Ekho-Labs / infrastructure-tf-kubernetes

PR #89 - Move pinned GitHub Actions to their Node 24 releases

1 file changed, 13 pin updates — .github/workflows/terraform.yml

SAFE TO MERGE Node 20 → Node 24 5 actions updated 1 action unexercised by PR CI

01 Overview

GitHub deprecated the Node 20 runtime for Actions. Every run of this repository's only workflow (.github/workflows/terraform.yml) emitted a warning that five actions declare node20 and were being force-run on Node 24. The pins were correct when written; the runtime moved underneath them. Once GitHub removes the compatibility fallback, actions still declaring node20 fail rather than warn.

The fix re-pins each affected action to a release whose action.yml declares using: node24, preserving the repo convention of a commit SHA pin plus a readable version comment so Renovate keeps tracking them.

Verbatim deprecation warning that motivated this PR

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout, actions/download-artifact, actions/github-script, hashicorp/setup-terraform. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

02 Pin Changes

Action Old SHA Old Ver New SHA New Ver Runtime Uses
actions/checkout 11bd71901bbe5b1630ceea73d27597364c9af683 v4.2.2 3d3c42e5aac5ba805825da76410c181273ba90b1 v7.0.1 node24 4
hashicorp/setup-terraform b9cd54a3c349d3f38e8881555d616ced269862dd v3.1.2 dfe3c3f87815947d99a8997f908cb6525fc44e9e v4.0.1 node24 4
actions/upload-artifact ea165f8d65b6e75b540449e92b4886f43607fa02 v4.6.2 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a v7.0.1 node24 2
actions/github-script 60a0d83039c74a4aee543508d2ffcb1c3799cdea v7.0.1 3a2844b7e9c422d3c10d287c895573f7108da1b3 v9.0.0 node24 2
actions/download-artifact d3f86a106a0bac45b974a628896c90dbdf5c8093 v4.3.0 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c v8.0.1 node24 1
aquasecurity/trivy-action ed142fd0673e97e23eac54620cfb913e5ce36c25 v0.36.0 UNCHANGED v0.36.0 n/a 1

Note: aquasecurity/trivy-action was already pinned to the exact commit behind its current release, so it is untouched.

03 Workflow Change Map

Trigger A: pull_request
Trigger B: push to main
Trigger C: workflow_dispatch
Artifact data flow (SHA-256 digest gate)
Exercised by PR CI
Not exercised (main/dispatch only)
pull_request
Trigger A
push to main
Trigger B
workflow_dispatch
Trigger C
security-check
Exercised
inline script only
terraform-static-checks
Exercised
checkout v7 setup-terraform v4 trivy-action v0.36.0
terraform-plan
Exercised
checkout v7 setup-terraform v4 upload-artifact v7 github-script v9
terraform-main-plan
Not exercised
checkout v7 setup-terraform v4 upload-artifact v7 github-script v9
terraform-apply
Not exercised
checkout v7 download-artifact v8 setup-terraform v4
GitHub Artifact Store
SHA-256 digest gate
cross-run by run-id

Blue edges: pull_request trigger — Green edges: push to main — Amber edges: workflow_dispatch — Red dashed: artifact data flow. Nodes with green border were exercised by CI run 31980969492; amber border nodes run only on main push or manual dispatch.

04 Breaking-Change Review

Filter: 5 of 5 visible
Condition Only affects workflows whose inline scripts call require(). Checked No script in this workflow uses require(); all five call sites use the injected github.rest.* client. Blast radius If it had applied: PR plan comments and the apply job's trusted-source verification would throw at runtime. Evidence CI run 31980969492 posted the plan comment successfully.
Condition Affects artifacts that are not standard zips, or whose hashes mismatch. Assessment The reviewed-plan artifact is an ordinary multi-file zip fetched cross-run by name, so it still decompresses; stricter integrity checking reinforces the existing SHA-256 digest gate. Residual risk This is the ONE bumped action NOT exercised by PR CI - it appears only in terraform-apply, which runs on manual dispatch. It stays unproven until the next apply.
Condition Input removals would break the workflow. Checked Both inputs used here (terraform_version, cli_config_credentials_token) still exist in v4.0.1. Evidence Terraform Init against Terraform Cloud succeeded in CI run 31980969492.
Condition v3-era artifacts are incompatible with v4+; uploads and downloads must sit on the v4+ backend. Checked upload v7 and download v8 both use the current artifact backend; every input used (name, path, if-no-files-found, retention-days, overwrite) still exists. Evidence CI produced artifact terraform-speculative-plan-08b448cd... at 2620 bytes.
Condition None identified; the only input used is ref. Checked ref still supported; no breaking notes apply to this usage.

05 Verification & Verdict

SAFE TO MERGE Note: download-artifact v8 is only exercised on the next apply
CI Jobs — Run 31980969492
Security Check Terraform Static Checks Terraform Plan Terraform Main Plan (skipped) Terraform Apply (skipped)
Node 20 deprecation warning
GONE
Zero annotations on run 31980969492
Previous runs 31976874720 and 31923166420 each carried the warning
actionlint
No new findings
One pre-existing SC2129 shellcheck style note, unrelated to this change
Terraform plan output
No changes
Your infrastructure matches the configuration.
Residual risk
download-artifact v8 unproven
Only exercised on next manual apply dispatch