Skip to content

chore: upgrade actions to Node 24 runtime (SHA-pinned) - #25

Open
John C. Bland II (johncblandii) wants to merge 2 commits into
mainfrom
chore/node24-runtime-upgrade
Open

chore: upgrade actions to Node 24 runtime (SHA-pinned)#25
John C. Bland II (johncblandii) wants to merge 2 commits into
mainfrom
chore/node24-runtime-upgrade

Conversation

@johncblandii

@johncblandii John C. Bland II (johncblandii) commented Aug 13, 2026

Copy link
Copy Markdown

what

  • Bump the composite action's references, SHA-pinned with precise version comments:
    • actions/checkout@v4 → @3d3c42e5... # v7.0.1 (node24 runtime)
    • mszostok/codeowners-validator@v0.7.2 → @7f3f5e28... # v0.7.4 (×2; docker-based)

why

references

@johncblandii
chore: upgrade actions to Node 24 era, SHA-pinned
60b5fff 
Combines pending Renovate bumps (checkout v7, codeowners-validator
v0.7.4) with SHA pins and precise version comments.
@johncblandii John C. Bland II (johncblandii) added the patch A minor, backward compatible change label Aug 13, 2026
Copilot AI lite review requested due to automatic review settings August 13, 2026 16:07
@johncblandii John C. Bland II (johncblandii) added the patch A minor, backward compatible change label Aug 13, 2026
Copilot AI reviewed Aug 13, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates this repository’s composite GitHub Action to use SHA-pinned upstream actions that run on the Node 24 runtime, reducing Node 20 deprecation warnings for consumers and aligning with supply-chain pinning practices.

Changes:

  • Pin actions/checkout to the commit for v7.0.1 (Node 24 runtime).
  • Pin mszostok/codeowners-validator to the commit for v0.7.4 in both usage paths (internal PRs vs forks).

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@johncblandii

John C. Bland II (johncblandii) commented Aug 13, 2026

Copy link
Copy Markdown
Author

The failing validate-codeowners check is pre-existing and unrelated to the pin changes — it runs the released cloudposse/github-action-validate-codeowners@0.2.1 via this repo's reusable workflow with secrets.CODEOWNERS_VALIDATOR_TOKEN_PUBLIC, which can no longer query cloudposse org teams (same auth failure red across the org since June; e.g. the Renovate checkout-v7 branch fails identically while checkout-v6 passed back in Nov 2025).

Fixed in 7bc197e with the org-standard pattern used across this effort: validate-codeowners.yml now calls shared-codeowners.yml@main with secrets: inherit and permissions: contents: read, on pull_request instead of pull_request_target. As with the other repos, the old check may still show red on this PR (pull_request_target runs the base branch's workflow definition until merge) — the new ci-codeowners checks from this branch are the ones that reflect the fix. The consumer-facing validate-codeowners-reusable.yml is left untouched.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@Gowiem Matt Gowie (Gowiem) Awaiting requested review from Gowiem Gowiem is a code owner automatically assigned from cloudposse/contributors
@nitrocode RB (nitrocode) Awaiting requested review from nitrocode nitrocode is a code owner automatically assigned from cloudposse/contributors

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

patch A minor, backward compatible change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@johncblandii