Skip to content

Update GitHub Actions to Node.js 24 releases; remove dead custom-runner workflow - #1946

Open
AustinBenoit wants to merge 3 commits into
mainfrom
update-actions-node24
Open

Update GitHub Actions to Node.js 24 releases; remove dead custom-runner workflow#1946
AustinBenoit wants to merge 3 commits into
mainfrom
update-actions-node24

Conversation

@AustinBenoit

@AustinBenoit AustinBenoit commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Why

GitHub is forcing actions that declare Node.js 20 to run on Node.js 24, producing warnings like:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a1…, actions/upload-artifact@ea165f8…

See https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/. An audit of every uses: in this repo showed almost all pins were on node16/node20 releases, not just the two in the warning.

What

1. Bump every pinned action to its latest release (all runs.using: node24). Full-SHA pins with # ratchet: version comments are kept, matching the existing convention. Each new SHA's action.yml was verified to declare node24.

Action Before → After
actions/checkout v3 → v7
actions/upload-artifact v4 → v7
actions/download-artifact v4 → v8
actions/setup-python v4 → v7
actions/setup-java v3 / v4 → v6
actions/setup-node v3 → v7
actions/cache v3 → v6
actions/create-github-app-token v3.2 → v3.3
nick-invision/retry v2 → nick-fields/retry v4 (repo was renamed)
microsoft/setup-msbuild v1.1 → v3
geekyeggo/delete-artifact v2 → v6
styfle/cancel-workflow-action 0.8.0 → 0.13.1
FirebaseExtended/github-actions/firebase-test-lab v1.4 → v1.5 (its nested auth/setup-gcloud are now node24 and SHA-pinned)

2. Replace unmaintained node12 actions that have no Node.js 24 release with equivalent gh CLI steps (same tokens and permissions, no third-party code to pin):

Removed action Replacement
scherermichael-oss/action-has-permission (checks_secure.yml) gh api repos/…/collaborators/$ACTOR/permission → sets has-permission output
lannonbr/repo-permission-check-action (integration_tests.yml) same API call, fails unless admin
andymckay/cancel-action gh run cancel $GITHUB_RUN_ID
actions-ecosystem/action-add-labels gh api POST repos/…/issues/$PR/labels
buildsville/add-remove-label gh pr edit --remove-label
KhannaAbhinav/random-selector-action + itsOliverBott/assign-pr-reviewers jq … | shuf -n 1 + gh api POST repos/…/pulls/$PR/requested_reviewers

3. Remove update-custom-runner.yml. It targeted self-hosted macOS runners (fplmac1, fplmac2) that are no longer registered (the repo has zero self-hosted runners), was workflow_dispatch-only with no run history, and was never functional: its if: reads github.event.input (singular — not a real context) so the job was always skipped, and its steps only echo their commands.

Breaking-change review

Release notes for each major bump were checked against actual usage:

  • download-artifact v5 path change only affects artifact-ids downloads — not used here (all downloads are by name, incl. the cross-run run-id ones).
  • download-artifact v8 now errors on digest mismatch by default (previously a warning).
  • checkout v6 stores credentials in $RUNNER_TEMP instead of .git/config; nothing in the repo reads extraheader from git config. v7 refuses fork-PR checkout under pull_request_target, but checks_secure.yml checks out the default (base) ref, so it is unaffected.
  • setup-python v7 removed pip-install, setup-java v6 renamed jdkFile, setup-node v6 limited auto-caching to npm — none used.
  • nick-fields/retry v4 has the same inputs as v2.

Validation

  • All workflow YAML parses; every remaining non-local uses: resolves to a node24 (or composite/docker) action.
  • zizmor findings dropped from 66 to 13 on main → this branch; the remaining 13 are pre-existing ref-version-mismatch on lukka/get-cmake@latest (already node24, left as-is).
  • Node 24 actions require Actions Runner ≥ 2.327.1; all jobs run on GitHub-hosted runners, which already satisfy this.

@AustinBenoit
Update GitHub Actions to Node.js 24-compatible releases
058c9b5 
GitHub is forcing actions that target Node.js 20 to run on Node.js 24
(https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/).
Bump every pinned action to its latest release (all `runs.using: node24`),
keeping full-SHA pins with ratchet version comments:

- actions/checkout v3 -> v7
- actions/upload-artifact v4 -> v7
- actions/download-artifact v4 -> v8
- actions/setup-python v4 -> v7
- actions/setup-java v3/v4 -> v6
- actions/setup-node v3 -> v7
- actions/cache v3 -> v6
- actions/create-github-app-token v3.2 -> v3.3
- nick-invision/retry v2 -> nick-fields/retry v4 (repo was renamed)
- microsoft/setup-msbuild v1.1 -> v3
- geekyeggo/delete-artifact v2 -> v6
- styfle/cancel-workflow-action 0.8.0 -> 0.13.1
- FirebaseExtended/github-actions/firebase-test-lab v1.4 -> v1.5

Replace unmaintained node12 actions that have no Node.js 24 release with
equivalent `gh` CLI steps:

- scherermichael-oss/action-has-permission, lannonbr/repo-permission-check-action
  -> `gh api .../collaborators/<actor>/permission`
- andymckay/cancel-action -> `gh run cancel`
- actions-ecosystem/action-add-labels -> `gh api POST .../issues/<n>/labels`
- buildsville/add-remove-label -> `gh pr edit --remove-label`
- KhannaAbhinav/random-selector-action + itsOliverBott/assign-pr-reviewers
  -> `shuf` + `gh api POST .../pulls/<n>/requested_reviewers`
@AustinBenoit
Remove non-functional update-custom-runner workflow
7681865 
This workflow_dispatch-only workflow targeted two self-hosted macOS
runners (fplmac1, fplmac2) that are no longer registered to the repo
(the repo has zero self-hosted runners). It was also never functional:
its job condition reads `github.event.input` (singular), which is not a
valid context and always evaluates empty, so the job was always skipped,
and its steps only echo the commands they describe.
@gemini-code-assist

gemini-code-assist Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

@AustinBenoit AustinBenoit added skip-release-notes Skip release notes check reviewer-roulette Assign a random reviewer tests-requested: quick Trigger a quick set of integration tests. labels Oct 23, 2026
@github-actions github-actions Bot removed the reviewer-roulette Assign a random reviewer label Oct 23, 2026
@github-actions
github-actions Bot requested a review from a-maurice October 23, 2026 18:07
@github-actions github-actions Bot added tests: in-progress This PR's integration tests are in progress. and removed tests-requested: quick Trigger a quick set of integration tests. labels Oct 23, 2026
@github-actions

github-actions Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

❌  Integration test FAILED

Requested by @AustinBenoit on commit d942bf4
Last updated: Fri Oct 23 13:48 PDT 2026
View integration test log & download artifacts

Failures Configs
app_check [TEST] [FAILURE] [iOS] [macos] [1/2 ios_device: simulator_target]
(1 failed tests)  FirebaseAppCheckTest.TestGetTokenForcingRefresh
firestore [TEST] [FLAKINESS] [iOS] [macos] [1/2 ios_device: ios_target]
(1 failed tests)  ServerTimestampTest.TestServerTimestampsCanRetainPreviousValueThroughConsecutiveUpdates
installations [TEST] [FLAKINESS] [Android] [1/3 os: macos] [1/2 android_device: emulator_ftl_target]
(1 failed tests)  FirebaseInstallationsTest.TestCanGetToken

Add flaky tests to go/fpl-cpp-flake-tracker

@AustinBenoit

AustinBenoit commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Workflow verification on this branch ✅ complete

Every workflow touched by this PR was exercised on update-actions-node24 (PR triggers, labels, and manual workflow_dispatch). Node 24 deprecation warnings are gone from all of these runs.

Workflow How triggered Run Status
Android Builds pull_request 39969435870 ✅ pass
iOS Builds pull_request 39969435810 ✅ pass
Lint pull_request 39969436242 ✅ pass
Checks pull_request / labeled 39969533899 ✅ pass
CodeQL (Analyze ×4) pull_request 39969433900 ✅ pass (see note 1)
GitHub Actions Scan (zizmor) pull_request_target 39969436250 ✅ pass
Reviewer Roulette reviewer-roulette label 40000769625 ✅ pass — new gh steps removed the label and requested a reviewer
Integration tests (self-cancel path) non-test label 39969533939 ✅ behaved as designed — gh run cancel replacement cancelled the run, same as the old action
Integration tests (quick) tests-requested: quick label 40000774395 19 of 20 jobs ✅ — check_and_prepare passed (new admin-permission check ✅; styfle/cancel-workflow-action@0.13.1 cancelled the superseded run 40000769713 ✅). Only test-ios-macos-26-simulator_target-gameloop fails, on the known-flaky FirebaseAppCheckTest.TestGetTokenForcingRefresh (note 3)
Desktop Builds pull_request 39969435816 ✅ all 10 jobs pass (Linux x86 jobs needed re-runs for the apt-mirror flake, note 2)
CPP binary SDK packaging workflow_dispatch 40000740534 ✅ pass — all 31 jobs incl. create-windows-only-package (the job from the original warning), cleanup-packaging-artifacts (geekyeggo/delete-artifact@v6) and trigger_integration_tests (create-github-app-token@v3 → dispatched the run below)
Integration tests — chained, dispatched by firebase-workflow-trigger[bot] against the packaged SDK via packaging above 40034553992 20 of 22 jobs ✅ — check_and_prepare ✅ with the permission check correctly skipped for the bot actor (note 4); summarize-results ✅ (create-github-app-token@v3 with pull-requests:write). The 2 failures are single App Check SDK tests (note 5)
Update Android and iOS dependencies workflow_dispatch 40000761523 ✅ pass — create-github-app-token@v3 + checkout/push path OK; no dependency changes detected so no PR was created (label step correctly skipped)
Generate Test Report Table workflow_dispatch 40000745628 ✅ pass
Retry Test Failures workflow_dispatch (run_id=39969435816) 40000750666, 40017130124 ✅ pass — second run (run_id=40000774395) performed a real retry: it re-ran the two failed test jobs as attempt 2, and test-tvos-macos-26-tvos_simulator passed on retry
Update Feature Branches workflow_dispatch 40000756176 ✅ pass (no feature_branch/* branches exist, merge job correctly skipped)
Checks (secure) pull_request_target: synchronize — ⏭️ not testable pre-merge: pull_request_target always runs the workflow file from main, so the new permission step only takes effect after merge

Notes

  1. The "CodeQL — 1 high" status on this PR is alert #2633 (actions/cache-poisoning/direct-cache in integration_tests.yml), which is already open on main. It is flagged here only because the actions/cache line moved; nothing about the cache usage changed.

  2. The Linux x86 desktop jobs hit the pre-existing apt-mirror flake (Release passed on the 2nd run, Debug on the 3rd): Install Desktop SDK prerequisites normally takes ~1 min but intermittently exceeds the 15-min nick-fields/retry timeout, at which point the retry action crashes with kill EPERM trying to kill the root-owned sudo apt process (same code path in v2 and v4). The same failure hit #39825804202 on the ab-14_1_0-update PR yesterday. Not related to this change; a follow-up could raise timeout_minutes for that step.

  3. FirebaseAppCheckTest.TestGetTokenForcingRefresh on the iOS/tvOS simulators is a known flaky SDK test, unrelated to CI actions: it is listed in today's nightly report ([C++] Nightly Integration Testing Report #1859, failed 5× on iOS from main), and test-ios-…-simulator_target-gameloop has failed on ~1 in 3 integration runs on main over the past week (e.g. 39928695935, 39881514960, 39852599368). It passed on tvOS on retry; the iOS failure is left as-is rather than re-running again.

  4. Permission check tightened in dc44663. Exercising the same change in firebase-unity-sdk (Update GitHub Actions to Node.js 24 releases firebase-unity-sdk#1552) showed the bot-dispatched integration run (packaging → integration_tests.yml) fails the new gh api …/collaborators/$ACTOR/permission step, because firebase-workflow-trigger[bot] is not a collaborator. The old lannonbr/repo-permission-check-action turned out to be a silent no-op (it reads its input as permision, a typo, so the required level was never set; 404s for non-collaborators were unhandled and never failed the step). The check is now skipped for bot actors (they already need actions:write to dispatch) and scheduled runs, and accepts write or admin so write-level team members can still trigger tests. Verified on the chained run 40034553992: actor firebase-workflow-trigger[bot], step skipped, run proceeds.

  5. Chained-run failures are one SDK test each, not CI: test-tvos-macos-26-tvos_simulator → FirebaseAppCheckTest.TestGetTokenForcingRefresh (the known flake from note 3), and test-desktop-windows-2022-x64-boringssl → FirebaseAppCheckTest.TestDatabaseCreateWorkingPath (same App Check family; that job passed 7/7 on main this past week and passed in this PR's from-source run 40000774395, and the packaged SDK downloaded, built and ran the rest of the suite fine). Not re-running.

@github-actions github-actions Bot added the tests: failed This PR's integration tests failed. label Oct 23, 2026
@firebase-workflow-trigger firebase-workflow-trigger Bot removed the tests: in-progress This PR's integration tests are in progress. label Oct 23, 2026
@AustinBenoit
integration_tests: skip permission check for bots/schedule, require w…
dc44663 
…rite

The replaced lannonbr/repo-permission-check-action was effectively a no-op:
it read its input as `permision` (typo), so the required level was never
set and every actor passed, and a 404 for non-collaborator actors (bots,
departed users) was an unhandled rejection that did not fail the step.

Enforcing it for real broke the chained run dispatched by
firebase-workflow-trigger[bot] from the packaging workflow, since bots are
not collaborators. Skip the check for bot actors (they already need
actions:write to dispatch) and for scheduled runs (whose actor is whoever
last committed the workflow file), and accept write as well as admin so
existing write-level team members can still trigger tests.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@a-maurice a-maurice Awaiting requested review from a-maurice

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

skip-release-notes Skip release notes check tests: failed This PR's integration tests failed.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AustinBenoit