.github: bump JavaScript actions to Node.js 24 runtimes#10689
Merged
Conversation
GitHub Actions now emits "Node.js 20 actions are deprecated" warnings: actions are forced to Node.js 24 by default starting 2026-06-16, and Node.js 20 is removed from the runners on 2026-09-16. Update every JavaScript action referenced by the workflows and the local composite actions to the lowest release that runs on Node.js 24: actions/checkout v4 -> v5 actions/checkout (SHA pin) v4.1.7 -> v5 actions/upload-artifact v4 -> v6 (v5 still Node.js 20) actions/download-artifact v4 -> v7 (v5/v6 still Node.js 20) actions/cache[/restore|/save] v4 -> v5 actions/setup-python v5 -> v6 actions/github-script v7 -> v8 docker/setup-buildx-action v3 -> v4 docker/build-push-action v5 -> v7 (v6 still Node.js 20) docker/login-action v3 -> v4 microsoft/setup-msbuild v2 -> v3 open-watcom/setup-watcom v0 -> v1 Actions already running on Node.js 24 (jwlawson/actions-setup-cmake, shogo82148/actions-setup-perl, msys2/setup-msys2, dorny/paths-filter) are left unchanged. These bumps are runtime-only; no workflow uses an input or output removed by the new majors, and v4-format artifacts remain compatible across the upload v6 / download v7 backends.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates GitHub Actions workflow dependencies to Node.js 24–compatible major versions in response to upcoming deprecation/removal of Node.js 20 runtimes on GitHub-hosted runners. This is a CI/automation maintenance change across the repository’s workflows and local composite actions.
Changes:
- Bump
actions/checkouttov5(including the SHA-pinned usage inwolfboot-integration.yml). - Bump artifact actions to
actions/upload-artifact@v6andactions/download-artifact@v7, plus cache actions toactions/cache@v5(andcache/{restore,save}@v5in the composite action). - Bump other JS actions to Node.js 24–capable majors (e.g.,
actions/setup-python@v6,actions/github-script@v8,docker/*majors,microsoft/setup-msbuild@v3,open-watcom/setup-watcom@v1).
Reviewed changes
Copilot reviewed 90 out of 90 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/zephyr.yml | Bump actions/checkout/upload-artifact to Node.js 24–compatible majors. |
| .github/workflows/zephyr-4.x.yml | Bump actions/checkout/upload-artifact to Node.js 24–compatible majors. |
| .github/workflows/xcode.yml | Bump actions/checkout to v5. |
| .github/workflows/wolfsm.yml | Bump actions/checkout to v5 and upload-artifact to v6. |
| .github/workflows/wolfCrypt-Wconversion.yml | Bump actions/checkout to v5 and upload-artifact to v6. |
| .github/workflows/wolfboot-integration.yml | Bump SHA-pinned actions/checkout to a v5 SHA; bump docker/login-action and upload-artifact. |
| .github/workflows/win-csharp-test.yml | Bump actions/checkout to v5 and microsoft/setup-msbuild to v3. |
| .github/workflows/watcomc.yml | Bump open-watcom/setup-watcom to v1, plus checkout/upload-artifact majors. |
| .github/workflows/tropic01-sim.yml | Bump checkout, docker/setup-buildx-action, and docker/build-push-action majors. |
| .github/workflows/trackmemory.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/tls-anvil.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/threadx.yml | Bump actions/cache to v5. |
| .github/workflows/symbol-prefixes.yml | Bump actions/checkout to v5. |
| .github/workflows/stunnel.yml | Bump upload-artifact to v6, download-artifact to v7, and checkout to v5. |
| .github/workflows/stsafe-a120-sim.yml | Bump checkout, docker/setup-buildx-action, and docker/build-push-action majors. |
| .github/workflows/stm32-sim.yml | Bump checkout, docker/setup-buildx-action, and docker/build-push-action majors. |
| .github/workflows/sssd.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/softhsm.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/socat.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/smoke-test.yml | Bump checkout to v5, actions/cache to v5, and upload-artifact to v6. |
| .github/workflows/smallStackSize.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/se050-sim.yml | Bump checkout, docker/setup-buildx-action, and docker/build-push-action majors. |
| .github/workflows/rng-tools.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/retrigger-prb-on-ready.yml | Bump actions/github-script to v8. |
| .github/workflows/python.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/puf.yml | Bump actions/checkout to v5. |
| .github/workflows/psk.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/pr-commit-check.yml | Bump actions/checkout to v5. |
| .github/workflows/pq-all.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/pic32mz-sim.yml | Bump checkout, docker/setup-buildx-action, and docker/build-push-action majors. |
| .github/workflows/pam-ipmi.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/packaging.yml | Bump actions/checkout to v5. |
| .github/workflows/os-check.yml | Bump checkout to v5, setup-python to v6, cache to v5, and upload-artifact to v6; bump setup-msbuild to v3. |
| .github/workflows/openvpn.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/opensslcoexist.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/openssl-ech.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/openssh.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/openldap.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/ocsp.yml | Bump actions/checkout to v5. |
| .github/workflows/ntp.yml | Bump checkout to v5, upload-artifact to v6, download-artifact to v7, and cache to v5. |
| .github/workflows/nss.yml | Bump checkout to v5 and actions/cache to v5. |
| .github/workflows/no-malloc.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/nginx.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/net-snmp.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/multi-compiler.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/multi-arch.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/msys2.yml | Bump actions/checkout to v5. |
| .github/workflows/msmtp.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/mosquitto.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/mono.yml | Bump actions/checkout to v5. |
| .github/workflows/memcached.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/membrowse-zephyr.yml | Bump actions/download-artifact to v7. |
| .github/workflows/mbedtls.yml | Bump actions/cache to v5 and actions/checkout to v5. |
| .github/workflows/linuxkm.yml | Bump actions/checkout to v5. |
| .github/workflows/libvncserver.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/libssh2.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/libspdm.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/krb5.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/jwt-cpp.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/ipmitool.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/intelasm-c-fallback.yml | Bump actions/checkout to v5. |
| .github/workflows/hostap-vm.yml | Bump checkout to v5, cache to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/haproxy.yml | Bump checkout to v5, cache to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/grpc.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/gencertbuf.yml | Bump actions/checkout to v5. |
| .github/workflows/freertos-mem-track.yml | Bump actions/checkout to v5. |
| .github/workflows/emnet-nonblock.yml | Bump actions/checkout to v5. |
| .github/workflows/docker-OpenWrt.yml | Bump checkout to v5, upload-artifact to v6, download-artifact to v7, setup-buildx to v4, and build-push to v7. |
| .github/workflows/docker-Espressif.yml | Bump actions/checkout to v5 across container jobs. |
| .github/workflows/disabled/hostap.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/disabled/hitch.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/disabled/haproxy.yml | Bump actions/checkout to v5. |
| .github/workflows/disable-pk-algs.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/cyrus-sasl.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/curl.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/cryptocb-only.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/coverity-scan-fixes.yml | Bump actions/checkout to v5. |
| .github/workflows/codespell.yml | Bump actions/checkout to v5. |
| .github/workflows/cmake.yml | Bump actions/checkout to v5. |
| .github/workflows/cmake-autoconf.yml | Bump actions/checkout to v5. |
| .github/workflows/check-source-text.yml | Bump actions/checkout to v5. |
| .github/workflows/check-headers.yml | Bump actions/checkout to v5. |
| .github/workflows/bind.yml | Bump checkout to v5, upload-artifact to v6, and download-artifact to v7. |
| .github/workflows/atecc608-sim.yml | Bump checkout, docker/setup-buildx-action, and docker/build-push-action majors. |
| .github/workflows/async.yml | Bump checkout to v5 and upload-artifact to v6. |
| .github/workflows/async-examples.yml | Bump actions/checkout to v5. |
| .github/workflows/arduino.yml | Bump actions/checkout to v5 and actions/cache to v5. |
| .github/workflows/ada.yml | Bump actions/checkout to v5. |
| .github/actions/install-apt-deps/action.yml | Bump actions/cache/{restore,save} to v5 inside the composite action. |
| .github/actions/ccache-setup/action.yml | Bump actions/cache to v5 inside the composite action. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
dgarske
reviewed
Jun 15, 2026
dgarske
left a comment
dgarske
left a comment
Member
There was a problem hiding this comment.
Skoll Code Review
Scan type: reviewOverall recommendation: COMMENT
Findings: 2 total — 2 posted, 0 skipped
1 finding(s) posted as inline comments (see file-level comments below)
Posted findings
- [Low] Verify the new SHA-pinned actions/checkout commit actually resolves to a v5 release tag —
.github/workflows/wolfboot-integration.yml:29,130,205,331,439 - [Info] Cross-workflow artifact pairing now spans upload-artifact v6 and download-artifact v7 —
.github/workflows/membrowse-zephyr.yml:51
Review generated by Skoll
JacobBarthelmeh
approved these changes
Jun 15, 2026
|
retest this please |
dgarske
approved these changes
Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions now emits "Node.js 20 actions are deprecated" warnings: actions are forced to Node.js 24 by default starting 2026-06-16, and Node.js 20 is removed from the runners on 2026-09-16. This updates every JavaScript action referenced by the workflows and the local composite actions to the lowest release that runs on Node.js 24:
actions/checkoutactions/checkout(SHA pin)actions/upload-artifactactions/download-artifactactions/cache[/restore|/save]actions/setup-pythonactions/github-scriptdocker/setup-buildx-actiondocker/build-push-actiondocker/login-actionmicrosoft/setup-msbuildopen-watcom/setup-watcomActions already running on Node.js 24 (
jwlawson/actions-setup-cmake,shogo82148/actions-setup-perl,msys2/setup-msys2,dorny/paths-filter) are left unchanged.These bumps are runtime-only; no workflow uses an input or output removed by the new majors, and v4-format artifacts remain compatible across the upload v6 / download v7 backends.