ci: upgrade GitHub Actions to Node 24-compatible versions by andrewhsu · Pull Request #2511 · redpanda-data/console

andrewhsu · 2026-06-16T20:44:44Z

Summary

GitHub is deprecating Node 20 on Actions runners (Node 16 is already removed). Workflows pinned to actions running on those runtimes will eventually break. This PR upgrades the external actions in .github/workflows/ to a Node 24-supporting version — one commit per action, so each upgrade can be reviewed and reverted independently. Each commit body links to the upstream release notes and calls out any breaking change relevant to our usage.

Upgrades

Action	From	To
`actions/cache`	v4	v5
`actions/checkout`	v5	v6
`actions/github-script`	v7	v9
`actions/setup-node`	v4	v6
`actions/upload-artifact`	v4	v7
`arduino/setup-task`	v1	v2
`aws-actions/aws-secretsmanager-get-secrets`	v2	v3
`aws-actions/configure-aws-credentials`	v4	v6
`golangci/golangci-lint-action`	v8	v9
`peter-evans/repository-dispatch`	`@caebe2a7` (untagged ~v2.x)	v4

Notes

actions/checkout v5 → v6 — v5 already runs on Node 24, so this is a currency bump to the approved major, not a runtime change. v6 persists the auth token to a separate file instead of .git/config; our checkout/build steps don't read .git/config.
actions/github-script v7 → v9 — v9 makes the bundled packages ESM-only (require('@actions/github') stops working; getOctokit becomes an injected parameter). All five of our script: bodies use only the pre-injected github/context/core, so none are affected.
golangci/golangci-lint-action v8 → v9 — stays within the golangci-lint v2.x era; the v1→v2 binary fork happened at v7. We pin version: v2.10 and --config=.golangci.yaml, so neither the binary version nor the linter set changes.
peter-evans/repository-dispatch — was pinned to an untagged Node 16 commit (caebe2a7). Moved to the floating v4 tag (currently v4.0.1, Node 24); pinned to v4 rather than v4.0.0, whose action.yml declared the wrong Node version (fixed in v4.0.1). Our token / repository / event-type / client-payload inputs are unchanged.
- Supply-chain trade-off (deliberate): this swaps an immutable commit-SHA pin for a floating tag on the repo's one privileged cross-repo dispatch step (ACTIONS_BOT_TOKEN → console-enterprise). We accept the standard publisher-trust posture here for consistency with the rest of .github/workflows/ (every other action uses a floating major tag) and with verify_actions.py's approved v4 pin — and the prior SHA was itself stale (Node 16), not a current audited pin. If we want to harden later, the right move is to SHA-pin all third-party actions and add Dependabot/Renovate to surface upgrades, rather than singling out this one.

Out of scope / follow-up

arduino/setup-task — bumped v1 → v2 to get off the already-removed Node 16 runtime, but v2 runs on Node 20, not Node 24 — there is no Node 24 release yet. A further bump should follow once upstream ships one. (This is also why verify_actions.py still lists arduino/setup-task@v2 as unknown — the action isn't in the tool's allowed_actions map.)

Verification

verify_actions.py .github/workflows/ → all 41 version-mismatch violations resolved; the only remaining lines are the two arduino/setup-task@v2 unknown refs (explained above).
The diff is exclusively uses: version-string changes — no logic touched, and no new yamllint findings (repo has no yaml-lint CI).

Test plan

CI on this PR exercises the PR-/push-triggered workflows that use the upgraded actions (buf, proto-generate, backend-lint-test, frontend-verify, frontend-react-doctor).
Post-merge, confirm the event-gated workflows still work: changelog (tag push), repository-dispatch / enterprise-ci-skip (push), fork-pr-dispatch (fork PR workflow_run).

🤖 Generated with Claude Code

github-actions · 2026-06-16T20:45:08Z

The latest Buf updates on your PR. Results from workflow Buf CI / validate (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
`✅ passed`	`❌ failed (38)`	`✅ passed`	`✅ passed`	Jun 16, 2026, 8:45 PM

Updates 4 occurrences across 4 workflow files. v5 runs on Node 24; v4 runs on Node 20, which is being deprecated on GitHub Actions runners. The only change is the runtime bump -- no input or API changes. See https://github.com/actions/cache/releases/tag/v5.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Updates 9 occurrences across 4 workflow files. v5 and v6 both run on Node 24, so this is not a runtime change -- it aligns the pin with the current major. v6 persists the auth token to a separate file instead of .git/config; our checkout and build steps don't read .git/config, so the change is transparent. (buf.yml's checkout bump is handled separately in #2512.) See https://github.com/actions/checkout/releases/tag/v6.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Updates 5 occurrences across 4 workflow files. v9 runs on Node 24 (switched at v8); v7 runs on Node 20, which is being deprecated on GitHub Actions runners. v9 makes the bundled packages ESM-only: require('@actions/github') no longer works inside scripts, and getOctokit is now an injected parameter (redeclaring it with const/let throws). All of our scripts use only the pre-injected github, context, and core objects to call createCommitStatus / core.setOutput, so none are affected. See https://github.com/actions/github-script/releases/tag/v9.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

v6 runs on Node 24 (switched at v5); v4 runs on Node 20, which is being deprecated on GitHub Actions runners. v5+ adds automatic dependency caching (narrowed to npm in v6) when package.json declares a packageManager field. Our step sets only node-version and then installs a global npm package -- no project dependencies and no `cache:` input -- so the new auto-caching has no effect here. See https://github.com/actions/setup-node/releases/tag/v6.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Updates 3 occurrences in frontend-verify.yml. v7 runs on Node 24 (switched at v6); v4 runs on Node 20, which is being deprecated on GitHub Actions runners. v7 ships the action as ESM (internal to the action -- no effect on YAML usage) and adds an opt-in `archive` input. Our uploads pass only name / path / retention-days, and the matrix job already uses a unique artifact name per shard, so no input or behavior changes apply. See https://github.com/actions/upload-artifact/releases/tag/v7.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Updates 2 occurrences (backend-lint-test, proto-generate). v1 runs on Node 16, which has already been removed from GitHub Actions runners; v2 runs on Node 20. arduino/setup-task has no Node 24 release yet, so v2 is the newest available -- this gets the action off Node 16 now, and a Node 24 bump can follow once upstream ships one. The `version: 3.x` and repo-token inputs are unchanged between v1 and v2. See https://github.com/arduino/setup-task/releases/tag/v2.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Updates 4 occurrences across 4 workflow files. v3 runs on Node 24; v2 runs on Node 20, which is being deprecated on GitHub Actions runners. No input changes affect our usage (secret-ids + parse-json-secrets). (buf.yml's bump is handled separately in #2512.) See https://github.com/aws-actions/aws-secretsmanager-get-secrets/releases/tag/v3.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Updates 4 occurrences across 4 workflow files. v6 runs on Node 24; v4 runs on Node 20, which is being deprecated on GitHub Actions runners. Our usage only sets aws-region and role-to-assume (string inputs), so the v5 input-validation change (invalid booleans now throw instead of coercing to false) does not affect us. (buf.yml's bump is handled separately in #2512.) See https://github.com/aws-actions/configure-aws-credentials/releases/tag/v6.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

v9 runs on Node 24; v8 runs on Node 20, which is being deprecated on GitHub Actions runners. v8 -> v9 stays within the golangci-lint v2.x era -- the v1 -> v2 binary fork happened at v7, not here. Our step pins `version: v2.10` and an explicit `--config=.golangci.yaml`, so the action neither resolves a floating binary version nor changes the default linter set; this is a runtime-only bump for us. See https://github.com/golangci/golangci-lint-action/releases/tag/v9.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Updates 3 occurrences across 2 workflow files. The pinned commit (caebe2a7) is an untagged v2.x-era build that runs on Node 16, which has already been removed from GitHub Actions runners. v4 runs on Node 24. Pinned to the floating v4 tag (currently v4.0.1) rather than v4.0.0, whose action.yml declared the wrong Node version (fixed in v4.0.1). The token / repository / event-type / client-payload inputs we pass are unchanged. See https://github.com/peter-evans/repository-dispatch/releases/tag/v4.0.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Moved here from #2511 so that PR's checks stay green without re-triggering Buf CI. Bumps the external actions used in .github/workflows/buf.yml: - actions/checkout v5 -> v6 (3 occurrences) - aws-actions/configure-aws-credentials v4 -> v6 (2 occurrences) - aws-actions/aws-secretsmanager-get-secrets v2 -> v3 (2 occurrences) Same Node 24 rationale as the sibling per-action commits in #2511; no input changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

andrewhsu · 2026-06-17T02:08:13Z

i've moved buf.yml workflow changes off to a separate PR #2512 so those changes do not block this one from merging.

Moved here from #2511 so that PR's checks stay green without re-triggering Buf CI. Bumps the external actions used in .github/workflows/buf.yml: - actions/checkout v5 -> v6 (3 occurrences) - aws-actions/configure-aws-credentials v4 -> v6 (2 occurrences) - aws-actions/aws-secretsmanager-get-secrets v2 -> v3 (2 occurrences) Same Node 24 rationale as the sibling per-action commits in #2511; no input changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

andrewhsu mentioned this pull request Jun 16, 2026

ci: upgrade buf.yml actions to Node 24 and pin buf CLI to 1.65.0 #2512

Draft

3 tasks

andrewhsu and others added 10 commits June 16, 2026 14:17

andrewhsu force-pushed the ci/upgrade-actions-node24 branch from 1824d20 to 82f7df0 Compare June 16, 2026 21:17

andrewhsu marked this pull request as ready for review June 17, 2026 02:08

andrewhsu enabled auto-merge June 17, 2026 02:08

andrewhsu requested review from a team, PrzemekZglinicki, c-julin and malinskibeniamin and removed request for a team June 17, 2026 02:08

malinskibeniamin approved these changes Jun 18, 2026

View reviewed changes

andrewhsu merged commit b816313 into master Jun 18, 2026
15 checks passed

andrewhsu deleted the ci/upgrade-actions-node24 branch June 18, 2026 08:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: upgrade GitHub Actions to Node 24-compatible versions#2511

ci: upgrade GitHub Actions to Node 24-compatible versions#2511
andrewhsu merged 10 commits into
masterfrom
ci/upgrade-actions-node24

andrewhsu commented Jun 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

andrewhsu commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

andrewhsu commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Upgrades

Notes

Out of scope / follow-up

Verification

Test plan

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

andrewhsu commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

andrewhsu commented Jun 16, 2026 •

edited

Loading