ci(actions): update workflows for Node 24

[cv]

Summary

Updates GitHub Actions workflow dependencies that still ran on the deprecated Node.js 20 runtime. Pins the affected artifact, Docker, and path-filter actions to Node.js 24-compatible releases ahead of GitHub's runner runtime migration.

Changes

• Pin actions/upload-artifact usages to v7.0.1 and actions/download-artifact usages to v8.0.1 SHAs.
• Update docker/login-action, docker/build-push-action, and dorny/paths-filter to Node.js 24-compatible pinned releases.
• Verified all workflow and local composite action uses: entries, including nested composite actions, resolve to Node.js 24 or composite-only actions.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow dependencies to newer versions for improved security and compatibility across CI/CD pipelines.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 12a84fe7-b241-42c0-96c9-621cece28c1e

📥 Commits

Reviewing files that changed from the base of the PR and between 971c526 and d4cb832.

📒 Files selected for processing (13)

• .github/workflows/base-image.yaml
• .github/workflows/e2e-advisor.yaml
• .github/workflows/e2e-branch-validation.yaml
• .github/workflows/e2e-scenarios.yaml
• .github/workflows/macos-e2e.yaml
• .github/workflows/nightly-e2e.yaml
• .github/workflows/ollama-proxy-e2e.yaml
• .github/workflows/pr-review-advisor.yaml
• .github/workflows/pr-self-hosted.yaml
• .github/workflows/pr.yaml
• .github/workflows/regression-e2e.yaml
• .github/workflows/sandbox-images-and-e2e.yaml
• .github/workflows/wsl-e2e.yaml

---

📝 Walkthrough

Walkthrough

Fourteen GitHub Actions workflow files are updated to pin specific versions of Docker build actions (v4.1.0 and v7.2.0), artifact upload action (v7.0.1), artifact download action (v8.0.1), and path-filter action (v4.0.1) by replacing version tags with commit SHAs for reproducibility.

Changes

GitHub Actions Version Pinning

Layer / File(s)	Summary
Docker build actions upgrade .github/workflows/base-image.yaml	docker/login-action and docker/build-push-action are pinned to v4.1.0 and v7.2.0 respectively via commit SHAs for both base-image and Hermes base-image build jobs.
Path filter action upgrade .github/workflows/pr.yaml	dorny/paths-filter for pull request change detection is upgraded and pinned from v3 to v4.0.1 commit SHA.
Artifact upload actions across E2E workflows .github/workflows/e2e-advisor.yaml, e2e-branch-validation.yaml, e2e-scenarios.yaml, macos-e2e.yaml, nightly-e2e.yaml, ollama-proxy-e2e.yaml, pr-review-advisor.yaml, pr-self-hosted.yaml, regression-e2e.yaml, sandbox-images-and-e2e.yaml, wsl-e2e.yaml	actions/upload-artifact is consistently pinned to v7.0.1 commit SHA across all E2E and advisor workflows for failure artifact logging, replacing unpinned v4 references.
Artifact download actions in E2E test jobs .github/workflows/pr-self-hosted.yaml, sandbox-images-and-e2e.yaml	actions/download-artifact is pinned to v8.0.1 commit SHA in jobs retrieving sandbox test images and isolation images for E2E testing environments.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A rabbit hops through workflows with glee,
Pinning actions to versions they'll be,
Docker, uploads, and downloads aligned,
Reproducible CI, one commit at a time! ✨
Version tags traded for SHAs so fine.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title describes updating workflows for Node 24 compatibility, but the actual changes focus on pinning GitHub Actions versions and upgrading action versions for Node.js 24 compatibility—not updating workflows to use Node 24 itself.	Consider clarifying the title to better reflect the main change, such as 'ci(actions): pin GitHub Actions versions for Node.js 24 compatibility' to more accurately represent pinning and upgrading action versions.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/actions-node24

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

E2E Advisor Recommendation

Required E2E: None
Optional E2E: test-e2e-ollama-proxy, test-e2e-sandbox, test-e2e-gateway-isolation

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• None. No merge-blocking product E2E is recommended: the changes are CI workflow/action-pin updates and do not alter installer/onboarding logic, sandbox lifecycle code, credentials handling, network policy, inference routing, deployment assets, or real assistant user-flow implementation. Existing E2E runs would mostly re-test unchanged runtime behavior and would not directly validate most of the changed failure-artifact or publish-workflow steps.

Optional E2E

• test-e2e-ollama-proxy (low): Optional lightweight confidence because .github/workflows/pr.yaml is modified and this PR E2E job exercises the updated PR workflow checkout/setup path. It is not required for runtime coverage because no Ollama proxy or product code changed.
• test-e2e-sandbox (medium): Optional if maintainers want to validate self-hosted PR artifact upload/download and sandbox image E2E wiring after upload-artifact pin changes in PR/self-hosted and sandbox image workflows. Not merge-blocking for product behavior because sandbox Dockerfiles and tests were not changed.
• test-e2e-gateway-isolation (medium): Optional companion check for the sandbox image artifact path in the self-hosted workflow. Useful for workflow-infrastructure confidence, not required for runtime isolation because no gateway or sandbox isolation implementation changed.

New E2E recommendations

• workflow-infrastructure (medium): This PR changes many workflow action pins, especially upload-artifact steps that usually execute only on failure. Existing product E2E jobs do not directly verify that every modified workflow parses, that pinned action SHAs are valid, or that failure-artifact paths still upload correctly.
  • Suggested test: Add a lightweight workflow-infrastructure validation job that runs actionlint, verifies all pinned action SHAs resolve, and includes a controlled artifact upload/download smoke for the pinned actions/upload-artifact and actions/download-artifact versions.
• image-publishing-workflow (low): The base-image workflow updates docker/login-action and docker/build-push-action pins, but no existing PR E2E dry-runs the GHCR login/build-push workflow without pushing.
  • Suggested test: Add a base-image workflow dry-run E2E/smoke that builds Dockerfile.base with the pinned docker/build-push-action using push=false and validates metadata/tag generation without publishing.

[github-actions]

PR Review Advisor

Recommendation: blocked
Confidence: medium
Analyzed HEAD: d4cb8321892ced2a5bb96067f0a35a22a38c0605
Findings: 1 blocker(s), 2 warning(s), 1 suggestion(s)

This is an automated advisory review. A human maintainer must make the final merge decision.

Limitations: Review used the supplied trusted deterministic context and diff; I did not execute workflows, package-manager commands, tests, actionlint, or network lookups.; The diff was truncated after 160000 characters, so detailed per-line inspection of the tail of wsl-e2e.yaml and any omitted unchanged context is limited.; I did not independently verify that the pinned GitHub Action SHAs correspond to the intended upstream tags/releases or that their action.yml files declare Node 24 runtimes.; No linked issues were present, so acceptance coverage is based on PR body clauses and E2E Advisor comment evidence rather than issue acceptance criteria.; Optional E2E jobs were in progress in the supplied status rollup; their final outcomes were not available.

Workflow run

Full advisor summary

PR Review Advisor

Base: origin/main
Head: HEAD
Analyzed SHA: d4cb8321892ced2a5bb96067f0a35a22a38c0605
Recommendation: blocked
Confidence: medium

Workflow action-pin updates look narrowly scoped and mostly improve supply-chain pinning, but the PR is currently blocked by mergeStateStatus=BLOCKED/review required and lacks direct workflow-infrastructure smoke coverage for the new action pins.

Gate status

• CI: pass — 5 required status context(s) completed with no failures for head d4cb832: checks, commit-lint, dco-check, check-hash, changes. Non-required contexts still pending: 4; failed: 0.
• Mergeability: fail — GitHub GraphQL reports mergeStateStatus=BLOCKED and reviewDecision=REVIEW_REQUIRED for PR ci(actions): update workflows for Node 24 #4046 at head d4cb832.
• Review threads: pass — GraphQL reviewThreads.nodes is empty; trusted deterministic gate also noted no review thread state was available.
• Risky code tested: fail — Risky area detected: workflow/enforcement. The PR changes 13 workflow files and no test files; optional workflow-related E2E jobs were still in progress in the supplied status rollup.

🔴 Blockers

• PR is not currently mergeable: The repository merge gate is blocked despite required status checks passing. GraphQL reports mergeStateStatus=BLOCKED and reviewDecision=REVIEW_REQUIRED for this head SHA.
  • Recommendation: Wait for the required human review/branch-protection conditions to be satisfied before merging.
  • Evidence: pullRequest.graphQl.repository.pullRequest.mergeStateStatus=BLOCKED; reviewDecision=REVIEW_REQUIRED; gateStatus.mergeability evidence: mergeStateStatus=BLOCKED.

🟡 Warnings

• Workflow action upgrades lack direct workflow-infrastructure smoke coverage: The diff changes many trusted CI workflow dependencies, including upload/download artifact actions, Docker login/build actions, and dorny/paths-filter. Product E2E coverage does not directly prove that every modified workflow parses, that each pinned action SHA resolves, or that artifact upload/download failure paths still work.
  • Recommendation: Add or run a lightweight workflow-infrastructure validation that checks workflow syntax/actionlint, verifies pinned action SHAs resolve to the intended releases, and exercises a controlled upload-artifact/download-artifact round trip. For base-image, consider a non-pushing docker/build-push-action dry-run smoke.
  • Evidence: E2E Advisor comment recommends new workflow-infrastructure and image-publishing-workflow tests; deterministic testDepth verdict is e2e_required for workflow/runtime infrastructure paths; no test files changed.
• Optional E2E jobs relevant to changed workflows were not complete in the supplied status rollup: The E2E Advisor required no merge-blocking product E2E, but recommended optional test-e2e-ollama-proxy, test-e2e-sandbox, and test-e2e-gateway-isolation. The supplied check rollup shows these optional jobs still in progress, along with test-non-root-sandbox-smoke.
  • Recommendation: If maintainers rely on these optional checks for workflow-infrastructure confidence, wait for them to complete successfully for head d4cb832.
  • Evidence: E2E Advisor comment: Optional E2E: test-e2e-ollama-proxy, test-e2e-sandbox, test-e2e-gateway-isolation. GraphQL statusCheckRollup shows those three as IN_PROGRESS.

🔵 Suggestions

• Active overlapping PRs touch regression-e2e workflow (.github/workflows/regression-e2e.yaml): Trusted overlap data reports open PRs chore: bump OpenShell pin to 0.0.44 #3830 and chore: upgrade agent runtime dependencies #3925 also modify .github/workflows/regression-e2e.yaml. This PR's change is a narrow artifact-action pin, but the file overlap can create merge drift or conflict with active dependency/runtime work.
  • Recommendation: Before final merge, rebase or re-check regression-e2e.yaml against active PRs chore: bump OpenShell pin to 0.0.44 #3830 and chore: upgrade agent runtime dependencies #3925 to ensure the action pins are preserved and no workflow behavior is accidentally reverted.
  • Evidence: openPrOverlaps lists PR chore: bump OpenShell pin to 0.0.44 #3830 and PR chore: upgrade agent runtime dependencies #3925 with sameFiles: .github/workflows/regression-e2e.yaml.

Acceptance coverage

• partial — Updates GitHub Actions workflow dependencies that still ran on the deprecated Node.js 20 runtime.: Diff updates actions/upload-artifact, actions/download-artifact, docker/login-action, docker/build-push-action, and dorny/paths-filter pins. I did not independently verify each upstream action runtime metadata from repository contents only.
• met — Pin actions/upload-artifact usages to v7.0.1 and actions/download-artifact usages to v8.0.1 SHAs.: Diff replaces upload-artifact references across E2E/advisor workflows with actions/upload-artifact@043fb46 # v7.0.1 and download-artifact references in pr-self-hosted.yaml and sandbox-images-and-e2e.yaml with actions/download-artifact@3e5f45b # v8.0.1.
• met — Update docker/login-action, docker/build-push-action, and dorny/paths-filter to Node.js 24-compatible pinned releases.: base-image.yaml changes docker/login-action@v3 to docker/login-action@4907a6d # v4.1.0 and docker/build-push-action@v6 to docker/build-push-action@f9f3042 # v7.2.0. pr.yaml changes dorny/paths-filter from the v3 SHA to fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1.
• unknown — Verified all workflow and local composite action uses: entries, including nested composite actions, resolve to Node.js 24 or composite-only actions.: This is asserted in the PR body, but the supplied evidence only includes the changed diff and status contexts. No independent exhaustive resolution of all workflow/composite uses entries is available in the provided trusted context.
• met — No linked issues were found for this pull request.: github.linkedIssues is an empty array; CodeRabbit pre-merge checks also state the Linked Issues check was skipped because no linked issues were found.

Security review

• pass — 1. Secrets and Credentials: No new hardcoded production secrets were introduced in the diff. Existing workflows continue to reference GitHub-provided tokens and repository secrets via expressions such as secrets.GITHUB_TOKEN, secrets.NVIDIA_API_KEY, and github.token. Fake test tokens remain clearly labeled as fake in existing E2E environment values.
• pass — 2. Input Validation and Data Sanitization: No application input parsing or untrusted deserialization logic changed. The existing base-image workflow validation for inputs.openclaw_version remains an allowlist regex ([0-9]+(\.[0-9]+)*). The changes are action-version substitutions.
• pass — 3. Authentication and Authorization: No new endpoints or authorization logic changed. Workflow permission blocks appear unchanged in the diff; the base-image workflow still restricts package writes to the existing GHCR publishing jobs and gates jobs to github.repository == 'NVIDIA/NemoClaw'.
• warning — 4. Dependencies and Third-Party Libraries: The PR updates multiple third-party GitHub Actions dependencies. Pinning to full SHAs is a positive supply-chain control, but this review did not independently verify that each SHA belongs to the intended upstream release/tag or review upstream release notes/CVEs. This is especially relevant for workflow trusted-code boundaries.
• pass — 5. Error Handling and Logging: No logging logic materially changed except the action implementation used to upload failure artifacts. Existing failure-only artifact collection paths and if-no-files-found behavior are preserved.
• pass — 6. Cryptography and Data Protection: Not applicable — no cryptographic operations or data-at-rest/in-transit protection logic changed.
• warning — 7. Configuration and Security Headers: This is a workflow configuration change in security-sensitive CI paths, including workflows that handle secrets, package publishing, and self-hosted runner artifact handoff. The diff improves action pinning for several actions, but direct workflow parsing and action resolution smoke evidence is not present in the changed files.
• warning — 8. Security Testing: No tests were added or updated for the workflow dependency changes. The E2E Advisor found no required product E2E but suggested workflow-infrastructure and image-publishing workflow smokes; optional relevant E2E jobs were still in progress in the supplied rollup.
• warning — 9. Holistic Security Posture: The overall change likely improves supply-chain posture by moving major actions to SHA-pinned Node 24-compatible releases. Residual risk remains because workflow trusted-code boundaries, artifact exchange, GHCR publishing, and self-hosted runner paths are high impact and not directly validated by a dedicated infrastructure smoke in this PR.

Test / E2E status

• Test depth: e2e_required — Runtime/sandbox/infrastructure paths need real execution coverage: the PR changes 13 GitHub Actions workflows, including base-image publishing, E2E advisor, PR advisor, self-hosted sandbox image artifact upload/download, regression E2E, and sandbox images/E2E. Required status checks passed, but no test files changed and optional workflow-relevant E2E jobs were not complete in the provided rollup.
• E2E Advisor: ok

✅ What looks good

• The PR is tightly scoped to workflow action-version/pinning updates with no product runtime code changes.
• Most changed third-party actions are pinned by full commit SHA, improving reproducibility compared with mutable major-version tags.
• Required status contexts checks, commit-lint, dco-check, check-hash, and changes passed for the supplied head SHA.
• E2E Advisor ran successfully and found no merge-blocking product E2E requirement.
• No CodeRabbit actionable comments were generated, and GraphQL reviewThreads.nodes is empty in the supplied context.

Review completeness

• Review used the supplied trusted deterministic context and diff; I did not execute workflows, package-manager commands, tests, actionlint, or network lookups.
• The diff was truncated after 160000 characters, so detailed per-line inspection of the tail of wsl-e2e.yaml and any omitted unchanged context is limited.
• I did not independently verify that the pinned GitHub Action SHAs correspond to the intended upstream tags/releases or that their action.yml files declare Node 24 runtimes.
• No linked issues were present, so acceptance coverage is based on PR body clauses and E2E Advisor comment evidence rather than issue acceptance criteria.
• Optional E2E jobs were in progress in the supplied status rollup; their final outcomes were not available.
• Human maintainer review required: yes