Upgrade GitHub Actions to Node 24

zackees · zackees · commit 2aa2e346ff63 · 2026-04-24T09:41:32.000-07:00
diff --git a/.github/actions/setup/README.md b/.github/actions/setup/README.md
@@ -1,6 +1,6 @@
 # `FastLED/fbuild/setup` - composite GitHub Action
 
-One-line fbuild setup for consumer CI pipelines. Installs fbuild, wires `actions/cache@v4` with sensible defaults, and exports `FBUILD_CACHE_DIR` plus `ZCCACHE_DIR` so subsequent steps Just Work.
+One-line fbuild setup for consumer CI pipelines. Installs fbuild, wires `actions/cache@v5` with sensible defaults, and exports `FBUILD_CACHE_DIR` plus `ZCCACHE_DIR` so subsequent steps Just Work.
 
 For the underlying cache design (what's cached, why, and how to tune the key for your project) see [`../../docs/CI_CACHING.md`](../../../docs/CI_CACHING.md).
 
@@ -53,7 +53,7 @@ jobs:
 
 ## Caching the zccache store
 
-The built-in `cache: true` wiring covers the fbuild package/tool cache rooted at `FBUILD_CACHE_DIR`. If you also want cross-run reuse of zccache's object store, add your own `actions/cache@v4` step for the resolved zccache directory and your project build outputs:
+The built-in `cache: true` wiring covers the fbuild package/tool cache rooted at `FBUILD_CACHE_DIR`. If you also want cross-run reuse of zccache's object store, add your own `actions/cache@v5` step for the resolved zccache directory and your project build outputs:
 
 ```yaml
 - name: Setup fbuild
@@ -63,7 +63,7 @@ The built-in `cache: true` wiring covers the fbuild package/tool cache rooted at
     cache-key-extra: ${{ matrix.board }}-${{ hashFiles('platformio.ini') }}
 
 - name: Restore zccache store + project build outputs
-  uses: actions/cache@v4
+  uses: actions/cache@v5
   with:
     path: |
       ${{ steps.fbuild-setup.outputs.zccache-store-path }}
@@ -105,7 +105,7 @@ Use `steps.<id>.outputs.zccache-store-path` inside workflow expressions. The sam
 | `cache-hit` | `true` if the cache was restored from a previous run, `false` on miss. |
 | `cache-dir` | Resolved cache directory path. Useful for diagnostic steps. |
 | `fbuild-hash` | sha256 prefix (16 hex chars) of the installed fbuild wheel's `RECORD` file. Baked into the cache key so any fbuild change, including a re-released wheel at the same version, invalidates stale cache artifacts. |
-| `zccache-store-path` | Resolved zccache object-store directory. The same path is exported to later steps as `ZCCACHE_DIR`, so consumer-managed `actions/cache@v4` blocks can reuse it without guessing platform-specific defaults. |
+| `zccache-store-path` | Resolved zccache object-store directory. The same path is exported to later steps as `ZCCACHE_DIR`, so consumer-managed `actions/cache@v5` blocks can reuse it without guessing platform-specific defaults. |
 
 ## What this action does
 
@@ -114,7 +114,7 @@ Use `steps.<id>.outputs.zccache-store-path` inside workflow expressions. The sam
 3. Exports `FBUILD_CACHE_DIR` and `ZCCACHE_DIR` via `$GITHUB_ENV` so every later step inherits them, and exposes the zccache location as the `zccache-store-path` output.
 4. Installs fbuild from PyPI at the requested version.
 5. **Computes the installed fbuild's content hash** (sha256 of its dist-info `RECORD`) and bakes it into the cache key. This guarantees the cache is tied to the exact fbuild you're running, not just the PyPI version string, so `latest` is safe and a re-released wheel won't poison the cache.
-6. Restores (and on job-end, saves) the fbuild cache via `actions/cache@v4`.
+6. Restores (and on job-end, saves) the fbuild cache via `actions/cache@v5`.
 
 ### Why hash-pinning matters
 
@@ -128,7 +128,7 @@ Baking the wheel's `RECORD` hash into the key means:
 
 It does **not** cache `~/.fbuild/*/daemon/` - that's ephemeral runtime state and restoring it across runs causes broken daemon discovery on the next client call. The action sidesteps the whole `~/.fbuild/` tree by redirecting fbuild's cache to `$RUNNER_TEMP/fbuild-cache` via `FBUILD_CACHE_DIR`.
 
-It also does **not** automatically cache zccache's object store for you. That store lives at `ZCCACHE_DIR` / `zccache-store-path`, and consumers who want cross-run per-TU reuse should add their own `actions/cache@v4` step as shown above.
+It also does **not** automatically cache zccache's object store for you. That store lives at `ZCCACHE_DIR` / `zccache-store-path`, and consumers who want cross-run per-TU reuse should add their own `actions/cache@v5` step as shown above.
 
 ## Version pinning
 
@@ -142,5 +142,5 @@ At time of writing there is no `v1` tag - use `@main` and pin `fbuild-version` t
 
 ## Related
 
-- [`docs/CI_CACHING.md`](../../../docs/CI_CACHING.md) - detailed design of the underlying cache, plus raw `actions/cache@v4` snippets for consumers who prefer to avoid the action dependency.
+- [`docs/CI_CACHING.md`](../../../docs/CI_CACHING.md) - detailed design of the underlying cache, plus raw `actions/cache@v5` snippets for consumers who prefer to avoid the action dependency.
 - [#101](https://github.com/FastLED/fbuild/issues/101) - the issue that tracked creation of this action.
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
@@ -49,7 +49,7 @@ runs:
   using: "composite"
   steps:
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ inputs.python-version }}
 
@@ -118,7 +118,7 @@ runs:
     - name: Restore fbuild cache
       if: ${{ inputs.cache == 'true' }}
       id: fbuild-cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ${{ steps.resolve-paths.outputs.cache-dir }}
         key: fbuild-${{ inputs.cache-version }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.fbuild-hash.outputs.fbuild-hash }}-${{ inputs.cache-key-extra }}
diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
@@ -24,6 +24,9 @@ on:
   pull_request:
     types: [opened]
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 # pull_request (not pull_request_target) — fork PRs run in the fork's context
 # without access to PROJECT_APP_PRIVATE_KEY, so they simply won't be
 # auto-added. That is an intentional security trade-off: pull_request_target
diff --git a/.github/workflows/check-macos.yml b/.github/workflows/check-macos.yml
@@ -9,6 +9,7 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   check:
diff --git a/.github/workflows/check-ubuntu.yml b/.github/workflows/check-ubuntu.yml
@@ -9,6 +9,7 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   check:
diff --git a/.github/workflows/check-windows.yml b/.github/workflows/check-windows.yml
@@ -9,6 +9,7 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   check:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 jobs:
   docs:
     name: Documentation
diff --git a/.github/workflows/fmt.yml b/.github/workflows/fmt.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 jobs:
   fmt:
     name: Formatting
diff --git a/.github/workflows/msrv.yml b/.github/workflows/msrv.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 jobs:
   msrv:
     name: Min Rust Version (1.94.1)
diff --git a/.github/workflows/release-auto.yml b/.github/workflows/release-auto.yml
@@ -170,7 +170,7 @@ jobs:
           ref: ${{ needs.prepare.outputs.release_ref }}
 
       - name: Download native artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: binaries-*
           path: artifacts
@@ -204,7 +204,7 @@ jobs:
           sha256sum fbuild-* > "fbuild-${version}-SHA256SUMS.txt"
 
       - name: Attest release artifacts
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-checksums: dist/fbuild-${{ needs.prepare.outputs.version }}-SHA256SUMS.txt
 
@@ -239,7 +239,7 @@ jobs:
           ref: ${{ needs.prepare.outputs.release_ref }}
 
       - name: Download native artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: binaries-*
           path: dist/_tmp
@@ -312,7 +312,7 @@ jobs:
 
     steps:
       - name: Download PyPI distributions
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: pypi-fbuild
           path: dist
diff --git a/.github/workflows/template_build.yml b/.github/workflows/template_build.yml
@@ -23,6 +23,7 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
   build:
diff --git a/.github/workflows/template_native_build.yml b/.github/workflows/template_native_build.yml
@@ -35,6 +35,7 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 permissions:
   contents: read
@@ -199,7 +200,7 @@ jobs:
           cat SHA256SUMS.txt
 
       - name: Attest native artifacts
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-checksums: staging/SHA256SUMS.txt
 
diff --git a/docs/CI_CACHE.md b/docs/CI_CACHE.md
@@ -74,7 +74,7 @@ jobs:
           cache-key-extra: ${{ env.FBUILD_RUNNER_IMAGE }}-${{ env.FBUILD_BOARD }}-${{ hashFiles('platformio.ini', 'rust-toolchain.toml', '.fbuild-cache-version') }}
 
       - name: Restore zccache store and fbuild build outputs
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ${{ steps.fbuild.outputs.zccache-store-path }}
diff --git a/docs/CI_CACHING.md b/docs/CI_CACHING.md
@@ -19,7 +19,7 @@ Most consumers should use the [`FastLED/fbuild/.github/actions/setup`](../.githu
 - run: fbuild build examples/Blink -e esp32dev
 ```
 
-The action sidesteps the whole `~/.fbuild/*/daemon/` "don't cache ephemeral state" pitfall by redirecting fbuild's cache to `$RUNNER_TEMP/fbuild-cache` via `FBUILD_CACHE_DIR`. It also exposes the resolved zccache store as both the `zccache-store-path` output and the `ZCCACHE_DIR` environment variable, so consumer workflows can add their own `actions/cache@v4` entry for cross-run per-TU reuse. See the [action's README](../.github/actions/setup/README.md) for inputs, outputs, and a full matrix example.
+The action sidesteps the whole `~/.fbuild/*/daemon/` "don't cache ephemeral state" pitfall by redirecting fbuild's cache to `$RUNNER_TEMP/fbuild-cache` via `FBUILD_CACHE_DIR`. It also exposes the resolved zccache store as both the `zccache-store-path` output and the `ZCCACHE_DIR` environment variable, so consumer workflows can add their own `actions/cache@v5` entry for cross-run per-TU reuse. See the [action's README](../.github/actions/setup/README.md) for inputs, outputs, and a full matrix example.
 
 ### If you want zccache hits across CI runs
 
@@ -33,7 +33,7 @@ Keep the action's built-in cache for `FBUILD_CACHE_DIR`, then add a second cache
     cache-key-extra: ${{ matrix.board }}-${{ hashFiles('platformio.ini') }}
 
 - name: Restore zccache store + project build outputs
-  uses: actions/cache@v4
+  uses: actions/cache@v5
   with:
     path: |
       ${{ steps.fbuild-setup.outputs.zccache-store-path }}
@@ -66,7 +66,7 @@ If you skip the composite action, you MUST still bake the fbuild content hash in
     echo "hash=$FBUILD_HASH" >> "$GITHUB_OUTPUT"
 
 - name: Restore fbuild cache
-  uses: actions/cache@v4
+  uses: actions/cache@v5
   with:
     path: |
       ~/.fbuild/prod/cache
@@ -105,7 +105,7 @@ See `crates/fbuild-paths/src/lib.rs` for the authoritative path list.
 The goal is to maximize hit rate without producing wrong output. In priority order, the key should discriminate on:
 
 1. **Runner OS + arch** - `${{ runner.os }}-${{ runner.arch }}`. Toolchains are platform-pinned; sharing across OSes corrupts builds.
-2. **fbuild content hash** - **required**, not optional. Key on a content hash of the installed fbuild (e.g., sha256 of the wheel's dist-info `RECORD` file), not just the PyPI version string. A version string does not discriminate against re-released wheels, dev builds, or local installs; cached artifacts can encode fbuild-internal layout (response-file format, path embedding, fingerprint scheme) that changes silently across those. The composite `setup` action computes this hash for you and exports it via the `fbuild-hash` output - consumers who roll their own `actions/cache@v4` should do the equivalent.
+2. **fbuild content hash** - **required**, not optional. Key on a content hash of the installed fbuild (e.g., sha256 of the wheel's dist-info `RECORD` file), not just the PyPI version string. A version string does not discriminate against re-released wheels, dev builds, or local installs; cached artifacts can encode fbuild-internal layout (response-file format, path embedding, fingerprint scheme) that changes silently across those. The composite `setup` action computes this hash for you and exports it via the `fbuild-hash` output - consumers who roll their own `actions/cache@v5` should do the equivalent.
 3. **Graph inputs** - `platformio.ini`, per-board JSONs, `rust-toolchain.toml`, any `lib_deps`-defining file. A change to these invalidates the warm-build fingerprint anyway, so it's cheap to bake them into the key to avoid carrying obsolete artifacts.
 4. **Manual bump** - a `.fbuild-cache-version` sentinel in the repo lets you force-invalidate with a one-line commit when the runtime has rotted for reasons GH Actions can't see.
 
@@ -127,7 +127,7 @@ If you also cache `ZCCACHE_DIR`, use the same OS/arch, `fbuild-hash`, and graph-
     )
     echo "hash=$FBUILD_HASH" >> "$GITHUB_OUTPUT"
 
-- uses: actions/cache@v4
+- uses: actions/cache@v5
   with:
     path: ~/.fbuild/prod/cache
     key: fbuild-${{ runner.os }}-${{ runner.arch }}-${{ steps.fbuild-hash.outputs.hash }}-${{ hashFiles('platformio.ini') }}
@@ -151,15 +151,15 @@ The index SQLite file is the only thing that MUST match the archives/installed d
 ## Hermeticity
 
 - **Toolchain binaries, frameworks, and libraries are content-addressed** - they produce bit-for-bit identical intermediate objects given identical inputs, regardless of which runner built them. Safe to share across the matrix.
-- **Compile outputs under `.fbuild/build/` are reproducible in file *content* but not always in *mtime***. fbuild's build fingerprint is content-hashed, not mtime-based, so a restored cache does not need mtime preservation from the CI runner - `needs_rebuild` keys on depfile contents and command-hash, not timestamps. This means `actions/cache@v4` restoring without mtime fidelity is fine.
+- **Compile outputs under `.fbuild/build/` are reproducible in file *content* but not always in *mtime***. fbuild's build fingerprint is content-hashed, not mtime-based, so a restored cache does not need mtime preservation from the CI runner - `needs_rebuild` keys on depfile contents and command-hash, not timestamps. This means `actions/cache@v5` restoring without mtime fidelity is fine.
 - **Absolute path embedding**: response files (`*.rsp`) under `.fbuild/build/` contain absolute paths to `~/.fbuild/.../installed/...`. On a runner where `$HOME` differs between runs (uncommon but possible), response files become stale. Mitigate by pinning `HOME` to a stable runner path, or by bumping `.fbuild-cache-version` when you change runner images.
 - **Debug info**: optimized release builds don't embed source paths beyond what DWARF requires. If you ship debuggable firmware, embedded paths may differ across runners - file-per-runner cache shards if this matters.
 
 ## Invalidation
 
 `disk_cache::reconcile_on_open` runs **on daemon startup**, not per-build. On CI where the daemon starts fresh each job, reconcile happens exactly once and is fast (just walks `index.sqlite` + verifies referenced paths exist, removes orphans). No full filesystem rescan per build.
 
-The LRU/GC budget (`crates/fbuild-packages/src/disk_cache/budget.rs`) auto-scales to disk free space. On a 14 GB-free GH Actions runner this lands on a ~10 GB budget - within `actions/cache@v4`'s 10 GB cache-entry limit. If you use a bigger runner, consider pinning the budget with `FBUILD_CACHE_BUDGET=8G` (or whatever you want) to keep the cache entry from growing past what the hosted cache will accept.
+The LRU/GC budget (`crates/fbuild-packages/src/disk_cache/budget.rs`) auto-scales to disk free space. On a 14 GB-free GH Actions runner this lands on a ~10 GB budget - within `actions/cache@v5`'s 10 GB cache-entry limit. If you use a bigger runner, consider pinning the budget with `FBUILD_CACHE_BUDGET=8G` (or whatever you want) to keep the cache entry from growing past what the hosted cache will accept.
 
 ### Forcing a rebuild in CI
 
@@ -192,7 +192,7 @@ Matrix jobs sharing one `actions/cache` key will each read the same restore atom
 
 As of this doc:
 
-- `fbuild cache export <tarball>` / `fbuild cache import <tarball>`: **not implemented**. `actions/cache@v4` handles archive+extract. A native helper would only be needed for non-GHA CI systems.
+- `fbuild cache export <tarball>` / `fbuild cache import <tarball>`: **not implemented**. `actions/cache@v5` handles archive+extract. A native helper would only be needed for non-GHA CI systems.
 - `fbuild cache pin <entry>`: **not implemented**. LRU eviction is based on recency; if you need to guarantee a toolchain never evicts on a shared cache, file a follow-up.
 - `fbuild cache stats`: yes - `DiskCache::stats()` exposes size and entry counts. Useful for CI debug output.
 
@@ -216,7 +216,7 @@ steps:
       cache-key-extra: ${{ matrix.board }}-${{ hashFiles('platformio.ini', 'rust-toolchain.toml') }}
 
   - name: Restore zccache store + project build outputs
-    uses: actions/cache@v4
+    uses: actions/cache@v5
     with:
       path: |
         ${{ steps.fbuild-setup.outputs.zccache-store-path }}
