Repository navigation
[PET-57] Pin CI runners to ubuntu-24.04 and clear the Node 20 deprecations - #59
Merged
Merged
Conversation
Every job emits a notice that the `ubuntu-latest` label migrates to Ubuntu 26 starting 2026-10-19. The rollout is gradual, so left alone the change arrives on GitHub's schedule rather than ours and a pipeline nobody touched can go red. Pinning to the image `ubuntu-latest` resolves to today keeps the runner identical to what these workflows have been running on, and makes the move to 26 a deliberate PR where a failure is expected and diagnosable instead of a surprise on unrelated work. All 8 jobs across the 3 workflows were on the bare label. Nothing else changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 29 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…y action The build-and-submit run warns that `dawidd6/action-download-artifact@v2` targets Node.js 20 and is being forced onto Node.js 24. That pin is also 23 majors behind (v25 is current), so bumping it blind is its own risk. `actions/download-artifact@v8` has supported cross-run downloads via `run-id` + `github-token` since v4, takes the same four inputs this step passes (just dash-cased), runs on node24, and is already what main.yml and pull-request.yml use to fetch the coverage artifact. So the fix is to drop the third-party action rather than chase its major versions. Behaviour is unchanged: `name: version` + `path: .` extracts version.txt to the workspace root, which is where the next step reads it from. The artifact is still produced by actions/upload-artifact@v7 in main.yml — the same v4+ pairing the coverage artifact already uses. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
🚀 Expo preview is ready!
|
zigcccc
changed the title
`expo/expo-github-action/preview` and `expo/expo-github-action` are separate actions, but the tag resolves against the same repo, so pinning the preview step at v8 pulled a 2.5-year-old checkout (8.2.1, Jan 2024) alongside v9.0.0 elsewhere. More to the point, v9.0.0's only breaking change is "update tooling and actions to Node 24" — preview/action.yml goes from `using: node20` to `using: node24`. So v8 was a second Node 20 action, just one nothing had warned us about yet. Inputs and outputs are byte-identical between the two tags, and the step only passes `command`, so this is a drop-in. Unlike the download-artifact swap, this one is exercised by the Publish Expo Preview job on this PR. No action in any workflow targets Node 20 after this. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
zigcccc
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: PET-57
Why
Deprecation annotations on our CI runs. Nothing failing yet, but all of it lands on someone else's schedule if we leave it.
1. Runner image. Every job emits:
The rollout is gradual from that date, so left alone a pipeline nobody touched can go red on a random morning, on top of whatever unrelated work is in flight.
Our exposure looks low: the runners do no native compilation (iOS/Android builds happen on EAS servers), so there's no Android SDK, NDK, Xcode or Java toolchain on our side to break. Node is explicitly pinned (
actions/setup-node@v6,node-version: 24) in every job that needs it, pnpm comes frompnpm/action-setup@v6plus thepackageManagerfield (with the binary itself pinned in the lockfile since #58), and the only system tools we touch arejqandgh, both of which stay preinstalled on Ubuntu 26. So this is most likely a no-op either way — the point is to make it a deliberate one.2. Node 20 actions. The build-and-submit workflow warns:
Auditing the rest turned up a second one that nothing had warned about yet — see below.
What
Three commits, one concern each.
Pin the runners
runs-on: ubuntu-latest→ubuntu-24.04on all 8 jobs, which is the imageubuntu-latestresolves to today, so the runner stays identical to what these workflows have been running on.pull-request.ymllint-test·sonar·expo-previewmain.ymllint-test·sonar·convex·expobuild-and-submit.ymlbuild-submitDrop the third-party download action
That
@v2pin is 23 majors behind (v25 is current), so bumping it blind carries its own risk. Instead the step moves toactions/download-artifact@v8, which has supported cross-run downloads viarun-id+github-tokensince v4, takes the same four inputs just dash-cased, runs on node24, and is already whatmain.ymlandpull-request.ymluse for the coverage artifact. One fewer third-party action in the release path.Behaviour is unchanged:
name: version+path: .extractsversion.txtto the workspace root, where the next step reads it. Still paired withactions/upload-artifact@v7inmain.yml— the same v4+ pairing the coverage artifact already uses successfully.Bump
expo-github-action/previewto v9expo/expo-github-action/previewandexpo/expo-github-actionare separate actions, but the tag resolves against the same repo, so pinning the preview step at v8 pulled a checkout from January 2024 (8.2.1) alongside 9.0.0 (June 2026) elsewhere.More to the point: v9.0.0's only breaking change is "update tooling and actions to Node 24" —
preview/action.ymlgoes fromusing: node20tousing: node24. So v8 was a second Node 20 action, just one nothing had warned us about yet.Inputs and outputs are byte-identical across the two tags, and the step only passes
command, so it's a drop-in.After this, no action in any workflow targets Node 20.
Verification
The preview bump is exercised by the Publish Expo Preview job on this PR, so it's proven rather than reasoned about.
build-and-submit.ymlisworkflow_dispatch-only and isn't exercised by PR checks, so the download-artifact swap can't be proven green here — it needs a manual dispatch after merge. The inputs were checked against the publishedaction.ymlfor v8, and the equivalent upload/download pairing already works in the other two workflows.Follow-up
Moving to
ubuntu-26.04gets its own PR, where a red pipeline is expected and diagnosable. PET-57 also carries an open question worth deciding then: whether to keep the explicit pin as standing policy (we own the cadence, but image security patches need a deliberate bump) or return toubuntu-latestonce 26 is the stable default.🤖 Generated with Claude Code