ci: trace DEP0005 Buffer deprecation in artifact download path

[seonghobae]

Observed warning

Central trusted coverage workflow .github@fb17ef556f94f673234aa557254ae52779e9a7b0 emitted Node [DEP0005] DeprecationWarning from process 2155 while actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c downloaded opencode-coverage-source (run 34695011182). Artifact SHA256 verification completed successfully; no coverage result impact was observed.

The captured log has no --trace-deprecation stack, so the exact package/function is unknown. Investigate by reproducing with Node trace-deprecation or inspecting the pinned action dependency tree, then assess an upstream action update. Do not suppress the warning without identifying the owner.

Target investigation date: 2026-09-13 KST.

[seonghobae]

RCA correction and bounded reproduction:

• Git tags confirm pinned 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c is both v8 and v8.0.1, the latest upstream release observed. The earlier suggestion to upgrade to a later release is withdrawn: no such verified consumer upgrade candidate exists.
• The lockfile path is unzip-stream@0.3.4 → binary@0.3.0 → buffers@0.1.1. A diagnostic copy extracted only the self-contained Buffers module; it did not execute the action entrypoint, network calls, token handling, or installed runtime.
• Under Node v24.16.0 with --trace-deprecation, an in-memory splice/slice fixture reproduces DEP0005 at Buffers.slice. Replacing numeric constructors with Buffer.alloc and the string constructor with Buffer.from in that diagnostic copy preserves splice, cross-buffer slice, and empty-slice outputs and emits no DEP0005. The original reproduction remains runnable with --original.
• This proves a concrete deprecated-call path in the dependency. It does not prove that this was the exact call executed in the original CI capture; that capture has no stack trace. Conditional proxy-auth and other parser constructors remain separate candidates.

Next owner action: trace the real artifact-download warning with deprecation stacks, repair the identified upstream source dependency and rebuild the action distribution, then adopt a reviewed immutable release and rerun the original artifact download/integrity validation. Do not patch generated dist in the consumer or suppress diagnostics. The issue remains unresolved, with the existing 2026-09-13 investigation/review target retained.

[seonghobae]

The same fast-mlsirm #1818 coverage run 34621596364 / check 103336781298 repeated Node [DEP0005] Buffer() at 2026-09-11T16:22:53.0448505Z. This is a recurrence in the captured diagnostic lane; it does not identify the exact artifact-download callsite. Preserve the existing request for stack-traced artifact-download reproduction and upstream dependency repair; do not suppress the warning.

[seonghobae]

Investigation-date check (2026-09-13), consumer side — no suppression, no change to the pinned action:

• Upstream already tracks this exact warning, four ways: v8 emits Node DEP0005 Buffer() deprecation warning on every download actions/download-artifact#484 (open, "v8 emits Node DEP0005 Buffer() deprecation warning on every download"), chore(deps): bump google-cloud-bigquery from 3.42.0 to 3.42.1 #327 and fix(opencode-review): cap context + fail fast to stop org-wide review hang #381 (open, older reports), and @actions/artifact: [DEP0005] DeprecationWarning caused when used in @actions/download-artifact actions/toolkit#2003 (open, @actions/artifact is the emitter when used by download-artifact). Root cause matches the RCA above: unzip-stream@0.3.4 → binary@0.3.0 → buffers@0.1.1; buffers calls new Buffer(...) in Buffers.slice/splice (visible in the pinned dist/index.js at ~L16638-16643, 15 new Buffer( sites total).
• No consumer upgrade exists today. npm: @actions/artifact latest is 6.2.1 and still depends on unzip-stream; unzip-stream latest is still 0.3.4 depending on binary ^0.3.0; binary and buffers were last modified 2022-11-11 (unmaintained). actions/download-artifact latest release is v8.0.1 = the SHA we pin. So the repair has to land in @actions/artifact (replace unzip-stream, or vendor a Buffer.from-based fork), then in a download-artifact release, before any pin bump here can remove the warning.
• Separate compliance angle worth an owner look: [@actions/artifact] Transitive dependency buffers has no declared license actions/toolkit#2392 reports that the same transitive buffers package declares no license. CWL's permissive-license convention (docs/CWL-MASTER-CONTEXT.md §7) is about what we add; this is a transitive dependency of a GitHub-owned action we consume, but it should be recorded rather than discovered later.

Next: subscribe-and-adopt — re-check actions/toolkit#2003 / download-artifact#484 for a released fix, then bump the pin in exact-artifact-sbom-attestation.yml (2 sites), opencode-review-dispatch.yml (1 site) and the two contract tests that pin the SHA, and re-run an artifact-download lane with NODE_OPTIONS=--trace-deprecation to confirm zero DEP0005. Internal next review date: 2026-09-27 (two weeks; no release cadence signal upstream yet). Kept open; not resolved.