CI: bump actions off deprecated Node 20 runtime - #38
Merged
Conversation
actions/checkout@v3 and actions/setup-python@v3 in the publish workflow target Node 20, which GitHub now forces onto Node 24 and warns about. Bump to checkout@v5 / setup-python@v6 (Node 24 native). Also bring the other workflows up to date: test_urls.yml was still on checkout@v2 / setup-python@v2, and tj-actions/changed-files@v19 is well behind (v19 is within the tag range affected by the 2025 tag-rewrite compromise of that action).
shimwell
commented
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the
Node.js 20 is deprecatedannotation on the release workflow (run 32149295096).python-publish.ymlcheckout@v3,setup-python@v3checkout@v5,setup-python@v6test_urls.ymlcheckout@v2,setup-python@v2checkout@v5,setup-python@v6test_package.ymlcheckout@v4,setup-python@v5checkout@v5,setup-python@v6test_processing.ymlcheckout@v4,setup-python@v5,changed-files@v19checkout@v5,setup-python@v6,changed-files@v48changed-files@v19also falls inside the tag range affected by the 2025 tag-rewrite compromise of that action, so it was worth moving off regardless.Note: this does not fix the 2.5.0 release failure
The Node 20 message is only a warning — it did not fail the job. The
Build and publishstep failed on:after uploading ~210 MB. That is PyPI's 100 MB per-file limit. The bundled depletion chain XMLs now total 244 MB uncompressed:
The three
chain_endf_b8.1*.xmlfiles added since 2.4.2 are 27 MB each, which pushed the sdist/wheel past the cap. Fixing that needs a separate decision — either request a per-project size increase from PyPI, or stop shipping the chain XMLs in the package and fetch them viadownload_chaininstead. Happy to open a follow-up for whichever you prefer.