Skip to content

Commit f16b28a

Browse files
josecelanojosecelano
committed
docs: add issue specification for #460 
1 parent 9f0b8dd commit f16b28a

1 file changed

Lines changed: 131 additions & 0 deletions

File tree

‎docs/issues/460-node-24-action-deprecation-warnings.md‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Update GitHub Actions to Node.js 24 Compatible Versions
2+
3+
**Issue**: #460
4+
**Parent Epic**: N/A
5+
**Related**: N/A
6+
7+
## Overview
8+
9+
Several GitHub Actions workflows produce deprecation warnings because some actions
10+
still run on Node.js 20. Starting **June 2nd, 2026**, GitHub will force all actions
11+
to run with Node.js 24 by default, and Node.js 20 will be removed from runners on
12+
**September 16th, 2026**.
13+
14+
Each affected action needs to be reviewed: in some cases a newer version with
15+
Node.js 24 support exists and can be adopted; in other cases no compatible release
16+
exists yet and the issue must be tracked until one does.
17+
18+
Reference: <https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/>
19+
20+
## Goals
21+
22+
- [ ] Identify which affected actions have Node.js 24-compatible releases available
23+
- [ ] Update workflow files to use compatible versions where possible
24+
- [ ] Track actions that have no compatible release yet, and re-check periodically
25+
- [ ] Eliminate all Node.js 20 deprecation warnings from CI runs
26+
27+
## Affected Actions by Workflow
28+
29+
### `backup-container.yaml` — Backup Container
30+
31+
| Action | Current Version | Node.js 24? |
32+
| ---------------------------- | --------------- | ----------- |
33+
| `docker/setup-buildx-action` | `@v3` | TBD |
34+
| `docker/build-push-action` | `@v6` | TBD |
35+
| `docker/login-action` | `@v3` | TBD |
36+
| `docker/metadata-action` | `@v5` | TBD |
37+
38+
### `container.yaml` — Container
39+
40+
| Action | Current Version | Node.js 24? |
41+
| ---------------------------- | --------------- | ----------- |
42+
| `docker/setup-buildx-action` | `@v3` | TBD |
43+
| `docker/build-push-action` | `@v6` | TBD |
44+
| `docker/login-action` | `@v3` | TBD |
45+
| `docker/metadata-action` | `@v5` | TBD |
46+
47+
### `cargo-security-audit.yml` — Cargo Security Audit
48+
49+
| Action | Current Version | Node.js 24? |
50+
| --------------------- | --------------- | ----------- |
51+
| `rustsec/audit-check` | `@v2.0.0` | TBD |
52+
53+
### `docker-security-scan.yml` — Docker Security Scan
54+
55+
| Action | Current Version | Node.js 24? |
56+
| --------------------------- | --------------- | ----------- |
57+
| `aquasecurity/trivy-action` | `@0.35.0` | TBD |
58+
59+
> **Note**: The warning in this workflow shows `actions/cache@0400d5f...` running on
60+
> Node.js 20. This is a **transitive dependency** used internally by
61+
> `aquasecurity/trivy-action`. Updating Trivy to a newer release should resolve it.
62+
63+
### `test-e2e-deployment.yml` — E2E Deployment Workflow Tests
64+
65+
| Action | Current Version | Node.js 24? |
66+
| ---------------------------- | --------------- | ----------- |
67+
| `docker/setup-buildx-action` | `@v3` | TBD |
68+
69+
### `dependabot-updates` — Dependabot (GitHub-managed)
70+
71+
| Action | Current Version | Node.js 24? |
72+
| -------------------------- | --------------- | ----------- |
73+
| `github/dependabot-action` | `@main` | TBD |
74+
75+
> **Note**: This workflow is **managed entirely by GitHub** and is not present in
76+
> this repository. We cannot update it directly. The warning may resolve
77+
> automatically when GitHub updates their internal Dependabot runner, or it may
78+
> require a GitHub support request.
79+
80+
## Implementation Plan
81+
82+
### Phase 1: Research available updates
83+
84+
- [ ] Check latest releases of `docker/setup-buildx-action`, `docker/build-push-action`, `docker/login-action`, `docker/metadata-action` for Node.js 24 support
85+
- [ ] Check latest release of `rustsec/audit-check` for Node.js 24 support
86+
- [ ] Check latest release of `aquasecurity/trivy-action` for Node.js 24 support (resolves transitive `actions/cache` warning)
87+
- [ ] Investigate `github/dependabot-action` — determine if this is fully GitHub-managed and no action is needed from our side
88+
89+
### Phase 2: Apply available updates
90+
91+
- [ ] Update all docker action versions in `backup-container.yaml` where newer Node.js 24 compatible versions are available
92+
- [ ] Update all docker action versions in `container.yaml` where newer Node.js 24 compatible versions are available
93+
- [ ] Update `docker/setup-buildx-action` in `test-e2e-deployment.yml`
94+
- [ ] Update `rustsec/audit-check` in `cargo-security-audit.yml`
95+
- [ ] Update `aquasecurity/trivy-action` in `docker-security-scan.yml`
96+
97+
### Phase 3: Handle actions with no available update
98+
99+
- [ ] For any action without a Node.js 24-compatible release, open a follow-up tracking note or issue
100+
- [ ] Document the status and re-check schedule
101+
102+
## Acceptance Criteria
103+
104+
> **Note for Contributors**: These criteria define what the PR reviewer will check. Use this as your pre-review checklist before submitting the PR to minimize back-and-forth iterations.
105+
106+
**Quality Checks**:
107+
108+
- [ ] Pre-commit checks pass: `./scripts/pre-commit.sh`
109+
110+
**Task-Specific Criteria**:
111+
112+
- [ ] No Node.js 20 deprecation warnings appear in any of the affected workflow runs
113+
- [ ] All updated action versions are pinned correctly and tested
114+
- [ ] Any action that cannot be updated is documented with a follow-up plan
115+
116+
## Related Documentation
117+
118+
- [GitHub blog: Deprecation of Node 20 on Actions Runners](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/)
119+
- Affected workflow runs:
120+
- [backup-container.yaml run #24191868780](https://github.com/torrust/torrust-tracker-deployer/actions/runs/24191868780)
121+
- [cargo-security-audit.yml run #24455465380](https://github.com/torrust/torrust-tracker-deployer/actions/runs/24455465380)
122+
- [container.yaml run #24455465394](https://github.com/torrust/torrust-tracker-deployer/actions/runs/24455465394)
123+
- [dependabot-updates run #24389583837](https://github.com/torrust/torrust-tracker-deployer/actions/runs/24389583837)
124+
- [docker-security-scan.yml run #24445697392](https://github.com/torrust/torrust-tracker-deployer/actions/runs/24445697392)
125+
- [test-e2e-deployment.yml run #24455481734](https://github.com/torrust/torrust-tracker-deployer/actions/runs/24455481734)
126+
127+
## Notes
128+
129+
- The `docker/*` actions appear in both `backup-container.yaml` and `container.yaml` with the same versions. They should be updated together.
130+
- The `dependabot-updates` warning may resolve itself without any action on our part — GitHub is likely already working on updating the internal runner.
131+
- Setting `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true` in the workflow environment is available as a temporary opt-in to test compatibility before the forced migration.

0 commit comments

Comments
 (0)