From 3790c39c4045de8e4ad9ba11822a82699f6c22f1 Mon Sep 17 00:00:00 2001 From: WaylandYang Date: Sun, 2 Aug 2026 20:26:28 +0800 Subject: [PATCH 1/2] chore(ci): move actions to the Node 24 runtime GitHub is forcing Node 20 actions onto Node 24 and warning on every run: Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5 Bump every versioned action to its current major so the runtime is declared rather than coerced. actions/checkout v4 -> v7 actions/setup-node v4 -> v7 actions/setup-python v5 -> v7 astral-sh/setup-uv v6 -> v9 softprops/action-gh-release v2 -> v3 docker/setup-buildx-action v3 -> v4 docker/login-action v3 -> v4 docker/build-push-action v6 -> v7 Left alone deliberately: `dtolnay/rust-toolchain@stable` and `pypa/gh-action-pypi-publish@release/v1` are branch refs, not version tags, and `Swatinem/rust-cache@v2` is already current (v2.9.1). Checked the majors being crossed for behaviour changes beyond the runtime bump. Three could have bitten us and do not: - setup-node v7 removes the dummy NODE_AUTH_TOKEN export. publish-npm sets NODE_AUTH_TOKEN itself on the publish step, so the .npmrc reference still resolves. - setup-node v5/v6 changed automatic cache detection. Both call sites pass `cache: npm` explicitly, so the new default never applies. - setup-uv v8 dropped the old custom version-manifest format. Not used. One real behaviour change ships with this: setup-uv v9 enables caching by default, which is why upstream marked it breaking. It costs Actions cache storage on the two mcp-python legs. `enable-cache: false` restores the old behaviour if that is not wanted. actionlint reports no findings across all six workflows. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci-typescript.yml | 4 ++-- .github/workflows/ci.yml | 14 +++++++------- .github/workflows/publish-npm.yml | 4 ++-- .github/workflows/publish-pypi-mcp.yml | 4 ++-- .github/workflows/publish-pypi.yml | 4 ++-- .github/workflows/release.yml | 14 +++++++------- 6 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci-typescript.yml b/.github/workflows/ci-typescript.yml index 2c3cf25..64637a3 100644 --- a/.github/workflows/ci-typescript.yml +++ b/.github/workflows/ci-typescript.yml @@ -23,8 +23,8 @@ jobs: run: working-directory: sdk/typescript steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: ${{ matrix.node }} cache: 'npm' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 24be574..0dee01b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,7 +9,7 @@ jobs: rust: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@stable with: components: rustfmt, clippy @@ -28,8 +28,8 @@ jobs: # or daemon needed — the analyzer runs on synthetic event lists. runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: '3.12' - name: analyze.py unit tests @@ -48,8 +48,8 @@ jobs: # and the _send wire protocol against an in-process socket server. runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: '3.12' - name: install + pytest @@ -69,8 +69,8 @@ jobs: # Deliberately tracks the latest compatible 1.x as an early warning. - 'mcp>=1.2,<2' steps: - - uses: actions/checkout@v4 - - uses: astral-sh/setup-uv@v6 + - uses: actions/checkout@v7 + - uses: astral-sh/setup-uv@v9 - name: stdio handshake run: >- uv run --isolated --no-project diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index 1742d45..4632cb6 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -18,8 +18,8 @@ jobs: run: working-directory: sdk/typescript steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: '20' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/publish-pypi-mcp.yml b/.github/workflows/publish-pypi-mcp.yml index 52b9b2e..c78b84e 100644 --- a/.github/workflows/publish-pypi-mcp.yml +++ b/.github/workflows/publish-pypi-mcp.yml @@ -33,9 +33,9 @@ jobs: id-token: write # OIDC for Trusted Publishers contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: '3.12' diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index efb9773..c78f953 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -29,9 +29,9 @@ jobs: id-token: write # OIDC for Trusted Publishers contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: '3.12' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2eee753..11ab321 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,7 +40,7 @@ jobs: name: build binaries (x86_64-linux) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@stable @@ -61,7 +61,7 @@ jobs: sha256sum forkd-*.tar.gz > SHA256SUMS - name: Create / update GitHub Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: # Prefer the PAT so the `release: published` event fires # downstream workflows (publish-pypi.yml). Fall back to @@ -80,19 +80,19 @@ jobs: name: build + push Docker image runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@v4 - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build + push controller image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . file: Dockerfile @@ -123,7 +123,7 @@ jobs: # Python SDK publish for `v*` tags on the main package. if: startsWith(github.ref_name, 'v') steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Dispatch publish-pypi.yml env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 0d032dd7b4ad3552cf42887d38e88052b5ff77a2 Mon Sep 17 00:00:00 2001 From: WaylandYang Date: Sun, 2 Aug 2026 20:32:25 +0800 Subject: [PATCH 2/2] =?UTF-8?q?fix(ci):=20pin=20setup-uv=20to=20v9.0.0=20?= =?UTF-8?q?=E2=80=94=20no=20floating=20v9=20tag=20exists?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first attempt used `astral-sh/setup-uv@v9`, which failed to resolve: Unable to resolve action `astral-sh/setup-uv@v9`, unable to find version `v9` setup-uv published floating major tags through v7 but stopped from v8 onward — only exact `vX.Y.Z` tags exist now. Pin the exact release. Checked every other bumped ref against the GitHub refs API rather than assuming the major alias exists. All of them resolve, including the four in release.yml and the publish workflows that a pull request cannot exercise: action-gh-release@v3, docker/setup-buildx-action@v4, docker/login-action@v4, docker/build-push-action@v7. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0dee01b..4a6e43e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -70,7 +70,9 @@ jobs: - 'mcp>=1.2,<2' steps: - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v9 + # setup-uv stopped publishing floating major tags after v7, so this + # one is pinned to an exact release while the rest track majors. + - uses: astral-sh/setup-uv@v9.0.0 - name: stdio handshake run: >- uv run --isolated --no-project