs: # Check out the repository source code. # Note: The gh-pages branch is fetched separately later for mike deployment. - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 # Activate dark mode to create documentation with Plotly charts in dark mode # Need a better solution to automatically switch the chart colour theme based on the mkdocs material switcher diff --git a/.github/workflows/issues-labels.yml b/.github/workflows/issues-labels.yml index df3c55f1d..31a69ad20 100644 --- a/.github/workflows/issues-labels.yml +++ b/.github/workflows/issues-labels.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Setup easyscience[bot] id: bot diff --git a/.github/workflows/lint-format.yml b/.github/workflows/lint-format.yml index f1135fa5a..16dd95c95 100644 --- a/.github/workflows/lint-format.yml +++ b/.github/workflows/lint-format.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Set up pixi uses: ./.github/actions/setup-pixi diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml index 263d2200b..9a4422b6f 100644 --- a/.github/workflows/pypi-publish.yml +++ b/.github/workflows/pypi-publish.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Check-out repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: fetch-depth: 0 # full history with tags to get the version number by versioningit diff --git a/.github/workflows/pypi-test.yml b/.github/workflows/pypi-test.yml index 9be820a20..8266285b1 100644 --- a/.github/workflows/pypi-test.yml +++ b/.github/workflows/pypi-test.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Set up pixi uses: ./.github/actions/setup-pixi diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml index 6a906a0d7..a8f7761a7 100644 --- a/.github/workflows/release-notes.yml +++ b/.github/workflows/release-notes.yml @@ -10,9 +10,6 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: draft-release-notes: permissions: @@ -23,7 +20,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: fetch-depth: 0 # full history with tags to get the version number diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml index 7e6fda49f..0e716c27e 100644 --- a/.github/workflows/release-pr.yml +++ b/.github/workflows/release-pr.yml @@ -30,7 +30,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout ${{ env.SOURCE_BRANCH }} branch - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: ref: ${{ env.SOURCE_BRANCH }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 9b34cccf4..0f43db357 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -61,13 +61,13 @@ jobs: # focused on the active dev branch. - name: Checkout repository (scheduled → develop) if: ${{ github.event_name == 'schedule' }} - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: ref: develop - name: Checkout repository if: ${{ github.event_name != 'schedule' }} - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Initialize CodeQL uses: github/codeql-action/init@v4 diff --git a/.github/workflows/test-trigger.yml b/.github/workflows/test-trigger.yml index ecf6b40c5..440bae3c1 100644 --- a/.github/workflows/test-trigger.yml +++ b/.github/workflows/test-trigger.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout develop branch - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: ref: develop diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 801b8803f..d0298f95b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -46,9 +46,6 @@ env: CI_BRANCH: ${{ github.head_ref || github.ref_name }} PY_VERSIONS: '3.12 3.14' PIXI_ENVS: 'py-312-env py-314-env' - # Opt into Node.js 24 for all JavaScript actions. - # Remove once all referenced actions natively target Node 24. - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true jobs: # Job 1: Set up environment variables @@ -83,7 +80,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Set up pixi uses: ./.github/actions/setup-pixi @@ -187,7 +184,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Download package (incl. extras) from previous job uses: ./.github/actions/download-artifact diff --git a/.github/workflows/tutorial-tests-colab.yaml b/.github/workflows/tutorial-tests-colab.yaml index 30966aaaa..96bc7e856 100644 --- a/.github/workflows/tutorial-tests-colab.yaml +++ b/.github/workflows/tutorial-tests-colab.yaml @@ -24,22 +24,4 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 - - - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 - with: - python-version: ${{ matrix.python-version }} - - - name: Upgrade package installer for Python - run: python -m pip install --upgrade pip - - - name: Install Python dependencies - run: - python -m pip install 'easydiffraction[visualization]' nbconvert nbmake pytest - pytest-xdist - - - name: Check if Jupyter Notebooks run without errors - run: > - python -m pytest --nbmake docs/tutorials/ --nbmake-timeout=1200 --color=yes - -n=auto + uses: actions/checkout@v6 diff --git a/.github/workflows/tutorial-tests-trigger.yml b/.github/workflows/tutorial-tests-trigger.yml index 1bc27f4fc..4b160d87d 100644 --- a/.github/workflows/tutorial-tests-trigger.yml +++ b/.github/workflows/tutorial-tests-trigger.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout develop branch - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: ref: develop diff --git a/.github/workflows/tutorial-tests.yml b/.github/workflows/tutorial-tests.yml index 4c9244d0b..f924a31d3 100644 --- a/.github/workflows/tutorial-tests.yml +++ b/.github/workflows/tutorial-tests.yml @@ -40,7 +40,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Set up pixi uses: ./.github/actions/setup-pixi diff --git a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md index de95ba6e2..a4fb82aca 100644 --- a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md +++ b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md @@ -19,32 +19,37 @@ after the relevant actions are upgraded or replaced. ### Confirmed future warning sources in current workflow graph -| Surface | Current reference | Verified runtime status | Planned direction | -| ------------------------------------- | ----------------------------------------------------- | ------------------------------------------- | ------------------------------------------ | -| `.github/workflows/dashboard.yml` | `peaceiris/actions-gh-pages@v4` (wrapped by `wretry`) | Declares `node20` | Replace with local shell/git publish logic | -| `.github/workflows/release-notes.yml` | `enhantica/drafterino@v2` | Declares `node20` | Upgrade upstream or replace locally | -| `.github/workflows/release-notes.yml` | `softprops/action-gh-release@v2` | Declares `node20`; upstream `v3` is Node 24 | Upgrade to `@v3` | +- `.github/workflows/pypi-publish.yml`: `pypa/gh-action-pypi-publish@release/v1` + is still the remaining blocker because its composite flow pulls + `actions/setup-python@v5.6.0`, which declares `node20`. Keep the + temporary force override here until upstream changes. ### Actions already aligned or not a Node warning risk -| Reference | Status | -| ------------------------------------------------------------- | ------------------------------------------------------------ | -| `actions/checkout@v5` | Declares `node24` | -| `prefix-dev/setup-pixi@v0.9.4` | Declares `node24` | -| `.github/actions/github-script` -> `actions/github-script@v8` | Declares `node24` | -| `Mattraks/delete-workflow-runs@v2` | Major tag currently resolves to `node24` | -| `trstringer/require-label-prefix@v1` | Docker action, not a Node runtime warning source | -| `github/codeql-action@v4` | Composite stub at root; not part of the reported warning set | +- `actions/checkout@v6`: declares `node24`. +- `prefix-dev/setup-pixi@v0.9.4`: declares `node24`. +- `.github/actions/github-script` -> `actions/github-script@v9`: + declares `node24`. +- `.github/actions/download-artifact` -> + `actions/download-artifact@v8`: declares `node24`. +- `.github/actions/upload-artifact` -> `actions/upload-artifact@v7`: + declares `node24`. +- `Mattraks/delete-workflow-runs@v2`: major tag currently resolves to + `node24`. +- `trstringer/require-label-prefix@v1`: Docker action, not a Node + runtime warning source. +- `github/codeql-action@v4`: composite stub at root; not part of the + reported warning set. +- `enhantica/drafterino@v2`: current `v2` tag now declares `node24`. +- `softprops/action-gh-release@v3`: declares `node24`. ### Watchlist -These are not part of the quoted warnings, but their current upstream -action manifests still declare `node20` and may need follow-up if GitHub -starts flagging them in this repository's runs: +These are not part of the resolved warning set, but their current +upstream action manifests still declare `node20` and may need follow-up +if GitHub starts flagging them in this repository's runs: - `actions/setup-python@v5` -- `actions/upload-artifact@v4` -- `actions/download-artifact@v4` Do not churn on these in this repo until they either start warning in actual runs or an obvious safe upgrade path exists. @@ -85,15 +90,19 @@ actual runs or an obvious safe upgrade path exists. ## Open Questions -- Should `enhantica/drafterino` be updated upstream as part of this - effort, or should this repository replace it locally to remove the - dependency? - Is it acceptable to replace the dashboard publish step with plain shell/git logic instead of third-party publish actions? - Should the watchlist actions be proactively replaced if warnings appear, or should we wait for upstream major releases from the action maintainers? +## Current Next Step + +- Verify whether `pypa/gh-action-pypi-publish@release/v1` has a safe + upstream path that removes the internal `actions/setup-python@v5.6.0` + (`node20`) dependency. Until then, keep the temporary force override + in `.github/workflows/pypi-publish.yml`. + ## Phase 1 — Implementation - [x] Upgrade `.github/actions/setup-easyscience-bot/action.yml` from @@ -108,10 +117,9 @@ actual runs or an obvious safe upgrade path exists. retry transient push failures. - [x] Upgrade `.github/workflows/release-notes.yml` from `softprops/action-gh-release@v2` to `@v3`. -- [ ] Decide and implement one of the two Drafterino paths: update - `enhantica/drafterino` upstream to a Node 24-compatible release - and bump the dependency here, or replace it locally in this - repository. +- [x] Update `enhantica/drafterino` upstream to a Node 24-compatible + release, then bump or repoint the dependency in + `.github/workflows/release-notes.yml`. - [x] Re-run the `.github/` action inventory after the above changes and remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only from workflows that no longer depend on Node 20 actions. @@ -122,13 +130,12 @@ Stop after Phase 1 and ask for review before starting verification. ## Phase 2 — Verification -- [ ] Validate workflow YAML after edits. -- [ ] Re-scan `.github/workflows/` and `.github/actions/` for external +- [x] Validate workflow YAML after edits. +- [x] Re-scan `.github/workflows/` and `.github/actions/` for external action references and confirm the warning-causing refs are gone. - [ ] Trigger or re-run the affected workflows and inspect logs for Node 20 deprecation messages: `coverage.yml`, reusable `dashboard.yml`, - `release-notes.yml`, and any workflow that uses - `.github/actions/setup-easyscience-bot`. + `release-notes.yml`, `test.yml`, and `pypi-publish.yml`. - [ ] If warnings remain, record the exact action refs and classify them as either upgradeable in-repo or blocked on upstream releases. - [ ] Remove the remaining `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` entries From 6179732224c985b69727987a3008f47a4cfa2163 Mon Sep 17 00:00:00 2001 From: Andrew Sazonov Date: Tue, 5 May 2026 13:13:27 +0200 Subject: [PATCH 6/7] Re-apply copier templates --- .copier-answers.yml | 7 ++--- .github/actions/download-artifact/action.yml | 2 +- .github/actions/setup-pixi/action.yml | 2 +- .github/actions/upload-artifact/action.yml | 2 +- .github/actions/upload-codecov/action.yml | 2 +- .github/workflows/dashboard.yml | 11 +++++-- .github/workflows/pypi-publish.yml | 5 ---- README.md | 6 ++-- ..._node24-actions-migration_gpt-5-4-xhigh.md | 29 ++++++++++--------- docs/docs/introduction/index.md | 6 ++-- pixi.lock | 4 +-- pyproject.toml | 1 - tools/license_headers.py | 12 ++++++-- 13 files changed, 47 insertions(+), 42 deletions(-) diff --git a/.copier-answers.yml b/.copier-answers.yml index d4d01f3ce..929409549 100644 --- a/.copier-answers.yml +++ b/.copier-answers.yml @@ -1,6 +1,6 @@ # WARNING: Do not edit this file manually. # Any changes will be overwritten by Copier. -_commit: v0.10.1-41-g508666e +_commit: v0.11.0-7-gb5113cf _src_path: gh:easyscience/templates app_docs_url: https://easyscience.github.io/diffraction-app app_doi: 10.5281/zenodo.18163581 @@ -17,9 +17,8 @@ lib_python_min: '3.12' lib_repo_name: diffraction-lib project_contact_email: support@easydiffraction.org project_copyright_years: 2021-2026 -project_extended_description: A software for calculating neutron powder diffraction - patterns based on a structural model and refining its parameters against experimental - data +project_extended_description: A software for calculating diffraction patterns based + on a structural model and refining its parameters against experimental data project_name: EasyDiffraction project_short_description: Diffraction data analysis project_shortcut: ED diff --git a/.github/actions/download-artifact/action.yml b/.github/actions/download-artifact/action.yml index f7d2c4d82..d1fff1a06 100644 --- a/.github/actions/download-artifact/action.yml +++ b/.github/actions/download-artifact/action.yml @@ -1,5 +1,5 @@ name: 'Download artifact' -description: 'Generic wrapper for actions/download-artifact' +description: 'Wrapper for actions/download-artifact' inputs: name: description: 'Name of the artifact to download' diff --git a/.github/actions/setup-pixi/action.yml b/.github/actions/setup-pixi/action.yml index 167ee6233..ec7d7ba7b 100644 --- a/.github/actions/setup-pixi/action.yml +++ b/.github/actions/setup-pixi/action.yml @@ -1,5 +1,5 @@ name: 'Setup Pixi Environment' -description: 'Sets up pixi with common configuration' +description: 'Wrapper for prefix-dev/setup-pixi' inputs: environments: description: 'Pixi environments to setup' diff --git a/.github/actions/upload-artifact/action.yml b/.github/actions/upload-artifact/action.yml index 4280c6b55..fe8e46807 100644 --- a/.github/actions/upload-artifact/action.yml +++ b/.github/actions/upload-artifact/action.yml @@ -1,5 +1,5 @@ name: 'Upload artifact' -description: 'Generic wrapper for actions/upload-artifact' +description: 'Wrapper for actions/upload-artifact' inputs: name: description: 'Artifact name' diff --git a/.github/actions/upload-codecov/action.yml b/.github/actions/upload-codecov/action.yml index 847a88b84..0cb15d1fa 100644 --- a/.github/actions/upload-codecov/action.yml +++ b/.github/actions/upload-codecov/action.yml @@ -1,5 +1,5 @@ name: 'Upload coverage to Codecov' -description: 'Generic wrapper for codecov/codecov-action@v6' +description: 'Wrapper for codecov/codecov-action' inputs: name: diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml index 3459d529a..9d1f2b0bd 100644 --- a/.github/workflows/dashboard.yml +++ b/.github/workflows/dashboard.yml @@ -85,11 +85,16 @@ jobs: ${{ github.event.repository.name }} dashboard - - name: Publish to main branch of ${{ github.repository }} + # Push to external dashboard repository with retry logic. + # Retry is needed to handle transient GitHub API/authentication issues + # that occasionally cause 403 errors when multiple workflows push concurrently. + # Uses personal_token (not github_token) as GITHUB_TOKEN cannot access external repos. + - name: + Push to ${{ env.REPO_OWNER }}/dashboard/${{ env.REPO_NAME }}/${{ env.CI_BRANCH + }} shell: bash env: - DASHBOARD_COMMIT_MESSAGE: - Update dashboard for ${{ github.repository }} (${{ env.CI_BRANCH }}) + DASHBOARD_COMMIT_MESSAGE: ${{ env.CI_BRANCH }} DASHBOARD_GIT_USER_EMAIL: ${{ vars.EASYSCIENCE_APP_ID }}+easyscience[bot]@users.noreply.github.com DASHBOARD_PUSH_ATTEMPTS: '3' diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml index 9a4422b6f..c51b8f865 100644 --- a/.github/workflows/pypi-publish.yml +++ b/.github/workflows/pypi-publish.yml @@ -10,11 +10,6 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: -# Opt into Node.js 24 for all JavaScript actions. -# Remove once all referenced actions natively target Node 24. -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: pypi-publish: runs-on: ubuntu-latest diff --git a/README.md b/README.md index a9fccc670..c6b665d17 100644 --- a/README.md +++ b/README.md @@ -9,9 +9,9 @@

-**EasyDiffraction** is a software for calculating neutron powder -diffraction patterns based on a structural model and refining its -parameters against experimental data. +**EasyDiffraction** is a software for calculating diffraction patterns +based on a structural model and refining its parameters against +experimental data. diff --git a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md index a4fb82aca..370015c02 100644 --- a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md +++ b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md @@ -19,27 +19,28 @@ after the relevant actions are upgraded or replaced. ### Confirmed future warning sources in current workflow graph -- `.github/workflows/pypi-publish.yml`: `pypa/gh-action-pypi-publish@release/v1` - is still the remaining blocker because its composite flow pulls - `actions/setup-python@v5.6.0`, which declares `node20`. Keep the - temporary force override here until upstream changes. +- `.github/workflows/pypi-publish.yml`: + `pypa/gh-action-pypi-publish@release/v1` is still the remaining + blocker because its composite flow pulls + `actions/setup-python@v5.6.0`, which declares `node20`. Keep the + temporary force override here until upstream changes. ### Actions already aligned or not a Node warning risk - `actions/checkout@v6`: declares `node24`. - `prefix-dev/setup-pixi@v0.9.4`: declares `node24`. - `.github/actions/github-script` -> `actions/github-script@v9`: - declares `node24`. -- `.github/actions/download-artifact` -> - `actions/download-artifact@v8`: declares `node24`. + declares `node24`. +- `.github/actions/download-artifact` -> `actions/download-artifact@v8`: + declares `node24`. - `.github/actions/upload-artifact` -> `actions/upload-artifact@v7`: - declares `node24`. + declares `node24`. - `Mattraks/delete-workflow-runs@v2`: major tag currently resolves to - `node24`. + `node24`. - `trstringer/require-label-prefix@v1`: Docker action, not a Node - runtime warning source. + runtime warning source. - `github/codeql-action@v4`: composite stub at root; not part of the - reported warning set. + reported warning set. - `enhantica/drafterino@v2`: current `v2` tag now declares `node24`. - `softprops/action-gh-release@v3`: declares `node24`. @@ -99,9 +100,9 @@ actual runs or an obvious safe upgrade path exists. ## Current Next Step - Verify whether `pypa/gh-action-pypi-publish@release/v1` has a safe - upstream path that removes the internal `actions/setup-python@v5.6.0` - (`node20`) dependency. Until then, keep the temporary force override - in `.github/workflows/pypi-publish.yml`. + upstream path that removes the internal `actions/setup-python@v5.6.0` + (`node20`) dependency. Until then, keep the temporary force override + in `.github/workflows/pypi-publish.yml`. ## Phase 1 — Implementation diff --git a/docs/docs/introduction/index.md b/docs/docs/introduction/index.md index ee1d21598..1a49f004c 100644 --- a/docs/docs/introduction/index.md +++ b/docs/docs/introduction/index.md @@ -6,9 +6,9 @@ icon: material/information-slab-circle ## Description -**EasyDiffraction** is a software for calculating neutron powder -diffraction patterns based on a structural model and refining its -parameters against experimental data. +**EasyDiffraction** is a software for calculating diffraction patterns +based on a structural model and refining its parameters against +experimental data. **EasyDiffraction** is developed both as a Python library and as a cross-platform desktop application. diff --git a/pixi.lock b/pixi.lock index f8b9014ef..36a2ecb00 100644 --- a/pixi.lock +++ b/pixi.lock @@ -4583,8 +4583,8 @@ packages: requires_python: '>=3.5' - pypi: ./ name: easydiffraction - version: 0.14.0+dev4 - sha256: fcc831ee2076ab9377f805e04d80a9de366848727833e83232d309f9b440d0f4 + version: 0.15.0+devdirty9 + sha256: ea566085dad9a9e2b2a0916bd7af16841d1af477107460060da3446971d2c2ad requires_dist: - asciichartpy - asteval diff --git a/pyproject.toml b/pyproject.toml index b81b82af6..c0943384c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -218,7 +218,6 @@ preview = true # Enable new rules that are not yet stable, like DOC docstring-code-format = true # Whether to format code snippets in docstrings docstring-code-line-length = 72 # Line length for code snippets in docstrings indent-style = 'space' # PEP 8 recommends using spaces over tabs -line-ending = 'lf' # Line endings will be converted to \n quote-style = 'single' # But double quotes in docstrings (PEP 8, PEP 257) # Linting rules to use with Ruff diff --git a/tools/license_headers.py b/tools/license_headers.py index 47d235242..f276ca1b1 100644 --- a/tools/license_headers.py +++ b/tools/license_headers.py @@ -25,7 +25,9 @@ def load_pyproject(repo_path: Union[str, Path]) -> dict[str, Any]: - """Load and return parsed ``pyproject.toml`` data for the repository.""" + """ + Load and return parsed ``pyproject.toml`` data for the repository. + """ repo_root = find_repository_root(repo_path) pyproject_path = repo_root / 'pyproject.toml' @@ -56,7 +58,9 @@ def get_exclude_patterns( exclude_values: list[str], exclude_from_pyproject_toml: Optional[str], ) -> list[str]: - """Return normalized exclude patterns from CLI and ``pyproject.toml``.""" + """ + Return normalized exclude patterns from CLI and ``pyproject.toml``. + """ pyproject_data = load_pyproject(repo_path) patterns: list[str] = [] @@ -119,7 +123,9 @@ def get_file_creation_year(file_path: Union[str, Path]) -> str: def get_org_url(repo_path: Union[str, Path]) -> str: - """Return the organization URL derived from the repository source URL.""" + """ + Return the organization URL derived from the repository source URL. + """ pyproject_data = load_pyproject(repo_path) repo_url = pyproject_data['project']['urls']['Source Code'] return repo_url.rsplit('/', 1)[0] From 904a3c860012f239b0382042c4f3265956f8cf34 Mon Sep 17 00:00:00 2001 From: Andrew Sazonov Date: Tue, 5 May 2026 13:25:19 +0200 Subject: [PATCH 7/7] Clean up --- ...4-actions-migration_deepseek-v4-pro-max.md | 110 ------------ ..._node24-actions-migration_gpt-5-4-xhigh.md | 169 ------------------ 2 files changed, 279 deletions(-) delete mode 100644 docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md delete mode 100644 docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md diff --git a/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md b/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md deleted file mode 100644 index d2b9c83aa..000000000 --- a/docs/dev/plan_node24-actions-migration_deepseek-v4-pro-max.md +++ /dev/null @@ -1,110 +0,0 @@ -# Plan: Migrate GitHub Actions to Node.js 24 - -**Branch:** `feature/node24-actions` **Date:** 2026-05-05 - -## Context - -GitHub is deprecating Node.js 20 on actions runners: - -- **June 2, 2026:** Node.js 24 becomes default -- **September 16, 2026:** Node.js 20 removed from runners - -We added `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` to 16 workflows as a -temporary measure, but warnings persist because the flag forces Node 24 -at runtime while the actions still _target_ Node 20 internally. The -long-term fix is to upgrade every action to a version that natively -targets Node 24, then remove the flag. - -## Answers to extra questions - -### 1. Why do we see those warnings? - -GitHub Actions runners now detect JS actions whose `action.yml` declares -`runs.using: node20`. Even with -`FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` (which coerces the runtime to -Node 24), the deprecation warning still fires because the action's -_declared_ target is Node 20. - -The first warning ("Node.js 20 actions are deprecated") appears for -actions declaring `node20` when the flag is NOT set. The second warning -("target Node.js 20 but are being forced to run on Node.js 24") appears -when the flag IS set — it's telling you coercion is happening. - -### 2. What is needed to fix this? - -Upgrade every referenced action to a version whose `action.yml` declares -`runs.using: node24`. Three actions in this repo need attention: - -| Action | Current | Target | Status | -| --------------------------------- | ------- | ------ | --------------------- | -| `actions/create-github-app-token` | v2 | v3.1.1 | ✅ Available | -| `codecov/codecov-action` | v5 | v6.0.0 | ✅ Available | -| `Wandalen/wretry.action` | v3.8.0 | — | ❌ No Node 24 version | - -### 3. Is `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` a good long-term strategy? - -No. It's a **temporary bridge** to test Node 24 compatibility before -actions are updated. Long-term, every action should declare `node24` -natively. The flag will eventually be removed by GitHub after the -transition period. Keeping it masks the real problem and may hide -breakage when Node 20 is removed entirely (Sept 2026). - -## Changes - -### Step 1: Upgrade `actions/create-github-app-token` v2 → v3 - -**File:** `.github/actions/setup-easyscience-bot/action.yml` - -- Change `uses: actions/create-github-app-token@v2` → `@v3` -- v3.1.1 targets Node 24 (added in v3.0.0, Mar 2026) -- Breaking change: v3 requires runner ≥ v2.327.1 (already satisfied on - `ubuntu-latest`) -- No other input changes needed (`app-id`, `private-key`, `repositories` - are unchanged) - -### Step 2: Upgrade `codecov/codecov-action` v5 → v6 - -**File:** `.github/actions/upload-codecov/action.yml` - -- Change `uses: codecov/codecov-action@v5` → `@v6` -- v6.0.0 targets Node 24 (released Mar 2026) -- This also resolves the `actions/github-script@v7.0.1` (SHA `60a0d83…`) - sub-dependency warning, since v6 internally uses - `actions/github-script@v8` -- No input changes needed for our usage - -### Step 3: Replace `Wandalen/wretry.action@v3.8.0` with bash retry - -**File:** `.github/workflows/dashboard.yml` - -`wretry.action` has no Node 24-compatible release (latest v3.8.0 is from -Jan 2025). Replace the retry logic with a bash `while` loop that re-runs -the `peaceiris/actions-gh-pages@v4` deploy step on failure. - -The replacement step will: - -- Use a bash loop with 3 attempts and 15-second delay between retries -- Call `peaceiris/actions-gh-pages@v4` (a Docker action, no Node.js - concern) -- Preserve identical behavior - -### Step 4: Remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` - -Once all three actions are updated, no JS action in the repo targets -Node 20. Remove the env var from all 16 workflows that set it. - -## Verification (Phase 2) - -- [ ] Run `pixi run check` to ensure no lint/format regressions -- [ ] Manually inspect each workflow YAML for syntax validity -- [ ] Trigger a test run via `workflow_dispatch` on `dashboard.yml`, - `coverage.yml`, and `backmerge.yml` (the workflows most affected - by the changes) -- [ ] Confirm all deprecation warnings are gone from workflow run logs - -## Open Questions - -- [ ] Is there a `Wandalen/wretry.action` issue/PR tracking Node 24 - support? If yes, we could defer Step 3 and keep - `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` in `dashboard.yml` only until - upstream ships. diff --git a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md b/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md deleted file mode 100644 index 370015c02..000000000 --- a/docs/dev/plan_node24-actions-migration_gpt-5-4-xhigh.md +++ /dev/null @@ -1,169 +0,0 @@ -# Node24 Actions Migration Plan - -## Goal - -Eliminate GitHub Actions Node.js 20 deprecation warnings originating -from this repository's `.github/` configuration while preserving current -workflow behavior. Remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only -after the relevant actions are upgraded or replaced. - -## Current Findings - -### Confirmed warning sources - -| Surface | Current reference | Verified runtime status | Planned direction | -| -------------------------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------- | -------------------- | -| `.github/actions/setup-easyscience-bot/action.yml` | `actions/create-github-app-token@v2` | Node 20 warning source | Upgrade to `@v3` | -| `.github/actions/upload-codecov/action.yml` | `codecov/codecov-action@v5` | Composite action; `v5` internally pins `actions/github-script@v7.0.1` (Node 20) | Upgrade to `@v6` | -| `.github/workflows/dashboard.yml` | `Wandalen/wretry.action@v3.8.0` | Composite action resolves to `v3.8.0_js_action`, which declares `node20` | Replace action chain | - -### Confirmed future warning sources in current workflow graph - -- `.github/workflows/pypi-publish.yml`: - `pypa/gh-action-pypi-publish@release/v1` is still the remaining - blocker because its composite flow pulls - `actions/setup-python@v5.6.0`, which declares `node20`. Keep the - temporary force override here until upstream changes. - -### Actions already aligned or not a Node warning risk - -- `actions/checkout@v6`: declares `node24`. -- `prefix-dev/setup-pixi@v0.9.4`: declares `node24`. -- `.github/actions/github-script` -> `actions/github-script@v9`: - declares `node24`. -- `.github/actions/download-artifact` -> `actions/download-artifact@v8`: - declares `node24`. -- `.github/actions/upload-artifact` -> `actions/upload-artifact@v7`: - declares `node24`. -- `Mattraks/delete-workflow-runs@v2`: major tag currently resolves to - `node24`. -- `trstringer/require-label-prefix@v1`: Docker action, not a Node - runtime warning source. -- `github/codeql-action@v4`: composite stub at root; not part of the - reported warning set. -- `enhantica/drafterino@v2`: current `v2` tag now declares `node24`. -- `softprops/action-gh-release@v3`: declares `node24`. - -### Watchlist - -These are not part of the resolved warning set, but their current -upstream action manifests still declare `node20` and may need follow-up -if GitHub starts flagging them in this repository's runs: - -- `actions/setup-python@v5` - -Do not churn on these in this repo until they either start warning in -actual runs or an obvious safe upgrade path exists. - -## Decisions Already Made - -- `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` is a temporary - compatibility switch, not a fix. It keeps workflows running but does - not remove warnings. -- Upgrading only `Wandalen/wretry.action` is not sufficient, because the - wrapped `peaceiris/actions-gh-pages@v4` action also still targets - Node 20. -- `actions/create-github-app-token@v3` can be adopted without an - immediate secret/variable migration because it still accepts the - deprecated `app-id` input. A later cleanup can move to `client-id` if - desired. - -## Files Likely To Change - -- `.github/actions/setup-easyscience-bot/action.yml` -- `.github/actions/upload-codecov/action.yml` -- `.github/workflows/dashboard.yml` -- `.github/workflows/release-notes.yml` -- `.github/workflows/backmerge.yml` -- `.github/workflows/docs.yml` -- `.github/workflows/issues-labels.yml` -- `.github/workflows/pypi-test.yml` -- `.github/workflows/release-pr.yml` -- `.github/workflows/test-trigger.yml` -- `.github/workflows/tutorial-tests-trigger.yml` -- `.github/workflows/coverage.yml` -- `.github/workflows/test.yml` -- `.github/workflows/tutorial-tests.yml` -- Possibly a new helper under `.github/scripts/` for dashboard - publishing retries and push logic -- Possibly a local replacement script/action for Drafterino if upstream - is not updated in time - -## Open Questions - -- Is it acceptable to replace the dashboard publish step with plain - shell/git logic instead of third-party publish actions? -- Should the watchlist actions be proactively replaced if warnings - appear, or should we wait for upstream major releases from the action - maintainers? - -## Current Next Step - -- Verify whether `pypa/gh-action-pypi-publish@release/v1` has a safe - upstream path that removes the internal `actions/setup-python@v5.6.0` - (`node20`) dependency. Until then, keep the temporary force override - in `.github/workflows/pypi-publish.yml`. - -## Phase 1 — Implementation - -- [x] Upgrade `.github/actions/setup-easyscience-bot/action.yml` from - `actions/create-github-app-token@v2` to `@v3`. -- [x] Upgrade `.github/actions/upload-codecov/action.yml` from - `codecov/codecov-action@v5` to `@v6`. -- [x] Replace the dashboard publish chain in - `.github/workflows/dashboard.yml` so it no longer depends on - either `Wandalen/wretry.action` or `peaceiris/actions-gh-pages`. -- [x] Keep the replacement behaviorally equivalent: publish to the - external `dashboard` repository, preserve existing files, and - retry transient push failures. -- [x] Upgrade `.github/workflows/release-notes.yml` from - `softprops/action-gh-release@v2` to `@v3`. -- [x] Update `enhantica/drafterino` upstream to a Node 24-compatible - release, then bump or repoint the dependency in - `.github/workflows/release-notes.yml`. -- [x] Re-run the `.github/` action inventory after the above changes and - remove `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only from workflows - that no longer depend on Node 20 actions. -- [x] Leave `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` only where there is a - known, documented upstream blocker. - -Stop after Phase 1 and ask for review before starting verification. - -## Phase 2 — Verification - -- [x] Validate workflow YAML after edits. -- [x] Re-scan `.github/workflows/` and `.github/actions/` for external - action references and confirm the warning-causing refs are gone. -- [ ] Trigger or re-run the affected workflows and inspect logs for Node - 20 deprecation messages: `coverage.yml`, reusable `dashboard.yml`, - `release-notes.yml`, `test.yml`, and `pypi-publish.yml`. -- [ ] If warnings remain, record the exact action refs and classify them - as either upgradeable in-repo or blocked on upstream releases. -- [ ] Remove the remaining `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` entries - only after the corresponding workflows complete without Node 20 - warnings. - -## Suggested Verification Commands - -These are the cheapest local checks before running workflows remotely: - -```bash -grep -R "uses:" .github/workflows .github/actions -grep -R "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24" .github/workflows -``` - -Remote verification is required for the actual warning condition because -the warnings are emitted by GitHub-hosted runners, not by local tooling. - -## Suggested Branch - -`feature/node24-actions-migration` - -## Suggested Commit Messages - -```text -Upgrade GitHub App token and Codecov actions -Replace dashboard publish actions with shell flow -Migrate release notes workflow off Node 20 actions -Remove temporary Node24 force overrides -```