ci: ilammy/msvc-dev-cmd is abandoned and is the last node20 action #317

What

ilammy/msvc-dev-cmd@v1 in .github/workflows/build-whisper-stt.yml is the last remaining node20 action in the repo, after #97 and #316 moved everything else to Node 24.

It is not fixable by bumping: upstream is abandoned.

• Last push to master: 2024-04-01
• master still declares using: node20 — there is no newer tag or branch to move to
• 28 open issues; two open PRs asking for Node 24 (#94, #99) sitting unmerged

Why it is not urgent

Today this is one cosmetic deprecation line. GitHub is still shimming node20 onto the Node 24 runtime.

Why it is not ignorable

When GitHub removes that shim, the action stops running entirely, and the Windows whisper-stt-server build breaks. That binary is bundled into the Windows installer by build.yml, so without it the installer ships with no speech-to-text.

The failure mode is at least benign: loud and immediate at the "Setup MSVC (Windows)" step, not a silent miscompile.

What to do when that happens

The step only sets up the MSVC environment for the Ninja/CMake build:

- name: Setup MSVC (Windows)
  if: matrix.os == 'windows-latest'
  uses: ilammy/msvc-dev-cmd@v1
  with:
    arch: x64

Options, roughly in order of preference:

1. Inline vcvarsall.bat — run it and export the resulting environment into $GITHUB_ENV. Self-contained, no third-party dependency. The cost is reimplementing the VS edition / architecture / toolset discovery the action does for us, so it needs care rather than a one-liner.
2. Switch the Windows build to CMake's Visual Studio generator instead of Ninja, which does not need vcvarsall at all. Bigger change to the build itself.
3. Pin a maintained fork — fastest, but takes on supply-chain risk for a build that produces a shipped binary.

This is testable before it breaks

build-whisper-stt.yml triggers on push with a paths filter that includes the workflow file itself, so any replacement can be validated by pushing it to a branch — no need to wait for a release or do it under pressure. (That is how the Node 24 sweep in #97 got its Windows job exercised.)

So: no rush, but no need to improvise it on the day either.