Repository navigation
CI: upgrade upload-artifact pin for Node 24 runtime #2011
Description
Consumer evidence
ContextualWisdomLab/quarantine-sandbox-runtime root exact 7482108c0b74f58f447722a98330f9ad44215eec, native branch-coverage job 101640016078 in run 34089522598, executed actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 under the current GitHub-hosted Node 24 runtime.
The action completed its upload, but emitted all of the following current runtime warnings:
Node.js 20 is deprecated ... action targets Node.js 20 but [is] being forced to run on Node.js 24;[DEP0040] DeprecationWarning: The punycode module is deprecated;[DEP0169] DeprecationWarning: url.parse() behavior is not standardized and prone to errors that have security implications.
The quarantine runtime contract requires deprecation warnings to be root-caused rather than hidden. Do not use ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true as a workaround.
Owner action
Inventory the canonical reusable workflows and action-pin policy in .github, determine the latest reviewed immutable actions/upload-artifact SHA that natively targets the supported Node runtime, update the canonical owner once, and let thin consumers inherit it. Preserve exact-SHA pinning, artifact digest/provenance behavior, retention semantics and fail-closed upload errors. Add/adjust a reusable-workflow contract test so a Node-runtime-deprecated upload-artifact pin cannot silently return.
Acceptance
- Canonical
.githubworkflow uses an immutable reviewedactions/upload-artifactSHA with no Node 20 compatibility warning on current hosted runners. - Consumer exact-head run shows no
DEP0040,DEP0169, or forced-Node-24 warning from that action. - Artifact upload still succeeds with expected digest/name and failure behavior.
- No leaf repository suppresses the warning or locally forks the central workflow.
- Release/provenance consumers receive the owner release/version bump through their normal immutable dependency path.
Activity
seonghobae commentedon Sep 7, 2026
Fresh consumer evidence from
ContextualWisdomLab/quarantine-sandbox-runtimeroot exactc0839dc1a4eac69bf12dfd82777c2182e0b8769d, native CI34157422907confirms the deprecated action remains live after the prior specimen. Coverage job101852032799and branch-coverage job101852032932both successfully uploaded exact-head JSON artifacts, but GitHub forcedactions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02onto Node 24 and emitted the Node 20 deprecation warning plus runtimeDEP0040(punycode) andDEP0169(url.parse()) warnings. The uploaded artifacts werecoverage-json-c0839dc1a4eac69bf12dfd82777c2182e0b8769d(artifact10031465485, archive digestsha256:55310f871c1d53dcb5b6e01a0a61c1f88fcaf89c8b9b54d91f9e956e335ebf1a) andbranch-coverage-json-c0839dc1a4eac69bf12dfd82777c2182e0b8769d(artifact10031469433, archive digestsha256:1276584ddc5c4055a0d095050930845f43cdf4acbe085ec016dcfe0bb2adb875).Primary upstream authority now gives a concrete candidate for owner review: the latest
actions/upload-artifactrelease isv7.0.1, published 2026-04-10, targeting commit043fb46d1a93c77aae656e7c1c64a875d1fc6a0a; that exact commit'saction.ymldeclaresruns.using: node24. Please review and, if compatible with the canonical artifact/provenance semantics, pin that full SHA in the.githubowner workflow rather than suppressing warnings in leaf repositories. Consumer acceptance should require the same artifact name/digest/fail-closed upload behavior and absence of forced-Node-24,DEP0040, andDEP0169warnings on a fresh exact head.seonghobae commentedon Sep 8, 2026
Fresh quarantine-sandbox-runtime artifact-action specimen: exact child
4990976015c554df1cc485135dfa1d5e3a38e4ca, branch-coverage job101905358853, used pinnedactions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. Runner warned that this Node 20 action is being forced onto Node 24 and emitted DEP0040 (punycode) plus DEP0169 (url.parse()) deprecations while artifact10037275727uploaded successfully with digestsha256:41be203dce7d8588f2ab450cf63983a9f4053515afad35762e86bfcb466bc189. Leaf is not suppressing warnings or changing the central action pin; please preserve artifact name/digest/provenance semantics while updating the reusable owner path.seonghobae commentedon Sep 8, 2026
Fresh quarantine-runtime canary evidence, 2026-09-09 KST:
ContextualWisdomLab/quarantine-sandbox-runtime#104@d098385045cefd8b337ba2bd0069107a01756b81, native CI34259463376, branch-coverage job102173494703is GREEN but still runs localactions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02and emits the current forced-Node-24 / Node-20-target deprecation warning plus the downstreamDEP0040(punycode) andDEP0169(url.parse) warnings. The repository workflow still contains that exact v4 SHA in both production and branch coverage uploads.actions/upload-artifactnow publishesv7.0.1at immutable commit043fb46d1a93c77aae656e7c1c64a875d1fc6a0a; its currentaction.ymlexplicitly declaresruns.using: node24.This strengthens the existing owner-path repair: the warning is not an unavoidable runner transition anymore. Please evaluate/pin the reviewed Node-24-native upstream SHA centrally and keep thin consumers from carrying the old Node-20-targeting v4 pin. Do not use
ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSIONor a leaf suppression. After central integration, rerun an unchanged quarantine-runtime head and require the warning family to disappear while artifact digest/name/fail-closed behavior remains intact.seonghobae commentedon Sep 15, 2026
OriginWeave consumer evidence (exact executed head):
ContextualWisdomLab/OriginWeave@8ca6c5a190d9ad2b4c7843d440e91f6070d681c2, CI run34518871994, Production coverage job103011260864.The job executed
actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02on the GitHub-hosted Node 24 runtime and successfully uploaded exact coverage artifact10168907693(exact-coverage-8ca6c5a190d9ad2b4c7843d440e91f6070d681c2, zip digestsha256:6a189378c99a02081d4ecf04384ae72e3ef86df4c0817be67bba0c76adbd4c85). The action nevertheless emitted all three owner-path warnings already described by this issue:Node.js 20 is deprecated ... actions/upload-artifact@ea165f8d...and the action was forced onto Node 24;[DEP0040] DeprecationWarning: The punycode module is deprecated;[DEP0169] DeprecationWarning: url.parse() behavior is not standardized and prone to errors that have security implications.This is an independent OriginWeave reproduction, not a leaf-workflow repair request. OriginWeave should not suppress the warnings or locally repin/fork the canonical reusable workflow. The run also proves artifact creation/digest behavior currently succeeds despite the warnings, so the owner fix should preserve that behavior while replacing the deprecated action/runtime path. The artifact has since expired under its 3-day retention policy; the run/job identity and recorded digest remain the immutable receipt.
seonghobae commentedon Sep 15, 2026
Fresh affected-owner inventory:
.github#1857(the canonical reusable OriginWeave MV3 evidence workflow candidate) still carriesactions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02v4.6.2 in its workflow delta. That PR is currently open/Ready/mergeable=false on stale base7fd571d..., so its required non-force current-generation repair must also consume this #2011 action-runtime fix rather than transplanting the deprecated pin. Upstream exact043fb46d1a93c77aae656e7c1c64a875d1fc6a0awas re-read and itsaction.ymlexplicitly declaresruns.using: node24; adoption still requires the existing #2011 artifact name/digest/retention/fail-closed compatibility checks and a fresh consumer run with the Node20/DEP0040/DEP0169 warning family absent.seonghobae commentedon Sep 16, 2026
Fresh consumer evidence, 2026-09-16:
ContextualWisdomLab/quarantine-sandbox-runtimePR #125 predecessor exact98d1a6d7d604a53b75bfdf7559f770ad0cfee161, CI run35024452373, branch-coverage job104567978936executedactions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02and emitted all three owner-tracked warnings again: forced Node 20→24,[DEP0040] punycode, and[DEP0169] url.parse(). Artifact upload itself succeeded with SHA-256dcb4e05869bc78b3624d2230b1411898d83b7496d0d6363ad8031ddc8c479caf.The consumer's local CI still pins that older SHA. Fresh
.githubdefault-branch code search shows canonical workflows/tests now pinactions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1, but the.githubGitHub Release inventory is still empty. Under the versioned-owner contract, I am not copying the mutable central pin into the quarantine runtime as an ad-hoc leaf fix. This issue therefore still needs immutable owner publication/versioning (or another canonical immutable consumption path) plus a normal consumer bump before the warning is actually closed downstream.seonghobae commentedon Sep 16, 2026
Fresh consumer evidence, 2026-09-16:
ContextualWisdomLab/quarantine-sandbox-runtime#125exactf5b26660761a283d4dc9bf5b2c14947b51f4b946, CI35072937902, coverage job104718486946, again executed the pinnedactions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02on hosted Ubuntu 24.04 / Node 24 compatibility mode. Upload itself succeeded as artifact10444683520(coverage-json-f5b26660761a283d4dc9bf5b2c14947b51f4b946), SHA-25632c0546aae4a23c2d297e8465321a3f7f59016238eeadc7e31790c2b996d5142, then emitted the same three owner defects: forced Node 20→24 compatibility warning,[DEP0040]forpunycode, and[DEP0169]forurl.parse(). QSR is not suppressing these warnings and is not locally repinning/forking the action; current owner-path repair remains this central issue and its immutable publication/consumer bump acceptance.seonghobae commentedon Sep 19, 2026
Fresh consumer recurrence on
ContextualWisdomLab/quarantine-sandbox-runtime#6 exact7029537b2165c5ad0adf64183c0aa733257a5d4a, CI35389946520, branch-coverage job105745711351:actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02again emitted the forced-Node-24 warning plus[DEP0040] punycodeand[DEP0169] url.parse()while uploading artifactbranch-coverage-json-7029537.... This is the same canonical owner defect; no leaf suppression or local action-pin fork should be added.