ci: bump actions/setup-python v4 -> v5 (clears the node16 runner deprecation) - #716
ci: bump actions/setup-python v4 -> v5 (clears the node16 runner deprecation)#716logbie wants to merge 1 commit into
Conversation
actionlint flags all five actions/setup-python@v4 uses with "the runner of ... is too old to run on GitHub Actions" (node16). v5.0.0 is a runner-only release (node16 -> node20) with no input or behaviour changes; all five call sites pass only python-version, so the bump is mechanical. Deliberately targets v5 rather than the current v7: v6.0.0 requires GitHub Actions runner >= v2.327.1 and every job here runs on Blacksmith runners whose agent version cannot be verified from the workflow side. v5 clears the deprecation with no runner-version dependency. After this change actionlint reports zero findings on the repository.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe CI and versioning workflows update all five ChangesPython setup action updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This change updates five CI workflow references from actions/setup-python@v4 to 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Updates GitHub Actions workflows to eliminate actionlint warnings caused by actions/setup-python@v4 running on the deprecated Node 16 runtime, by bumping those call sites to actions/setup-python@v5.
Changes:
- Bumped
actions/setup-pythonfrom@v4to@v5in all existing workflow call sites (5 total). - Left existing Python version pins unchanged (
'3.x'and the Windows-specific'3.12'pins).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/ci.yml |
Updates four actions/setup-python steps to @v5 for CI jobs that require Python. |
.github/workflows/versioning.yml |
Updates the version-bump workflow’s actions/setup-python step to @v5. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
CI is complete and fully green: 18 substantive checks pass, 2 skipped ( Closing the loop on the residual risk I flagged in the description — I could not run The bump is also validated on both platforms by the jobs that actually consume the action: Ready for review whenever you get to it. Not merging. Posted by the WFL repo warden (automated triage pass). |
|
Stale-PR check, 2026-08-18 warden pass — this is now ~48h idle with no blocker on it, so a nudge rather than a repeat of the readiness note above. Still green, still clean. Re-checked this morning: 18 checks pass, 2 skip ( Still the whole remaining actionlint surface. Merging this takes the repo to a clean actionlint run. New context that wasn't true at the last nudge: Next action: a maintainer merge. No code change is wanted here — the diff is four Posted by the WFL repo warden (automated triage pass). |
What and why
actionlintreports exactly five findings on this repository, and all five are the same one:actions/setup-python@v4runs on the node16 runner. This is a warning today, not a failure, but it is the kind of deprecation GitHub eventually force-migrates and then drops — at which point it turns into a redfmt/bump-version/database-testslane rather than a warning. This was flagged as a deferred item during the 2026-08-14 CI outage triage with the explicit condition "worth bumping to @v5 when CI can verify again". CI can verify again, so here it is.After this change
actionlintreports zero findings on the repository.Why v5 and not v7
actions/setup-pythonis currently at v7.0.0, so v5 is not the newest. That is deliberate:python-version, so this is genuinely mechanical.blacksmith-*-ubuntu-2404,blacksmith-*-windows-2025), and I cannot verify the Blacksmith agent version from the workflow side.pip-installinput (unused here).Jumping three majors to pick up features this repo does not use, while introducing an unverifiable runner-version dependency, is a worse trade than clearing the actual deprecation. Going to v6/v7 is a reasonable follow-up once someone confirms the Blacksmith agent version — happy to do that as a separate PR.
Changes
Five
uses:lines, two files, nothing else:.github/workflows/ci.yml.github/workflows/versioning.ymlThe two
python-version: '3.12'pins (ci.yml:225, :396) that exist because the Windows runner's default python predatestomllibare untouched and still needed.Test evidence
actionlint -no-coloronmain@36de4fa7→ 5 findings (quoted above). Same command on this branch → 0 findings.checker-unit-tests(ci.yml:43), the twointegration-testsmatrix lanes (ci.yml:211, :386),bump-version(ci.yml:666), andversioning.yml's bump job. Note the two integration lanes run the working-tree hygiene check that specifically needs Python 3.11+, so they exercise the pinned-version path, not just the'3.x'path.blacksmith-4vcpu-ubuntu-2404andblacksmith-4vcpu-windows-2025, so the bump is validated on Linux and Windows.scripts/check_repo_hygiene.pylocally because this sandbox has Python 3.10 and the checker requires 3.11+ (tomllib). CI runs it on both integration lanes. A workflowuses:bump has no path to affect repo-hygiene results, but I did not prove that locally. Please confirm the hygiene lane is green before merging.Not merging — warden branches always go back through review.
Opened by the WFL repo warden (automated triage pass).
Summary by CodeRabbit