Update GitHub actions to Node 24 by lawrencecchen · Pull Request #3210 · manaflow-ai/cmux

lawrencecchen · 2026-04-28T07:04:17Z

Summary

Bump pinned GitHub first-party JS actions to Node 24-compatible versions.
Bump release/upload actions used by nightly, release, and e2e flows to Node 24-compatible versions.
Pin the Claude workflow checkout action instead of using the moving v4 tag.

Testing

ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |f| YAML.load_file(f); puts "ok #{f}" }'
git diff --check
./tests/test_ci_self_hosted_guard.sh
./tests/test_ci_create_dmg_pinned.sh
./tests/test_ci_unit_test_spm_retry.sh
./tests/test_ci_scheme_testaction_debug.sh
./tests/test_ci_ghosttykit_checksum_present.sh
node scripts/release_asset_guard.test.js
go run github.com/rhysd/actionlint/cmd/actionlint@latest -ignore 'label "warp-macos-[^\"]+" is unknown' .github/workflows/*.yml

Notes

actionlint without the ignore only reports the repo's existing custom WarpBuild runner labels.

Summary by cubic

Update GitHub Actions to Node 24-compatible versions and pin SHAs for reproducible CI. Removes Node 20 deprecation warnings across nightly, release, e2e, macOS, and cloud workflows.

Dependencies
- Pin actions/checkout to v6.0.2 SHA across all workflows (including claude.yml).
- Bump actions/cache to v5.0.5.
- Bump actions/setup-go to v6.4.0.
- Bump actions/github-script to v9.0.0.
- Bump actions/upload-artifact to v7.0.1.
- Bump softprops/action-gh-release to v3.0.0.
- Pin oven-sh/setup-bun v2 to a Node 24-compatible SHA.

^{Written for commit 20bee78. Summary will update on new commits. Review in cubic}

Summary by CodeRabbit

Chores
- Updated CI/CD workflow actions across repository workflows (checkout, caching, language/tool setup, artifact uploads, and release tooling) to newer pinned revisions to keep build and release pipelines current and secure.

vercel · 2026-04-28T07:04:23Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cmux	Ready	Preview, Comment	Apr 28, 2026 7:25am
cmux-staging	Building	Preview, Comment	Apr 28, 2026 7:25am

coderabbitai · 2026-04-28T07:04:34Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 748afdca-830b-4404-aede-57ba11786f5c

📥 Commits

Reviewing files that changed from the base of the PR and between 0f49c11 and 20bee78.

📒 Files selected for processing (3)

.github/workflows/ci.yml
.github/workflows/cloud-vm-migrate.yml
.github/workflows/cloud-vm-smoke.yml

✅ Files skipped from review due to trivial changes (3)

.github/workflows/cloud-vm-smoke.yml
.github/workflows/cloud-vm-migrate.yml
.github/workflows/ci.yml

📝 Walkthrough

Walkthrough

This PR repins third-party GitHub Actions across multiple workflow files (notably actions/checkout → v6.0.2, actions/cache → v5.0.5, plus several other actions to newer versions). No workflow steps, inputs, or control flow were changed.

Changes

Cohort / File(s)	Summary
Checkout & Cache `.github/workflows/build-ghosttykit.yml`, `.github/workflows/ci-macos-compat.yml`, `.github/workflows/test-e2e.yml`	Pins `actions/checkout` to v6.0.2 and `actions/cache` to v5.0.5 where present.
Multi-job CI (checkout, cache, go) `.github/workflows/ci.yml`	Repins `actions/checkout`→v6.0.2, `actions/cache`→v5.0.5 and upgrades `actions/setup-go`→v6.4.0 across CI jobs.
Checkout-only updates `.github/workflows/claude.yml`, `.github/workflows/cloud-vm-migrate.yml`, `.github/workflows/cloud-vm-smoke.yml`, `.github/workflows/test-depot.yml`, `.github/workflows/update-homebrew.yml`	Updates `actions/checkout` to v6.0.2 with no other step changes.
Release / Nightly workflows `.github/workflows/release.yml`, `.github/workflows/nightly.yml`	Repins multiple actions: `actions/checkout`→v6.0.2, `actions/github-script`→v9.0.0, `actions/cache`→v5.0.5, `actions/setup-go`→v6.4.0, `actions/upload-artifact`→v7.0.1, `softprops/action-gh-release`→v3.0.0.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

codex

Poem

🐇 I hopped through YAML, a carrot in paw,

Checkout and cache got a neat little thaw.
Pins brushed to v6 and friends lined in rows,
CI hums softly as the night wind blows.
A celebratory thump—hip hop, here we go!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: updating GitHub Actions to Node 24-compatible versions across multiple workflows.
Description check	✅ Passed	The description includes Summary and Testing sections with specific details about changes and testing performed. However, it is missing Demo Video (marked N/A per PR type), Review Trigger checklist item, and explicit confirmation of checklist items.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch task-node24-github-actions

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

greptile-apps · 2026-04-28T07:06:54Z

Greptile Summary

This PR bumps all pinned GitHub first-party JS actions (checkout, cache, setup-go, github-script, upload-artifact) and third-party release actions (softprops/action-gh-release) to Node 24-compatible versions. It also converts the previously floating actions/checkout@v4 tag in claude.yml to a pinned SHA, which is a security improvement. All SHA hashes were verified against the GitHub Marketplace and release pages.

Confidence Score: 5/5

Safe to merge — purely a CI infrastructure version bump with no logic changes and all SHA hashes verified.

All action version bumps were verified against GitHub Marketplace and release pages. SHA hashes match the claimed tags. The claude.yml improvement from a floating tag to a pinned SHA reduces supply-chain risk. No workflow logic was changed and the PR author ran actionlint plus several test scripts against the updated files.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Bumps checkout (v4→v6.0.2), cache (v4→v5.0.5), setup-go (v5.5.0→v6.4.0) across all jobs; all SHAs verified
.github/workflows/nightly.yml	Bumps github-script (v7→v9.0.0), checkout, cache, setup-go, upload-artifact (v4→v7.0.1), softprops/action-gh-release (v2→v3.0.0)
.github/workflows/release.yml	Bumps github-script, checkout, cache, setup-go, upload-artifact, and softprops/action-gh-release to Node 24-compatible versions
.github/workflows/claude.yml	Replaces floating actions/checkout@v4 tag with a pinned SHA for v6.0.2 — a security improvement
.github/workflows/build-ghosttykit.yml	Bumps checkout and cache actions; straightforward Node 24 runtime upgrade
.github/workflows/ci-macos-compat.yml	Bumps checkout and cache (×3) to Node 24-compatible versions
.github/workflows/cloud-vm-migrate.yml	Bumps checkout (×3) to v6.0.2; no other action changes
.github/workflows/cloud-vm-smoke.yml	Bumps checkout to v6.0.2; single-step change
.github/workflows/test-depot.yml	Bumps checkout to v6.0.2; single-step change
.github/workflows/test-e2e.yml	Bumps checkout, cache, and upload-artifact to Node 24-compatible versions
.github/workflows/update-homebrew.yml	Bumps checkout to v6.0.2; single-step change

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[GitHub Actions Workflows] --> B[actions/checkout]
    A --> C[actions/cache]
    A --> D[actions/setup-go]
    A --> E[actions/github-script]
    A --> F[actions/upload-artifact]
    A --> G[softprops/action-gh-release]

    B -->|v4 SHA-pinned → v6.0.2 SHA-pinned| B2[Node 24 runtime]
    C -->|v4 → v5.0.5| C2[Node 24 runtime]
    D -->|v5.5.0 → v6.4.0| D2[Node 24 runtime]
    E -->|v7 → v9.0.0| E2[Node 24 runtime]
    F -->|v4 → v7.0.1| F2[Node 24 runtime]
    G -->|v2 → v3.0.0| G2[Node 24 runtime]

_{Reviews (1): Last reviewed commit: "Update GitHub actions to Node 24" | Re-trigger Greptile}

Update GitHub actions to Node 24

0f49c11

vercel Bot deployed to Preview – cmux April 28, 2026 07:08 View deployment

Update setup-bun Node 24 pin

20bee78

vercel Bot deployed to Preview – cmux April 28, 2026 07:25 View deployment

lawrencecchen merged commit b9c9c37 into main Apr 28, 2026
19 checks passed

lawrencecchen deleted the task-node24-github-actions branch April 28, 2026 07:33

Navigation Menu

Repository navigation

Update GitHub actions to Node 24 - #3210

Update GitHub actions to Node 24#3210
lawrencecchen merged 2 commits into
mainfrom
task-node24-github-actions

lawrencecchen commented Apr 28, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 28, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Suggested labels

Poem

Uh oh!

greptile-apps Bot commented Apr 28, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lawrencecchen commented Apr 28, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Notes

Summary by cubic

Summary by CodeRabbit

Uh oh!

vercel Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested labels

Poem

Uh oh!

greptile-apps Bot commented Apr 28, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lawrencecchen commented Apr 28, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Apr 28, 2026 •

edited

Loading

coderabbitai Bot commented Apr 28, 2026 •

edited

Loading