Skip to content

chore(ENG-12048): v1 Deprecation notice#34

Closed
BartoszBlizniak wants to merge 2 commits into
masterfrom
release/v1
Closed

chore(ENG-12048): v1 Deprecation notice#34
BartoszBlizniak wants to merge 2 commits into
masterfrom
release/v1

Conversation

@BartoszBlizniak
Copy link
Copy Markdown
Member

Summary

Following the Node.js release cycle, Node 20 is now EoL — this change adds deprecation notices to @v1. We will continue to provide security updates until end of 2026 to allow time for migration.

Migrating from @v1@v2

1. Bump the action reference

- uses: cloudsmith-io/cloudsmith-cli-action@v1
+ uses: cloudsmith-io/cloudsmith-cli-action@v2

2. OIDC audience default has changed

@v2 now defaults oidc-audience to https://github.com/{org-name} (resolved from
GITHUB_REPOSITORY_OWNER) instead of api://AzureADTokenExchange.

If your downstream validates the aud claim against the old value, either update that validation or pin
the previous default explicitly:

with:
  oidc-audience: 'api://AzureADTokenExchange'

3. Self-hosted runners need Node.js 24

GitHub-hosted runners are unaffected. Self-hosted runners must provide Node.js 24+.

No input or output names changed — existing workflows otherwise migrate one-for-one.

Copilot AI review requested due to automatic review settings May 5, 2026 08:47
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

  • Adds @v1 deprecation messaging across the action (runtime warning, action metadata, and docs) in response to Node.js 20 reaching EoL, and points users toward @v2/Node.js 24.
  • Updates package versioning and introduces a changelog entry for the deprecation notice.

Changes:

  • Emit a runtime core.warning(...) on every @v1 invocation with migration guidance.
  • Add @v1 deprecation notice to README.md, action.yml, and new CHANGELOG.md.
  • Bump package.json / package-lock.json version to 1.0.11 and update the built dist/index.js.

Reviewed changes

Copilot reviewed 5 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
src/main.js Adds a runtime deprecation warning with migration guidance.
src/download-cli.js Tweaks fetch failure error message formatting.
README.md Adds an @v1 deprecation callout and migration notes.
action.yml Updates the marketplace/action description to include deprecation notice.
CHANGELOG.md Adds a 1.0.11 entry documenting @v1 deprecation.
package.json Bumps package version to 1.0.11.
package-lock.json Keeps lockfile version metadata in sync with package.json.
dist/index.js Updates compiled action output to match source changes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/download-cli.js
const res = await fetch(url);
if (!res.ok) {
throw new Error(`Failed to fetch ${url}: ${res.statusText}`);
throw new Error(`Failed to fetch ${url} : ${res.statusText}`);
Comment thread src/main.js
core.warning(
"cloudsmith-cli-action @v1 is DEPRECATED. v1 runs on Node.js 20, which reached end-of-life on 2026-04-30 (https://nodejs.org/en/about/previous-releases). " +
"Please migrate to @v2, which runs on Node.js 24. Security-only patches for v1 will continue until 2026-12-31. " +
"Migration guide: https://github.com/cloudsmith-io/cloudsmith-cli-action#readme",
Comment thread README.md
Comment on lines +11 to +17
> **🛑 DEPRECATED — `@v1` is end-of-life.**
>
> `@v1` runs on Node.js 20, which reached [end-of-life on 2026-04-30](https://nodejs.org/en/about/previous-releases). Please migrate to [`@v2`](https://github.com/cloudsmith-io/cloudsmith-cli-action/tree/master#readme), which runs on Node.js 24.
>
> - **Migration guide:** see the [v2 README](https://github.com/cloudsmith-io/cloudsmith-cli-action/tree/master#readme) for breaking changes (Node.js 24 runtime, OIDC audience default).
> - **Security-only patches** for `@v1` will continue until **2026-12-31**. No new features or non-security fixes will land on `@v1` after that date.
> - To migrate, change `cloudsmith-io/cloudsmith-cli-action@v1` → `cloudsmith-io/cloudsmith-cli-action@v2` in your workflows.
Comment thread README.md
Comment on lines +13 to +15
> `@v1` runs on Node.js 20, which reached [end-of-life on 2026-04-30](https://nodejs.org/en/about/previous-releases). Please migrate to [`@v2`](https://github.com/cloudsmith-io/cloudsmith-cli-action/tree/master#readme), which runs on Node.js 24.
>
> - **Migration guide:** see the [v2 README](https://github.com/cloudsmith-io/cloudsmith-cli-action/tree/master#readme) for breaking changes (Node.js 24 runtime, OIDC audience default).
Comment thread CHANGELOG.md

### Deprecated

- **`@v1` is deprecated.** v1 runs on Node.js 20, which reached [end-of-life on 2026-04-30](https://nodejs.org/en/about/previous-releases). Please migrate to [`@v2`](https://github.com/cloudsmith-io/cloudsmith-cli-action/tree/master#readme), which runs on Node.js 24.
Comment thread action.yml
@@ -1,5 +1,5 @@
name: Cloudsmith CLI Setup
description: Set up Cloudsmith CLI in GitHub Actions
description: '[DEPRECATED — please migrate to @v2 (Node.js 24). v1 runs on Node.js 20 (EoL 2026-04-30); security-only patches until 2026-12-31.] Set up Cloudsmith CLI in GitHub Actions'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants