[Kartikey1306]

Update: #144 has merged, so this now applies directly to master — there is no longer a parent to merge first. The stacking note below predates that.

Stacked on #144 (origin/master does not pass its own checks without it, and this PR should not wear those reds). Review 9569226..c5111e5: one commit, 15 files, 69 uses: lines, nothing else. Land #144 first; this then rebases to its single commit.

Closes #168

Why now, precisely

Every job in this repository logs, on every run: "Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5, …" — 21 such warnings on a single ebuild run (35207728484).

GitHub's changelog (2025-09-19, editor's note of 2026-08-25), quoted: "Beginning on June 16th, 2026, runners will begin using Node24 by default"; the opt-out ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true "will only work until we upgrade the runner and remove Node20 on September 23rd, 2026." What the changelog does not say is whether a node20-declared action errors after the 23rd — today ours run on the forced Node 24 and pass. This PR does not claim they will break; it removes the dependence on a fallback GitHub calls temporary, six days before it ends.

What changed

69 uses: references in 15 files, each moved from a major whose action.yml declares node20 to the current major that declares node24 — pinned by commit SHA with the release tag in a comment (OpenSSF Pinned-Dependencies, the same form scorecard.yml already uses). Each SHA was resolved from the exact release tag through the GitHub API and confirmed identical to what the floating major tag points at:

action	pinned to	tag	runs.using
actions/checkout	3d3c42e	v7.0.1	node24
actions/configure-pages	45bfe01	v6.0.0	node24
actions/deploy-pages	368f825	v5.0.1	node24
actions/download-artifact	3e5f45b	v8.0.1	node24
actions/github-script	3a2844b	v9.0.0	node24
actions/setup-python	5fda3b9	v7.0.0	node24
actions/upload-artifact	043fb46	v7.0.1	node24
actions/upload-pages-artifact	fc324d3	v5.0.0	composite
github/codeql-action	b96794f	v4.38.0	composite
softprops/action-gh-release	efb3536	v3.0.3	node24

(upload-pages-artifact and codeql-action/codecov are composites; the first now wraps a SHA-pinned Node-24 upload-artifact, the others run Node-24 tooling.)

Breaking-change audit, per action, against this repository's actual usages

Read from each action's release notes at every major boundary crossed, then checked against every with: block here:

• download-artifact v4→v8 — v5 changed the extracted path for single artifacts downloaded by ID; every use here is by name: or by pattern: + merge-multiple: true, the cases the notes mark "no action needed". v8 defaults digest-mismatch to error (a corrupted download now fails instead of warning) — wanted.
• github-script v7→v9 — v9 breaks require('@actions/github'); the only script here uses the injected github/context objects and no require.
• codecov-action v4→v7 — v5 replaced the uploader with the CLI wrapper and deprecated file→files; usage here is files: + flags:, both still accepted.
• codeql-action v3→v4 — minimum bundle 2.19.4, met on hosted runners; init's languages/config-file inputs unchanged. The check name comes from this workflow's name: keys, not the action, so the required-check registry is unaffected — confirmed on this PR's run.
• configure-pages v4→v6 — v5's breaking changes concern Next.js static-export configuration; usage here passes no inputs.
• checkout v4→v7, setup-python v5→v7, upload-artifact v4→v7, cache v4→v6, deploy-pages v4→v5, action-gh-release v2→v3 — runtime-only majors; require runner ≥ 2.327.1, which every hosted image here (*-latest, ubuntu-22.04) meets. No self-hosted runner exists in this org (grepped all three repos).

Verification

Every file parsed before and after; the parsed structure asserted equal apart from uses: values — on: triggers, job names, job-level keys, step count and every non-uses step key identical; action names unchanged; line endings unchanged. Not yaml.safe_load succeeding — the assertion.

pytest 47 passed.

Which files this PR's own run exercises, and which it cannot:

file	uses: bumped	triggers	evidence
auto-assign.yml	1	pull_request	runs on this PR
book-build.yml	7	push, pull_request, release, workflow_dispatch	runs on this PR
build.yml	5	push, pull_request	runs on this PR
codeql.yml	3	push, pull_request, schedule	runs on this PR
deploy-pages.yml	4	push, workflow_dispatch	NOT RUN here — no pull_request trigger; first exercised by its own next push run after merge
eosim-sanity.yml	10	schedule, workflow_dispatch, pull_request	runs on this PR
nightly.yml	4	schedule, workflow_dispatch	NOT RUN here — no pull_request trigger; first exercised by its own next schedule run after merge
python-tests.yml	3	push, pull_request	runs on this PR
release.yml	14	push	NOT RUN here — no pull_request trigger; first exercised by its own next push run after merge
scorecard.yml	2	schedule, push, workflow_dispatch	NOT RUN here — no pull_request trigger; first exercised by its own next schedule/push run after merge
simulation-test.yml	5	schedule, workflow_dispatch, pull_request	runs on this PR
sync-release-branch.yml	1	push	NOT RUN here — no pull_request trigger; first exercised by its own next push run after merge
third-party.yml	2	push, pull_request, workflow_dispatch	runs on this PR
video-build.yml	4	push, release, workflow_dispatch	NOT RUN here — no pull_request trigger; first exercised by its own next push/release run after merge
weekly.yml	4	schedule, workflow_dispatch	NOT RUN here — no pull_request trigger; first exercised by its own next schedule run after merge

The NOT RUN rows are stated rather than implied: their first execution with these pins is their next scheduled/release/dispatch run after merge, and a failure there would be attributable to this change.

Deliberately not touched — 3 files, to keep the queue mergeable

These also carry Node-20 pins but are modified by open pull requests; bumping them here would put every one of those PRs into CONFLICTING. They follow in one commit once the PRs below land:

file	open PRs modifying it
ci.yml	#144, #151, #152, #154, #156, #158, #160, #163, #165
eos-simulation.yml	#152
upstream-drift.yml	#152

[Kartikey1306]

Run evidence for this head (c5111e5), per bumped file — 66 checks, 0 failing.

Exercised by this PR's own pull_request run, with the Node-24 pins in effect:

file	run	result
build.yml	35211501182	success
codeql.yml	35211501143	success — check names CodeQL and Analyze (C/C++) unchanged, matching the required-check registry, so #121's branch-protection instruction stays true
eosim-sanity.yml	35211501149	success
python-tests.yml	35211501187	success
simulation-test.yml	35211501193	success
third-party.yml	35211501289	success
auto-assign.yml	35211501115	NOT RUN — job skipped by design: its if: requires head.repo == github.repository, and this PR comes from a fork. The bumped github-script@v9 line was not executed; the audit (no require() in the script) is the evidence for it.
book-build.yml	—	NOT RUN — its pull_request trigger is path-filtered to docs/book/**, which this PR does not touch

ci.yml and eos-simulation.yml ran green too (35211501188, 35211501175) but are not changed by this PR — they are on the deferred list, still pinned to Node 20; their green is the forced-Node-24 fallback, not this change.

The remaining 7 bumped files (deploy-pages, nightly, release, scorecard, sync-release-branch, video-build, weekly) have no pull_request trigger: NOT RUN, first exercised by their own next run after merge.

No warning of the form "actions target Node.js 20" appears on any job of this run; the base's runs carry it on every job.

[srpatcha]

All 12 new SHA pins match their tags (checked with gh api). But the PR claims to pin every action, and 34 floating refs remain, including 10 in ci.yml (e.g. ci.yml:31 actions/checkout@v4, :172 upload-artifact@v4), the very Node-20 actions this PR targets. Others are in eos-simulation.yml (13), claude-code-review.yml (4), release.yml (3), upstream-drift.yml (3) and scorecard.yml (1). Please finish the pinning, or retitle and split.

[Aswin-V]

Daily-loop code review (the loop does review; not a merge).

Spot-verified the SHA pins: actions/checkout@3d3c42e5 resolves to the v7.0.1 tag commit, and actions/github-script@3a2844b7 resolves to the v9.0.0 tag commit (via the annotated tag object) — both match their # vX comments. The pinning approach is correct for the Node-24-forced era (immutable SHAs + human-readable version comments).

One scoping note: this PR pins eos's workflows to the new majors, which overlaps the org-wide Node-20 action-majors sweep that is currently awaiting Aswin's direction. If the sweep goes ahead org-wide, this PR's pins should be reconciled with whatever the sweep lands (same SHAs, ideally) rather than drifting. No action needed from the author — leaving the merge decision to the maintainers.

[srpatcha]

Pushed cfe8f23 (master merged in, claude-code-review.yml now gone): the remaining 30 floating refs are pinned by SHA, using the versions this PR already pins (checkout v7.0.1, upload v7.0.1, download v8.0.1, setup-python v7.0.0, gh-release v3.0.3), plus sbom-action v0.24.3, cosign-installer v3.10.1 (kept on v3; it is composite) and scorecard v2.4.4. SHAs were resolved with gh api. grep finds 0 non-SHA uses:; actionlint 1.7.12 passes.