ci: bump GitHub Actions to Node.js 24 runtimes #2
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -24,9 +24,9 @@ jobs: | |
| - goos: linux | ||
| goarch: amd64 | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
|
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: actions/checkout v6 release notes (what changed across the v6.x releases) v6.0.0 (released 2025-11-20) - Update README to include Node.js 24 support details and requirements. [1] - Persist credentials to a separate file. [1] v6.0.1 (released 2025-12-02) - Update all references from v5 and v4 to v6 in the repo. [2] - Add worktree support for persist-credentials includeIf. [2] - Clarify v6 README. [2] v6.0.2 (released 2026-01-09) - Add orchestration_id to the git user-agent when ACTIONS_ORCHESTRATION_ID is set. [3] - Fix tag handling: preserve annotations and explicit fetch-tags. [3] v6.0.3 (released 2026-06-02) - Fix expand merge commit SHA regex and add SHA-256 test cases. [4] - Fix checkout init for SHA-256 repositories. [4] Primary release-note sources: - v6.0.0: https://github.com/actions/checkout/releases/tag/v6.0.0 [1] - v6.0.1: https://github.com/actions/checkout/releases/tag/v6.0.1 [2] - v6.0.2: https://github.com/actions/checkout/releases/tag/v6.0.2 [3] - v6.0.3: https://github.com/actions/checkout/releases/tag/v6.0.3 [4] Citations:
🌐 Web query:
💡 Result: actions/setup-go v6 release notes (key items) 1) v6.0.0 (released 2025-09-04) - Breaking changes: - Improved Go toolchain handling for more reliable and consistent toolchain selection and management [1]. - Upgraded the action’s Node.js runtime from node20 to node24, with an action-required runner requirement: runner v2.327.1 or later [1]. - Dependency updates included upgrades such as actions/checkout 4→5 [1]. 2) v6.1.0 (released 2025-11-20) - Enhancements: - Fall back to downloading Go from go.dev/dl instead of storage.googleapis.com/golang [2]. - Added support for.tool-versions [2]. - Added comprehensive breaking changes documentation for v6 [2]. 3) v6.2.0 (released 2026-01-13) - Enhancements/documentation and dependency updates (no additional v6-breaking items called out in the short release highlights) [3]. 4) v6.3.0 (released 2026-02-26) - Changes: - Updated default Go module caching to use go.mod [4][5]. - Fixed Go download URL to go.dev [4]. General v6 breaking-change behavior summarized in the project README - Node.js runtime upgraded from node20 to node24, and you must use runner version v2.327.1 or later for compatibility [6]. - Toolchain directive support: the action supports both go and toolchain directives in go.mod; if toolchain is present it’s used, otherwise it falls back to the go directive [6]. - Cache key update: by default, the module cache key is based on go.mod (use cache-dependency-path to use go.sum instead) [6]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
# 該当行付近を表示
sed -n '1,120p' .github/workflows/release.yml | nl -ba | sed -n '15,60p'Repository: uzulla/shpool-launch Length of output: 107 🏁 Script executed: #!/bin/bash
set -euo pipefail
# nlが無いのでawkで行番号付けして該当範囲を表示
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/release.yml | sed -n '20,45p'Repository: uzulla/shpool-launch Length of output: 914 🏁 Script executed: #!/bin/bash
set -euo pipefail
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/release.yml | sed -n '1,35p'Repository: uzulla/shpool-launch Length of output: 956 actions/checkout@v6 と actions/setup-go@v6 の互換性観点（破壊的変更）を workflow 設定に紐づけて整理
🧰 Tools🪛 zizmor (1.25.2)[warning] 27-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||
|
|
||
| - uses: actions/setup-go@v6 | ||
| with: | ||
| go-version-file: go.mod | ||
| cache: true | ||
|
|
@@ -41,7 +41,7 @@ jobs: | |
| OUT="dist/shp-${GOOS}-${GOARCH}" | ||
| go build -trimpath -ldflags "-s -w" -o "${OUT}" ./cmd/shp | ||
|
|
||
| - uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: shp-${{ matrix.goos }}-${{ matrix.goarch }} | ||
| path: dist/shp-${{ matrix.goos }}-${{ matrix.goarch }} | ||
|
|
@@ -53,9 +53,9 @@ jobs: | |
| needs: build | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
|
|
||
| - uses: actions/download-artifact@v8 | ||
| with: | ||
| path: dist | ||
| merge-multiple: true | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
actions/checkout v6 release notes breaking changes💡 Result:
The release of actions/checkout v6 does not introduce breaking changes that require modifications to existing workflow YAML files [1][2]. Users can continue to use the action as they did with previous versions [1]. Key updates and requirements for v6 include: - Improved Credential Security: The persist-credentials feature has been updated to store credentials in a separate file under $RUNNER_TEMP instead of directly in the local.git/config file [1][2]. - Minimum Runner Version: When running authenticated git commands from within a Docker container action, the workflow requires an Actions Runner version of v2.329.0 or later to access these credentials correctly [1][2]. For context, v6 was released on November 20, 2025 [3]. As of June 3, 2026, the latest release is v6.0.3 [4].
Citations:
🌐 Web query:
actions/setup-go v6 release notes breaking changes💡 Result:
The release of actions/setup-go v6 introduced several breaking changes and updates to improve reliability and performance [1][2]. The primary breaking changes are as follows: Node.js Runtime Upgrade The action's underlying Node.js runtime was upgraded from Node 20 to Node 24 [1][3]. To ensure compatibility with this release, users must ensure that their GitHub Actions runners are on version v2.327.1 or later [1][2]. Enhanced Go Toolchain Management V6 improved Go toolchain handling to ensure more consistent version selection [1][2]. The action now correctly interprets both the
goandtoolchaindirectives fromgo.modfiles [3][4]. If atoolchaindirective is present, its version is used; otherwise, the action falls back to thegodirective [3][2]. This change may affect workflows where previous toolchain behavior relied on automatic downloads triggered bygocommands [5]. To manage this, the action sets theGOTOOLCHAINenvironment variable tolocal, preventing unexpected toolchain downloads during execution [5]. Cache Key Updates The default behavior for caching Go modules was updated [3][6]. Cache keys now rely ongo.modby default [3][2]. Additionally, cache keys now incorporate the version specified in thetoolchaindirective when present, which helps prevent cache conflicts when switching between different toolchain versions within the same Go minor release [4]. If users need to usego.sumfor caching, they must explicitly configure thecache-dependency-pathinput [3][2].Citations:
.github/workflows/ci.yml の actions/checkout@v6 / actions/setup-go@v6 互換性を確認（setup-go v6は破壊的変更あり）
actions/checkout@v6（12行目）: 既存workflow YAMLの修正が必要な破壊的変更は報告なし。ただしpersist-credentialsの挙動変更（$RUNNER_TEMP配下への分離）や、Docker内で認証git操作を行う場合は Runner v2.329.0+ が必要。actions/setup-go@v6（14行目）: 破壊的変更あり。Node実行環境が Node 20→24、必要Runner v2.327.1+。加えてgo/toolchain解釈とキャッシュキー（デフォルトでgo.mod依存、toolchain指定時はキャッシュキーに反映）の変更により、既存のキャッシュ設定・前提動作への影響があり得るため、ランナー要件とキャッシュ設定（cache-dependency-path等）を見直してから反映する。🧰 Tools
🪛 zizmor (1.25.2)
[warning] 12-12: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 12-12: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents