From f7e144cfcbc6acf783ab9b86a15cc704ebfd4f95 Mon Sep 17 00:00:00 2001 From: Yannic Labonte Date: Mon, 18 May 2026 21:13:57 +0200 Subject: [PATCH] chore(node): drop Node 20; default to 24, test 22 + 24 Node 20 left LTS at end of April 2026. Drop it from the supported set: bump `engines.node` from `>=20.0.0` to `>=22.0.0`, switch every workflow's default Node from 20 to 24, change the CI test matrix from ['20','22'] to ['22','24'], and move the coverage-upload gate from `matrix.node == '20'` to `'24'`. Update CLAUDE.md / CONTRIBUTING.md / copilot-instructions.md prose from "Node 20+" to "Node 22+". The `npm install -g npm@latest` defensive step in release.yml stays, with its comment updated: Node 24 bundles npm 11.5+ already, so the upgrade is now belt-and-braces. Shipping as a minor, not a major. `engines` is advisory (npm warns but installs), no Node 22+ APIs are introduced in this release, and the package is too young for a 2.0.0 on a Node-support narrowing alone. The changelog entry captures the contract change in prose. --- .changeset/drop-node-20.md | 13 +++++++++++++ .github/copilot-instructions.md | 2 +- .github/workflows/ci.yml | 10 +++++----- .github/workflows/deploy-docs.yml | 2 +- .github/workflows/release.yml | 7 +++++-- .github/workflows/self-check.yml | 2 +- CLAUDE.md | 2 +- CONTRIBUTING.md | 2 +- package.json | 2 +- 9 files changed, 29 insertions(+), 13 deletions(-) create mode 100644 .changeset/drop-node-20.md diff --git a/.changeset/drop-node-20.md b/.changeset/drop-node-20.md new file mode 100644 index 0000000..e398ab2 --- /dev/null +++ b/.changeset/drop-node-20.md @@ -0,0 +1,13 @@ +--- +'github-actions-updater': minor +--- + +Drop Node 20 support; require Node 22+. + +Node 20 left LTS at the end of April 2026, so the project drops it from its supported runtimes. The CLI is now tested on Node 22 and Node 24, with Node 24 as the build/release default. `package.json`'s `engines.node` bumps from `>=20.0.0` to `>=22.0.0`. + +**What this means in practice:** the `engines` field is advisory — npm will print a warning when installing on Node 20 but will still complete the install. Configurations with `engine-strict=true` will refuse outright. The CLI itself uses no Node 22+ APIs in this release, so unaffected users on Node 20 are likely to keep working for a while — but any regression observed on Node 20 will not be treated as a bug, and CI will not catch one. + +**What to do if you're on Node 20:** upgrade your runner to Node 22 or Node 24. There are no source-level API changes in this release; the bump is policy-only. + +Why this isn't a major: the `engines` field is a soft contract, no runtime API changed, and the package is young enough that burning a 2.0.0 on a Node-support narrowing alone would make the version stream noisier than it needs to be. A loud changelog entry captures the contract change without committing the version number. diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 72ac3b0..f462f4b 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -8,7 +8,7 @@ guidance in the repo. Keep this file in sync whenever the workflow rules in ## What this project is A CLI (`ghau`) that scans `.github/workflows/*.{yml,yaml}` for outdated remote `uses:` -references and optionally rewrites them. TypeScript ESM, Node 20+, pnpm. Tested with +references and optionally rewrites them. TypeScript ESM, Node 22+, pnpm. Tested with Vitest, linted with ESLint strict-type-checked + unicorn, formatted with Prettier. ## Workflow rules diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ecd6e1e..93cec3c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v6 with: - node-version: 20 + node-version: 24 cache: pnpm - run: pnpm install --frozen-lockfile - run: pnpm lint @@ -36,7 +36,7 @@ jobs: - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v6 with: - node-version: 20 + node-version: 24 cache: pnpm - run: pnpm install --frozen-lockfile - run: pnpm typecheck @@ -47,7 +47,7 @@ jobs: strategy: fail-fast: false matrix: - node: ['20', '22'] + node: ['22', '24'] os: [ubuntu-latest, macos-latest, windows-latest] steps: - uses: actions/checkout@v6 @@ -59,7 +59,7 @@ jobs: - run: pnpm install --frozen-lockfile - run: pnpm test:coverage - name: Upload coverage - if: matrix.os == 'ubuntu-latest' && matrix.node == '20' + if: matrix.os == 'ubuntu-latest' && matrix.node == '24' uses: actions/upload-artifact@v7 with: name: coverage @@ -74,7 +74,7 @@ jobs: - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v6 with: - node-version: 20 + node-version: 24 cache: pnpm - run: pnpm install --frozen-lockfile - run: pnpm build diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml index 708dcdc..9409d58 100644 --- a/.github/workflows/deploy-docs.yml +++ b/.github/workflows/deploy-docs.yml @@ -26,7 +26,7 @@ jobs: - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v6 with: - node-version: 20 + node-version: 24 cache: pnpm - run: pnpm install --frozen-lockfile - run: pnpm docs:build diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index da68043..d58e8c4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -44,9 +44,12 @@ jobs: # dropping `registry-url:` costs nothing. - uses: actions/setup-node@v6 with: - node-version: 20 + node-version: 24 cache: pnpm - # npm 11.5+ is required for trusted-publishing OIDC. Node 20 ships with npm 10. + # npm 11.5+ is required for trusted-publishing OIDC. Node 24 ships with + # npm 11.5+ already, so this is defensive only — it keeps the release + # path resilient if the `node-version` above is ever downgraded to a + # release line that still bundles npm 10 (Node 22 does). - run: npm install -g npm@latest - run: pnpm install --frozen-lockfile # Inline CI gate: re-run the same checks the CI workflow does on push to diff --git a/.github/workflows/self-check.yml b/.github/workflows/self-check.yml index 37552d9..ae274af 100644 --- a/.github/workflows/self-check.yml +++ b/.github/workflows/self-check.yml @@ -20,7 +20,7 @@ jobs: - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v6 with: - node-version: 20 + node-version: 24 cache: pnpm - run: pnpm install --frozen-lockfile - run: pnpm build diff --git a/CLAUDE.md b/CLAUDE.md index 617e3f8..878fa9b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -9,7 +9,7 @@ the same rules every session. - **What it is.** A CLI (`ghau`) that scans `.github/workflows/*.{yml,yaml}` for outdated remote `uses:` references and optionally rewrites them in place. Think `ncu`, but for GitHub Actions. -- **Stack.** TypeScript ESM, Node 20+, pnpm. Vitest + `@vitest/coverage-v8`. ESLint +- **Stack.** TypeScript ESM, Node 22+, pnpm. Vitest + `@vitest/coverage-v8`. ESLint (strict-type-checked + unicorn) + Prettier. VitePress for docs. Changesets for releases. Targets `github-actions-updater` on npm; binary is `ghau`. - **Architecture.** `src/core/` (scanner, parser, comparator, resolvers, auth) is the diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index fb9cf41..790ae03 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -10,7 +10,7 @@ pnpm build pnpm test:coverage ``` -You need Node 20+ and pnpm 9+. +You need Node 22+ and pnpm 9+. ## Development loop diff --git a/package.json b/package.json index 33c9788..cf2ac8e 100644 --- a/package.json +++ b/package.json @@ -20,7 +20,7 @@ }, "type": "module", "engines": { - "node": ">=20.0.0" + "node": ">=22.0.0" }, "bin": { "ghau": "./dist/cli.js"