From f5b67e66f48c81a13b252317eaf66bf700f1592c Mon Sep 17 00:00:00 2001 From: Devin Kees <6895754+djkees@users.noreply.github.com> Date: Tue, 22 Sep 2026 11:25:12 -0600 Subject: [PATCH 1/3] Bump actions/checkout and actions/setup-python to node24 versions (#299) GitHub removes the Node20 compatibility shim for Actions runners on 2026-09-23; actions/checkout@v4 and actions/setup-python@v5 still declare node20. Bump both to @v7 (latest stable) across all workflows, also resolving basic_build.yml's existing v4/v6 checkout inconsistency. Co-authored-by: Claude Sonnet 5 --- .github/workflows/basic_build.yml | 16 ++++++++-------- .github/workflows/docs.yml | 4 ++-- .github/workflows/publish_wheels.yml | 4 ++-- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/basic_build.yml b/.github/workflows/basic_build.yml index 1033533..23d1bc4 100644 --- a/.github/workflows/basic_build.yml +++ b/.github/workflows/basic_build.yml @@ -47,10 +47,10 @@ jobs: shell: bash steps: - name: Check out CEA - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: "3.12" @@ -241,10 +241,10 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Check out CEA - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: "3.12" @@ -283,10 +283,10 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Check out CEA - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: "3.12" @@ -406,11 +406,11 @@ jobs: shell: bash steps: - name: Check out CEA - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Check out GFE if: ${{ runner.os != 'Windows' }} - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: repository: Goddard-Fortran-Ecosystem/GFE path: extern/gfe diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index b4ee23f..3090ae8 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -14,8 +14,8 @@ jobs: build: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.12" diff --git a/.github/workflows/publish_wheels.yml b/.github/workflows/publish_wheels.yml index 21230a6..7540c8a 100644 --- a/.github/workflows/publish_wheels.yml +++ b/.github/workflows/publish_wheels.yml @@ -30,12 +30,12 @@ jobs: os: [ubuntu-22.04, macos-14, macos-15-intel, windows-2022] steps: - name: Check out CEA - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: submodules: recursive - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: "3.12" From 81b7e3a26a4da5d86ddc0339221828623d9c31ea Mon Sep 17 00:00:00 2001 From: Devin Kees <6895754+djkees@users.noreply.github.com> Date: Tue, 22 Sep 2026 11:51:13 -0600 Subject: [PATCH 2/3] Bump remaining node20-declaring actions to node24 versions (#301) A deep-dive audit of every action's own runs.using field (beyond the checkout/setup-python fix in #299) found five more actions still on node20: actions/upload-artifact, actions/download-artifact, actions/upload-pages-artifact, actions/deploy-pages, and softprops/action-gh-release. Bumps each to its first node24 release (v7, v8, v5, v5, v3 respectively). Verified via each release's changelog that none of these bumps change behavior for CEA's usage (no by-ID artifact downloads, no esoteric inputs affected). Co-authored-by: Claude Sonnet 5 --- .github/workflows/basic_build.yml | 8 ++++---- .github/workflows/docs.yml | 4 ++-- .github/workflows/publish_wheels.yml | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/basic_build.yml b/.github/workflows/basic_build.yml index 23d1bc4..64db2e1 100644 --- a/.github/workflows/basic_build.yml +++ b/.github/workflows/basic_build.yml @@ -212,7 +212,7 @@ jobs: ls -la build/source/bind/c/*cea_bindc* - name: Upload CLI executable artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: cea-cli-${{ matrix.label }} if-no-files-found: error @@ -223,7 +223,7 @@ jobs: build/trans.lib - name: Upload C ABI library artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: cea-bindc-${{ matrix.label }} if-no-files-found: error @@ -330,7 +330,7 @@ jobs: contents: write steps: - name: Download build artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: path: release-dist merge-multiple: false @@ -353,7 +353,7 @@ jobs: cat SHA256SUMS.txt - name: Publish GitHub release assets - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: files: release-assets/* generate_release_notes: true diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 3090ae8..69715f0 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -42,7 +42,7 @@ jobs: make html - name: Upload Pages artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@v5 with: path: docs/_build/html @@ -54,4 +54,4 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} steps: - id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v5 diff --git a/.github/workflows/publish_wheels.yml b/.github/workflows/publish_wheels.yml index 7540c8a..4038616 100644 --- a/.github/workflows/publish_wheels.yml +++ b/.github/workflows/publish_wheels.yml @@ -94,7 +94,7 @@ jobs: python -m build --sdist --outdir dist - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: dist-${{ matrix.os }} path: dist/* @@ -109,7 +109,7 @@ jobs: id-token: write steps: - name: Download artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: path: dist merge-multiple: true From 19714dcefd6239bf3a597ec1e537561666d966be Mon Sep 17 00:00:00 2001 From: Devin Kees <6895754+djkees@users.noreply.github.com> Date: Tue, 22 Sep 2026 11:58:54 -0600 Subject: [PATCH 3/3] Swap ilammy/msvc-dev-cmd for step-security's maintained node24 mirror (#302) ilammy/msvc-dev-cmd@v1 declares node20 with no newer release upstream (dead since April 2024). step-security/msvc-dev-cmd@v1 is a verified actively-maintained drop-in mirror (same inputs/usage) declaring node24. See nasa/cea#167 for the full node20 deadline context; this closes CEA's own direct exposure but not the one still baked into fortran-lang/setup-fortran@v1's internal pin. Co-authored-by: Claude Sonnet 5 --- .github/workflows/basic_build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/basic_build.yml b/.github/workflows/basic_build.yml index 64db2e1..18d06e7 100644 --- a/.github/workflows/basic_build.yml +++ b/.github/workflows/basic_build.yml @@ -453,7 +453,7 @@ jobs: - name: Set up MSVC toolchain (Windows MSVC/Intel) if: ${{ runner.os == 'Windows' && (matrix.toolchain.ccompiler == 'msvc' || matrix.toolchain.fcompiler == 'intel') }} - uses: ilammy/msvc-dev-cmd@v1 + uses: step-security/msvc-dev-cmd@v1 - name: Remove MinGW/MSYS paths for Windows Intel builds if: ${{ runner.os == 'Windows' && matrix.toolchain.fcompiler == 'intel' }}