Skip to content

Bump actions versions#1987

Merged
Masterkatze merged 2 commits into
NeotokyoRebuild:masterfrom
Masterkatze:update_actions
Jun 12, 2026
Merged

Bump actions versions#1987
Masterkatze merged 2 commits into
NeotokyoRebuild:masterfrom
Masterkatze:update_actions

Conversation

@Masterkatze

Copy link
Copy Markdown
Contributor

Description

Fix for this warning:
Windows Native Libraries Debug Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/upload-artifact@v4, ilammy/msvc-dev-cmd@v1. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

ilammy/msvc-dev-cmd@v1 is not active anymore (link) and will be replaced by TheMrMilchmann/setup-msvc-dev@v4 fork.

@Masterkatze Masterkatze added the CI Continuous Integration (GitHub Actions) label Jun 11, 2026
@Rainyan

Rainyan commented Jun 11, 2026

Copy link
Copy Markdown
Member

Should we maybe pin TheMrMilchmann/setup-msvc-dev@v4 by the release hash instead, to minimize the risk of a supply-chain attack where v4 gets pointed to something else? The maintainer seems legit but this doesn't seem like an action that will need updates so maybe it would be safer to do so. Just so we don't have to worry about a random supply chain compromise by whatever means.

For the official github action org actions I doubt there is a need to hard-pin a specific version, since intrinsically we have to trust GitHub already.

@Rainyan Rainyan requested review from a team and Rainyan June 11, 2026 19:08
@Rainyan Rainyan requested a review from a team June 11, 2026 19:09
@Masterkatze Masterkatze merged commit 7a5d1e3 into NeotokyoRebuild:master Jun 12, 2026
7 checks passed
@Masterkatze Masterkatze deleted the update_actions branch June 12, 2026 06:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CI Continuous Integration (GitHub Actions)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants