Release and Pages workflows still pin Node 20 actions after GitHub removed Node 20 (2026-09-23) (CR-A16-055) #116

Wave 0 · theme D0-8: Packaging and delivery promises · highest severity Low · 2 finding(s) · effort small

Summary

A Node-24 incompatibility in a node20-era artifact action breaks the dist hand-off between build and publish on the next tag, blocking the release.

Primary finding

CR-A16-055 — Release and Pages workflows still pin Node 20 actions after GitHub removed Node 20 (2026-09-23)

severity Low · reachability default · intent intended-but-harmful · confidence likely (static only) · single reviewer · reproduced (plumbing only)

What happens. upload-artifact@v5 and download-artifact@v5 declare using: node20 (ci.yml:149, nightly.yml:338, publish.yml:38,60,108,123). So do configure-pages@v5 and deploy-pages@v4 (site-deploy.yml:72,90). upload-pages-artifact@v3 (site-deploy.yml:75) is a composite that calls actions/upload-artifact@v4 (node20). pypa/gh-action-pypi-publish v1.14.0 (publish.yml:136) used setup-python v5.6.0 internally; v1.14.1 fixed this. GitHub's changelog of 2026-09-23 says Node 20 is no longer available, runners run JavaScript actions on Node 24, and the opt-out is gone. These steps now run on a runtime their releases did not target. Node-24 releases exist: checkout v7.0.1, setup-python v7.0.0, upload-artifact v7.0.1, download-artifact v8.0.1, configure-pages v6.0.0, upload-pages-artifact v5.0.0, deploy-pages v5.0.1, pypi-publish v1.14.2. checkout@v5, setup-python@v6 and github-script@v8 already declare node24.

Where.

• .github/workflows/publish.yml:38
• .github/workflows/publish.yml:60
• .github/workflows/publish.yml:136
• .github/workflows/site-deploy.yml:90
• .github/workflows/site-deploy.yml:75
• .github/workflows/ci.yml:149
• .github/workflows/nightly.yml:338

Evidence.

• using: read from each action.yml at the pinned ref (raw.githubusercontent.com). GitHub releases API latest tags. github.blog changelog 2025-09-19 (editor's note 2026-08-25) and 2026-09-23.

Recommended fix. Bump to the Node 24 releases (and pypi-publish to the v1.14.2 SHA) in one reviewed change.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

TECH-T12-002 — Supply-chain tooling, network dependencies and vulnerability scanning: GitHub Actions majors declaring node20: upload-artifact@v5, download-artifact@v5, configure-pages@v5, deploy-pages@v4, upload-pa…

severity Now

Item. GitHub Actions majors declaring node20: upload-artifact@v5, download-artifact@v5, configure-pages@v5, deploy-pages@v4, upload-pages-artifact@v3 (-> upload-artifact@v4) · verdict: deprecated-in-use · urgency: Now

State in ForgeLM. publish.yml:38,108 upload-artifact@v5 and :60,123 download-artifact@v5 (the dist hand-off into the PyPI publish job); ci.yml:149 and nightly.yml:338 upload-artifact@v5; site-deploy.yml:72,75,90 configure-pages@v5, upload-pages-artifact@v3, deploy-pages@v4. All tag-pinned.

State of the ecosystem on 2026-10-01. action.yml at each pinned major declares runs.using node20; upload-pages-artifact@v3 is composite and calls upload-artifact@v4 (node20). GitHub: from 2026-06-16 runners use Node 24 by default, with ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION as an opt-out 'until we upgrade the runner and remove Node20 on September 23rd, 2026'; on 2026-09-23 'Node 20 is no longer available on GitHub Actions runners. Runners now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no longer available', and users are told to update to versions that support Node 24. Latest majors (node24): upload-artifact v7.0.1 (2026-04-10), download-artifact v8.0.1 (2026-03-11), configure-pages v6.0.0 (2026-03-25), upload-pages-artifact v5.0.0 (2026-04-10), deploy-pages v5.0.1 (2026-09-01).

Impact. These actions now execute on a runtime they do not declare, and GitHub directs users to upgrade. The release path depends on them (dist upload/download between build, cross-os-tests and publish), as do the nightly scan artifacts and the Pages deploy; a Node 24 incompatibility would first surface on the next v* tag.

Recommendation. Bump to upload-artifact@v7, download-artifact@v8, configure-pages@v6, upload-pages-artifact@v5 and deploy-pages@v5, pinned by full SHA with version comments; review the intermediate majors' breaking notes; dry-run the release path and site-deploy before the next tag.

Sources.

• GitHub Changelog: Node 20 is no longer available in GitHub Actions (2026-09-23)
• GitHub Changelog: Deprecation of Node 20 on GitHub Actions runners (editor's notes to 2026-08-25) (2026-08-25)
• upload-artifact@v5 action.yml (node20) (tag v5 (retrieved 2026-10-01))
• download-artifact@v5 action.yml (node20) (tag v5 (retrieved 2026-10-01))
• configure-pages@v5 action.yml (node20) (tag v5 (retrieved 2026-10-01))
• upload-pages-artifact@v3 action.yml (composite -> upload-artifact@v4) (tag v3 (retrieved 2026-10-01))

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.
• The release note names the contract this fix restores.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}