docs(ci): document benign SLSA generator annotations in release workflow - #378
docs(ci): document benign SLSA generator annotations in release workflow#378bomly-guy wants to merge 1 commit into
Conversation
The three warnings on provenance runs (two Node 20 deprecation notices and the go.sum cache-restore failure) all originate inside the pinned slsa-framework/slsa-github-generator@v2.1.0 reusable workflow, which is still its latest release. None are configurable from this repo; record the upstream tracking issues so they are not re-investigated. [skip release] Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe release workflow now documents known SLSA generator v2.1.0 annotations and lists upstream references. It also instructs maintainers to re-check the annotations after an upgrade. ChangesRelease workflow documentation
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Bomly Diff SummaryCompared Overview
Dependency Changes✅ No dependency changes. Vulnerabilities✅ No vulnerability changes. License Changes✅ No license changes. Project Posture✅ No project posture changes ( Policy Findings✅ No policy differences were identified. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 167-177: Update the workflow-level environment configuration in
release.yml to set FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 to true, then validate
both the release and provenance execution paths under Node 24 before merging.
Keep the existing generator annotation context, but do not defer this
compatibility check until a generator upgrade.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 1ca7de20-f2ac-4448-903e-83b04d1a7d28
📒 Files selected for processing (1)
.github/workflows/release.yml
| # Known benign annotations from this job (all internal to the generator at | ||
| # v2.1.0, its latest release — nothing here can configure them away): | ||
| # - "Node.js 20 is deprecated ... forced to run on Node 24": the | ||
| # generator's internal actions still declare node20; GitHub runs them | ||
| # on Node 24 anyway. Upstream migration is tracked in | ||
| # slsa-framework/slsa-github-generator#4490. | ||
| # - "Restore cache failed: Dependencies file is not found ... go.sum": | ||
| # the generator's own setup-go step enables caching but its builder | ||
| # checkout has no go.sum at the expected path. Tracked upstream in | ||
| # slsa-framework/slsa-github-generator#2863 (fix PRs #2864, #4441). | ||
| # Re-check both when bumping the generator past v2.1.0. |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/release.yml"
sed -n '145,185p' "$file"
printf '\nGenerator references:\n'
rg -n -C 2 'slsa-github-generator|v2\.1\.0|4490|2863|Node\.js 20|Node 24' .github/workflows "$file" 2>/dev/null || trueRepository: bomly-dev/bomly-cli
Length of output: 5337
🌐 Web query:
GitHub Actions Node 24 default June 16 2026 Node 20 removal fall 2026 official changelog
💡 Result:
As of August 11, 2026, the transition from Node.js 20 to Node.js 24 for GitHub Actions is in progress [1]. The key milestones and status are as follows: - Default Runtime Switch: As of June 16, 2026, GitHub Actions runners began using Node.js 24 as the default runtime [1][2][3]. - Node.js 20 Status: Node.js 20 reached end-of-life in April 2026 [1][3]. While it was replaced as the default on June 16, 2026, GitHub maintained temporary support to allow users to opt out using the environment variable ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true [1][4][3]. - Full Removal: Node.js 20 is scheduled for full removal from GitHub Actions runners in the fall of 2026 [1][3]. Once this occurs, the opt-out mechanism will no longer function [1]. Users are advised to update their actions to versions compatible with Node.js 24 [1][4]. Actions that still rely on Node.js 20 will trigger deprecation warnings during workflow execution [1][5]. If a workflow requires testing on Node.js 24 prior to the final removal, it can be forced by setting the environment variable FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true [1][4].
Citations:
- 1: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
- 2: Update Node 24 default date to June 16th, 2026 actions/runner#4462
- 3: [Due for payment 2026-06-16] [Due for payment 2026-06-12] [No QA] Migrate third-party GitHub Actions off deprecated node20/node16 runtimes Expensify/App#92208
- 4: Node.js 20 actions are deprecated podman-desktop/podman-desktop#17802
- 5: Add Node.js 20 deprecation warning annotation (Phase 1) actions/runner#4242
🌐 Web query:
slsa-framework slsa-github-generator issue 4490 Node 20 Node 24 v2.1.0
💡 Result:
Issue #4490 in the slsa-framework/slsa-github-generator repository tracks the necessary migration of internal actions from Node.js 20 to Node.js 24 [1]. This work is required because GitHub Actions deprecated Node.js 20, with a transition that forced Node.js 24 on runners in mid-2026 [1][2]. As of August 11, 2026, version v2.1.0 remains the latest release of slsa-github-generator [3][2][4]. This version relies on internal actions that use Node.js 20 [1]. Because these actions are bundled within the reusable workflows, callers cannot independently update them [2][4]. Users have reported that these workflows trigger Node.js 20 deprecation warnings and may fail or produce errors in environments where Node.js 20 is no longer fully supported or where Node.js 24 is strictly enforced [1][2]. Upstream progress on this migration has been stalled, with the repository experiencing reduced maintenance activity and an open, untriaged state for issue #4490 [2][4]. No official Node.js 24-compatible release has been published to date [2][4].
Citations:
- 1: chore: migrate internal actions from node20 to node24 ahead of June 2026 deprecation slsa-framework/slsa-github-generator#4490
- 2: SLSA provenance: standing on GitHub-native L2; SLSA-framework L3 parked (upstream dormant + locked) klarlabs-studio/mnemos#147
- 3: https://github.com/slsa-framework/slsa-github-generator
- 4: Watch: bump slsa-github-generator to a Node-24 release (upstream-gated) millsmillsymills/millsymills.com#661
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json, urllib.request
urls = [
"https://api.github.com/repos/slsa-framework/slsa-github-generator/issues/4490",
"https://api.github.com/repos/slsa-framework/slsa-github-generator/releases/latest",
]
for url in urls:
print(f"\n== {url} ==")
req = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "review-verifier"})
with urllib.request.urlopen(req, timeout=20) as response:
data = json.load(response)
for key in ("state", "title", "html_url", "created_at", "updated_at", "tag_name", "published_at"):
if key in data:
print(f"{key}: {data[key]}")
if "body" in data:
print("body:")
print(data["body"][:4000])
PYRepository: bomly-dev/bomly-cli
Length of output: 2529
🌐 Web query:
site:docs.github.com GitHub Actions FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION
💡 Result:
These environment variables are used to manage the transition of JavaScript-based GitHub Actions from Node.js 20 to Node.js 24 [1]. FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 This environment variable allows you to opt in to using the Node.js 24 runtime for JavaScript actions before it becomes the mandatory default [1]. You can set this variable to true at either the workflow level in your YAML file or as a system environment variable on a self-hosted runner to force the use of Node.js 24 [1][2]. Example workflow configuration: env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION This environment variable provides a temporary opt-out mechanism [1]. When Node.js 24 becomes the required default for JavaScript actions, setting this variable to true allows you to fall back to the older Node.js 20 runtime [1]. This is intended as a short-term workaround for compatibility issues while updating actions [1][3]. It is recommended to apply this at the workflow level, as it may not function correctly if set at the job or step level [4]. Migration Context GitHub is deprecating Node.js 20 in favor of Node.js 24 [1][3]. Using these variables helps manage the migration period, allowing users to test compatibility or maintain legacy workflows during the transition [1][5][2]. Users are encouraged to update their actions to versions that natively support Node.js 24 rather than relying indefinitely on these environment variables [1][3].
Citations:
- 1: Node 20 -> Node 24 migration feature flagging, opt-in and opt-out environment variables actions/runner#3948
- 2: ci: force Node.js 24 for JavaScript actions in all workflows stillwater-sc/universal#790
- 3: Bump node.js to v24 actions-js/push#29
- 4: Setting
ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSIONonly works at workflow (not job/step) level actions/runner#3370 - 5: ci(workflows): opt in to FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 for still-node20 actions kent8192/reinhardt-web#4126
Run a Node 24 compatibility check before merging.
GitHub-hosted runners now use Node 24 by default, and Node 20 support is scheduled for removal in fall 2026. slsa-framework/slsa-github-generator@v2.1.0 still uses internal Node 20 actions, and upstream issue #4490 remains open. Set FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true at workflow level and validate the release and provenance path now. Do not defer this check until a generator upgrade.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 167 - 177, Update the
workflow-level environment configuration in release.yml to set
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 to true, then validate both the release and
provenance execution paths under Node 24 before merging. Keep the existing
generator annotation context, but do not defer this compatibility check until a
generator upgrade.
1 participant
Summary
Run https://github.com/bomly-dev/bomly-cli/actions/runs/31546516949 surfaced 3 warning annotations, all from the
provenancejob. Investigation shows every one originates inside the pinnedslsa-framework/slsa-github-generator@v2.1.0reusable workflow, which is still the latest upstream release — nothing in our workflow can fix or suppress them:detect-workflow-js,compute-sha256,privacy-check, and its pinnedcheckout/setup-go/upload-artifact) still declarenode20; GitHub forces them onto Node 24, which works. Upstream migration is tracked in chore: migrate internal actions from node20 to node24 ahead of June 2026 deprecation slsa-framework/slsa-github-generator#4490.Restore cache failed: ... go.sum— the generator's ownsetup-gostep enables module caching, but its builder checkout has nogo.sumat the path it inspects. Purely a missed cache, not a failure. Tracked upstream in [bug] setup-go cache restore fails due to non-default path slsa-framework/slsa-github-generator#2863 (fix PRs #2864 and #4441, both still open).The generator must stay pinned to a full
vX.Y.Ztag forslsa-verifierbuilder-identity resolution, so we cannot pin to a fixed commit onmaineither. This PR records all of that as a comment on theprovenancejob so the annotations aren't re-investigated, with a reminder to re-check when bumping past v2.1.0.No behavioral change — comment only.
[skip release].🤖 Generated with Claude Code
Summary by CodeRabbit