mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-24 23:59:08 +02:00
Eduard Gert
94106b57ab
GitHub Actions runners no longer ship Node 20 for JavaScript actions, and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is gone, so any action whose own action.yml declares `runs.using: node20` now fails to start. Eleven call sites across three workflows were still on such actions: actions/setup-node (five), pnpm/action-setup (four), actions/cache and actions/setup-go (one each). Every target was verified by reading `runs.using` out of the pinned ref's action.yml rather than inferred from its version number. Pin style is preserved per call site: SHA-pinned refs stay SHA-pinned with a corrected `# vX.Y.Z` comment, tag-pinned refs stay tag-pinned. cache and setup-go go to v6 rather than the newest release so the stragglers join the versions the rest of this repo already runs. Breaking changes were checked and none apply. The setup-node v5/v6 automatic dependency caching never triggers: it resolves package.json from the repo root, which does not exist here, and the frontend caches the pnpm store itself. v7 drops the dummy NODE_AUTH_TOKEN export and adds cache outputs, neither of which any workflow reads. setup-go v6 reworks toolchain selection, but the one straggler passes the same go-version-file and `cache: false` as the 22 setup-go v6.5.0 pins already in CI. The v5/v6 runner floor is met because every job runs on GitHub-hosted runners. pnpm/action-setup v4 added a hard error when the `version:` input disagrees with package.json's `packageManager`. It stays dormant here only because the action looks for package.json at the repo root and swallows the resulting ENOENT; all four sites pass `version: 11` while client/ui/frontend/package.json says pnpm@11.4.0. Left alone to keep this change to the runtime bump, but adding a root package.json or setting `package_json_file` would make all four fail. git-town/action is knowingly left on node20. Every release through the latest v1.3.3, and main HEAD, still declares `runs.using: node20`, so there is nothing to bump to. That job will break when the runtime is retired and needs its own decision: drop it, fork the action onto node24, or file upstream. node-version stays at 22. That is the Node toolchain used to build the frontend, not an action runtime, so this retirement does not touch it, and the build cannot be validated on this host because the binding generator needs Linux-only GTK4 and WebKitGTK dev packages. It belongs in a separately verified change.