fix(workflows): bump GitHub Actions off Node.js 20 runtime by yolabingo · Pull Request #67 · dotCMS/ai-workflows

yolabingo · 2026-08-28T14:48:35Z

Closes #68

actions/checkout, aws-actions/configure-aws-credentials, and astral-sh/setup-uv were all still pinned to Node 20-targeting majors, which GitHub now force-runs on Node 24 with a deprecation warning. Bumps them to their latest majors — checkout v7.0.1, configure-aws-credentials v6.2.3, setup-uv v10.0.1 — across all seven workflow files, including the SHA-pinned refs in autodoc-executor.yml.

Checked each major's breaking-change notes: none apply here (no boolean-style inputs to configure-aws-credentials, and setup-uv's v10 auto-cache change only affects enable-cache: auto, not the enable-cache: true used in this repo). Verified with actionlint (docker rhysd/actionlint:1.7.7) — clean.

After merge:

git checkout main && git pull
git tag v3.5.1
git push origin v3.5.1
git tag -f v3 main
git push --force origin v3

actions/checkout, aws-actions/configure-aws-credentials, and astral-sh/setup-uv were all still pinned to Node 20-targeting majors, which GitHub now force-runs on Node 24 with a deprecation warning. Bump to their latest majors (checkout v7, configure-aws-credentials v6, setup-uv v10), including the SHA-pinned refs in autodoc-executor.yml. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

github-actions · 2026-08-28T14:48:53Z

🤖 Bedrock Review — `qwen.qwen3-next-80b-a3b`

New Issues

🟡 Medium: .github/workflows/autodoc-executor.yml:73 — Pinning GitHub Actions to exact SHAs (8ade135... → 3d3c42e...) was replaced with version tags (v4.2.2 → v7.0.1). This introduces non-idempotent behavior: version tags are mutable and may break reproducibility. Assumption: CI/CD pipelines require deterministic action versions. What to verify: Are these workflows expected to be reproducible across environments? If yes, this is a risk.
🟡 Medium: .github/workflows/bedrock-generic-executor.yml:99 — Same as above: actions/checkout@v4 → v7 breaks reproducibility. Assumption: These workflows are production-critical and require version pinning. What to verify: Is there a policy requiring SHA-based pins for production workflows?
🟡 Medium: .github/workflows/bedrock-harness-executor.yml:153 — Same as above: actions/checkout@v4 → v7 and astral-sh/setup-uv@v6 → v10. Version drift may cause inconsistent environment setup. Assumption: Harness execution depends on stable tool versions. What to verify: Are uv and checkout versions locked for consistency across runs?
🟡 Medium: .github/workflows/claude-executor.yml:120 — actions/checkout@v4 → v7 and configure-aws-credentials@v4 → v6. Risk of breaking changes in action behavior (e.g., auth, checkout semantics). Assumption: AWS OIDC auth or checkout behavior is sensitive to action version. What to verify: Are there known breaking changes between v4 and v7 of checkout or v4 and v6 of AWS credentials action?
🟡 Medium: .github/workflows/codex-executor.yml:155 — Same as above: actions/checkout@v4 → v7, configure-aws-credentials@v4 → v6, setup-uv@v6 → v10. No version pinning → non-reproducible CI. Assumption: These workflows are used in production deployments. What to verify: Is there a documented policy requiring SHA pins over version tags?
🟡 Medium: .github/workflows/deployment-guard.yml:179 — actions/checkout@v4 → v7. Fetch-depth:0 implies full repo clone — behavior may change between versions. Assumption: Full clone behavior is critical for file detection. What to verify: Does v7 preserve fetch-depth:0 semantics identically to v4?
🟡 Medium: .github/workflows/deployment-guard.yml:269 — Same as above: actions/checkout@v4 → v7. Risk of inconsistent file detection logic. Assumption: Deployment guard relies on exact file listing behavior. What to verify: Is the file listing behavior of actions/checkout@v7 identical to v4 under fetch-depth:0?
🟡 Medium: .github/workflows/tests.yml:17 — actions/checkout@v4 → v7. No fetch-depth specified — default behavior may differ. Assumption: Test workflows depend on default checkout behavior. What to verify: Does v7 default to fetch-depth:1? If so, does that break tests expecting full history?
🟡 Medium: .github/workflows/tests.yml:27 — Same as above: actions/checkout@v4 → v7. No fetch-depth. Same risk as above. What to verify: Is the default checkout behavior in v7 compatible with test expectations?

Existing

No issues found.

Resolved

No issues found.

_{Run: #33182025240 · tokens: in: 3100 · out: 1338 · total: 4438}

yolabingo · 2026-08-28T14:50:36Z

The autodoc-executor.yml:73 finding is factually wrong: that line is still SHA-pinned (actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1), same pattern as before the change. The # v7.0.1 is a comment label next to the SHA, not a tag ref — no reproducibility regression there.

The other 8 findings are generic "assumption/what to verify" boilerplate with no cited breaking change. Before bumping, I checked each action's actual release notes for the major versions crossed:

actions/checkout v4→v7: v5 moved to Node 24 (needs runner ≥v2.327.1, which GitHub-hosted runners satisfy); v6/v7 changelogs show no fetch-depth or auth semantic changes.
aws-actions/configure-aws-credentials v4→v6: v5's breaking change is boolean-input handling (none of our usages pass boolean inputs — only role-to-assume/aws-region); v6 is the Node 24 bump.
astral-sh/setup-uv v6→v10: breaking changes are cache-pruning defaults and disabling enable-cache: auto on sensitive events — all workflows here set enable-cache: true explicitly, so unaffected.

No action needed.

…omments Semgrep github-actions-mutable-action-tag flagged 14 uses: refs pinned to mutable tags (checkout@v7, github-script@v7, configure-aws-credentials@v6, setup-uv@v10, claude-code-action@v1) across 6 workflows. Pin each to the resolved commit SHA with a version + release-URL comment, matching the convention already used in autodoc-executor.yml (also backfilled with URLs here per reviewer request). astral-sh/setup-uv@v10 turned out to be a nonexistent ref upstream (only v10.0.0/v10.0.1 tags exist) — pinned to v10.0.1 instead.

…g gotchas Codifies the pattern used in this PR's Semgrep fix: third-party uses: steps must pin full commit SHAs with a version + release-URL comment, plus how to resolve tags to SHAs and the GitHub tag-mutability pitfalls (dead major refs, annotated-tag dereferencing) hit while doing it.

github-actions · 2026-08-28T16:46:47Z

🤖 Bedrock Review — `qwen.qwen3-next-80b-a3b`

New Issues

🟡 Medium: .github/workflows/autodoc-executor.yml:73 — Replaced SHA pin with version tag v7.0.1, introducing non-reproducible CI behavior; version tags are mutable and may break consistency.
🟡 Medium: .github/workflows/bedrock-generic-executor.yml:99 — Replaced actions/checkout@v4 with v7, risking non-reproducible CI; version tags are mutable.
🟡 Medium: .github/workflows/bedrock-harness-executor.yml:153 — Replaced actions/checkout@v4 with v7 and setup-uv@v6 with v10; version drift risks inconsistent environment setup.
🟡 Medium: .github/workflows/claude-executor.yml:120 — Replaced actions/checkout@v4 with v7 and configure-aws-credentials@v4 with v6; may introduce breaking changes in auth or checkout behavior.
🟡 Medium: .github/workflows/codex-executor.yml:155 — Replaced actions/checkout@v4 with v7, configure-aws-credentials@v4 with v6, setup-uv@v6 with v10; non-idempotent CI risk.
🟡 Medium: .github/workflows/deployment-guard.yml:179 — Replaced actions/checkout@v4 with v7; fetch-depth:0 behavior may differ between versions, affecting file detection.
🟡 Medium: .github/workflows/deployment-guard.yml:269 — Same as above: actions/checkout@v4 → v7 risks inconsistent file listing under fetch-depth:0.
🟡 Medium: .github/workflows/tests.yml:17 — Replaced actions/checkout@v4 with v7 without fetch-depth; default behavior may have changed, breaking test assumptions.
🟡 Medium: .github/workflows/tests.yml:27 — Same as above: actions/checkout@v4 → v7 without fetch-depth risks inconsistent default behavior.

Existing

🟡 Medium: .github/workflows/autodoc-executor.yml:73 — Replaced SHA pin with version tag v7.0.1, introducing non-reproducible CI behavior; version tags are mutable and may break consistency.
🟡 Medium: .github/workflows/bedrock-generic-executor.yml:99 — Replaced actions/checkout@v4 with v7, risking non-reproducible CI; version tags are mutable.
🟡 Medium: .github/workflows/bedrock-harness-executor.yml:153 — Replaced actions/checkout@v4 with v7 and setup-uv@v6 with v10; version drift risks inconsistent environment setup.
🟡 Medium: .github/workflows/claude-executor.yml:120 — Replaced actions/checkout@v4 with v7 and configure-aws-credentials@v4 with v6; may introduce breaking changes in auth or checkout behavior.
🟡 Medium: .github/workflows/codex-executor.yml:155 — Replaced actions/checkout@v4 with v7, configure-aws-credentials@v4 with v6, setup-uv@v6 with v10; non-idempotent CI risk.
🟡 Medium: .github/workflows/deployment-guard.yml:179 — Replaced actions/checkout@v4 with v7; fetch-depth:0 behavior may differ between versions, affecting file detection.
🟡 Medium: .github/workflows/deployment-guard.yml:269 — Same as above: actions/checkout@v4 → v7 risks inconsistent file listing under fetch-depth:0.
🟡 Medium: .github/workflows/tests.yml:17 — Replaced actions/checkout@v4 with v7 without fetch-depth; default behavior may have changed, breaking test assumptions.
🟡 Medium: .github/workflows/tests.yml:27 — Same as above: actions/checkout@v4 → v7 without fetch-depth risks inconsistent default behavior.

Resolved

✅ .github/workflows/autodoc-executor.yml:73 — Pin now uses full SHA, not tag; comment correctly documents version.
✅ .github/workflows/bedrock-generic-executor.yml:99 — Pin now uses full SHA, not tag; comment correctly documents version.
✅ .github/workflows/bedrock-harness-executor.yml:153 — Pin now uses full SHA, not tag; comment correctly documents version.
✅ .github/workflows/claude-executor.yml:120 — Pin now uses full SHA, not tag; comment correctly documents version.
✅ .github/workflows/codex-executor.yml:155 — Pin now uses full SHA, not tag; comment correctly documents version.
✅ .github/workflows/deployment-guard.yml:179 — Pin now uses full SHA, not tag; comment correctly documents version.
✅ .github/workflows/deployment-guard.yml:269 — Pin now uses full SHA, not tag; comment correctly documents version.
✅ .github/workflows/tests.yml:17 — Pin now uses full SHA, not tag; comment correctly documents version.
✅ .github/workflows/tests.yml:27 — Pin now uses full SHA, not tag; comment correctly documents version.

_{Run: #33191558996 · tokens: in: 6248 · out: 1668 · total: 7916}

yolabingo · 2026-08-28T17:14:00Z

Re: the Bedrock review (qwen.qwen3-next-80b-a3b) — the "New Issues"/"Existing" sections contradict its own "Resolved" section below them. Both list the same 9 locations; Resolved confirms each is on a full SHA with a correct version comment, while New/Existing claim they were replaced with mutable tags (e.g. checkout@v4 → v7). That's not accurate.

Verified directly against the diff: every uses: for actions/checkout, aws-actions/configure-aws-credentials, astral-sh/setup-uv, actions/github-script, and anthropics/claude-code-action in this PR is pinned to a full 40-character commit SHA — none are on a bare tag.

$ grep -n "uses:.*checkout\|uses:.*configure-aws\|uses:.*setup-uv\|uses:.*github-script" \
    .github/workflows/*.yml | grep -v '@[0-9a-f]\{40\}'
(no output — nothing left unpinned)

No action needed on this batch of findings.

@v4

…6850) peter-evans/create-or-update-comment @v4 (node20) -> @v5.0.0 (node24), at both sites in issue_comp_link-issue-to-pr.yml. This was a scoping mistake, not a deferral. It was filed under "cold-path third-party actions" for #37194, but it runs on **every pull request** via `Add Issue to PR / link-issue`, so it kept AC-001 unsatisfied: the annotation scan on this PR still reported Node.js 20 is deprecated. ... peter-evans/create-or-update-comment@v4 The cause: the PR-pipeline surface was traced through cicd_1-pr.yml's job graph only. Other workflows also fire on `pull_request` -- issue_open-pr.yml (which calls this composite), the five ai_claude-* workflows, dotbot-review.yml and cicd_pr_skill-lint.yml -- and they were not walked. Safe: v5.0.0's release notes are dependency bumps only, and every input in use here (issue-number, comment-id, body, edit-mode) is still present in v5's action.yml. The `edit-mode: replace` guard against comment accumulation (issue #35794) is untouched. Remaining Node 20 annotations on this PR are NOT fixable from this repository: `Claude AI Orchestrator` and `Claude AI Rollback Safety Check` run dotCMS/ai-workflows' reusable workflows, addressed by dotCMS/ai-workflows#67. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

yolabingo · 2026-08-28T19:00:35Z

@sfreudenthaler I am unable to create or modify gh tags

yolabingo requested review from a team as code owners August 28, 2026 14:48

yolabingo requested a review from sfreudenthaler August 28, 2026 16:15

dotCMS deleted a comment from semgrep-dotcms Bot Aug 28, 2026

dotCMS deleted a comment from github-actions Bot Aug 28, 2026

erickgonzalez approved these changes Aug 28, 2026

View reviewed changes

yolabingo merged commit 23e7eda into main Aug 28, 2026
8 checks passed

yolabingo deleted the bump-gha-versions branch August 28, 2026 18:52

Navigation Menu

Uh oh!

fix(workflows): bump GitHub Actions off Node.js 20 runtime - #67

fix(workflows): bump GitHub Actions off Node.js 20 runtime#67
yolabingo merged 3 commits into
mainfrom
bump-gha-versions

yolabingo commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

yolabingo commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

yolabingo commented Aug 28, 2026

Uh oh!

Uh oh!

yolabingo commented Aug 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

yolabingo commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Bedrock Review — qwen.qwen3-next-80b-a3b

New Issues

Existing

Resolved

Uh oh!

yolabingo commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Bedrock Review — qwen.qwen3-next-80b-a3b

New Issues

Existing

Resolved

Uh oh!

yolabingo commented Aug 28, 2026

Uh oh!

Uh oh!

yolabingo commented Aug 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

yolabingo commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

🤖 Bedrock Review — `qwen.qwen3-next-80b-a3b`

github-actions Bot commented Aug 28, 2026 •

edited

Loading

🤖 Bedrock Review — `qwen.qwen3-next-80b-a3b`