fix(ci): correct Node-24 default-flip date to 2026-06-16 - #751
Merged
Conversation
GitHub revised the runner Node-24 default-flip date from 2026-06-02 to 2026-06-16 (changelog edited 2026-05-19, actions/runner#4462). Update the deploy.yml comment and the assert-slsa-pin-fresh.sh header, and document the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true opt-out that holds Node 20 until the fall-2026 hard removal. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
millsmillsymills
added a commit
that referenced
this pull request
Jun 23, 2026
ci-local.sh restated a "2026-06-02 deadline" string that drifted from the script's own DEADLINE constant (2026-09-16); PR #751 fixed the date in deploy.yml and the script but missed this echo. Make the echo defer to the script so the date lives in one place. Add an opt-in upstream check (MMS_CHECK_SLSA_UPSTREAM=true) that queries the releases API and flags when upstream cuts a release newer than the pinned one — the human-action trigger #661 waits on. Off by default so the lint stays offline and deterministic, matching the MMS_VERIFY_STATE_BUCKET opt-in pattern. Point LOCAL_ISSUE at #661 (supersedes #389). Refs #661 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
deploy.ymlandscripts/assert-slsa-pin-fresh.shcite a stale GitHub Node-24 default-flip date of2026-06-02. GitHub revised it to 2026-06-16 (changelog edited 2026-05-19; actions/runner#4462 bumped the runner's hardcoded fallback). Both spots now say 2026-06-16.Also documents the
ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=trueopt-out — the actual lever that keeps Node-20 actions on Node 20 between the soft flip and the fall-2026 hard removal (2026-09-16). The guardrail tripwire stays pinned to the hard-removal date, since the soft flip only auto-bumps the runtime and is reversible via the opt-out.Found by the multi-agent adversarial review sweep on #661.
Scope
deploy.yml. No workflow behavior change.assert-slsa-pin-fresh.sh: header comment + oneshfmt -ciline-continuation reformat (matches CI'sshfmt -ciinvocation). Logic unchanged.Verification
shellcheckclean,shfmt -ci -dcleanactionlint .github/workflows/deploy.ymlcleanbash scripts/assert-slsa-pin-fresh.sh→WARN ... 85 days until 2026-09-16(unchanged behavior)Refs #661.
🤖 Generated with Claude Code