Github actions failing after upgrading to node v20

Question

I'm trying to create a github workflow for my repo that is using supabase edge functions. The error I'm receiving is: Node.js 16 actions are deprecated. Please update the following actions to use Node.js 20: actions/checkout@v3, actions/setup-node@v3. For more information see: https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/.

I haven't set up a workflow before but I believe my workflow file is written correctly? I could be missing something really simple but haven't been able to find out what the issue is even after adding a specific version of node.

# .github/workflows/deploy-supabase-functions.yml
name: Deploy Supabase Functions

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    env:
      SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
      PROJECT_ID: ***

    steps:
      - uses: actions/checkout@v3
      - name: Use Node.js 20.x
        uses: actions/setup-node@v3
        with:
          node-version: 20.x

      - uses: supabase/setup-cli@v1
        with:
          version: latest

      - run: supabase functions deploy --project-ref ***

Answer 1

Your workflow is written fine -- the deprecation notice regarding node versions is with respect to the version of node that an action you're using is relying on. It has nothing at all to do with the version of node installed on the runner (unless you're self-hosting which you aren't), or that you're installing with the setup-node action.

If you have a look at the notice it's linking you to you'll see that "for users of actions" links you to an example of how to pick what version of an action you're running -- if you aren't sure, the part after the @ describes either a commit sha, a tag, or a branch name to pin to.

So in your uses: actions/checkout@v3 you're pinning to tag v3 of actions/checkout.

Or more specifically, tag v3 of the contents of the checkout repo owned by the user actions (at the repository root because there's no subdirectory specified), as specified in the actions.yml file at that tag and location in that repo.

If we have a look at the other link in that notice, namely, how to set the node runtime of a JS based action, we can see that the deprecation notice is with regards to the setting runs.using in the actions.yml file.

Knowing all those pieces, we can have a look at the actions you're using that you're getting those notices for.

actions/checkout@v3::action.yml::runs.using -- is node16. You'll need to update to v4 to be using a version of the action that uses node20.

Keep in mind that tags can be reassigned (and often are, such as a vX typically pointing to the latest vX.Y.Z), so tags and branches aren't immutable pins. At the time of writing, v3 pin in actions/checkout is the sha f43a0e5ff2bd294095638e18286ca9a3d1956744 and v4 is sha b4ffde65f46336ab88eb53be808477a3936bae11.

actions/setup-node@v3::action.yml::runs.using is also node16, with v4 having the node20 that you're after. At time of writing v3 is 1a4442cacd436585916779262731d5b162bc6ec7 and v4 is 60edb5dd545a775178f52524783378180af0d1f8.

Edit

How to pick what version of an action to update to? If we have a look at actions/checkout as an example, the broadest but not necessarily most accessible way of checking, is to navigate to the action.yml, and view the blame of the file, e.g. actions/checkout@main blame and navigate to the line that specifies using: nodeX and continue going "blame prior" until it's no longer node20, at that point if you go back one page it should show you the first commit on the trunk branch that had using: node20 e.g. we can see this commit on actions/checkout was the one that set the using: field to node20, so theoretically any commit after that point should be fine to use.

However, although pinning an action to a specific sha is advised for security reasons, it's also advised to not just pick any old commit (unless you're confident you know what you're doing). The better option for finding what version tag to use is to browse the tags of the repo, which can be navigated between by clicking the button on the top left above the list of files in the root of the repo, which will give you the option to Switch branches/tags. Whilst it is possible for a repo to follow a pattern of diverging branches for major versions, and thus have a fix for something like this on multiple major branches, at least, at the time of writing, the actions/checkout repo doesn't do this. If we look at the most recent "v3" tag, v3.6.0, we can see it's still using node16, and the very first "v4" tag v4.0.0 is using node20. It's simply a matter of looking to see which tag(s) have the fix you're after, and in this case, all the "v4" tags onwards use node20.

Answer 2

TLDR; use actions/checkout@v4 for node20

For example

name: Mdbook build

on:
  push:
    branches: ["main"]

jobs:
  build:
    name: build
    runs-on: ubuntu-latest
    env:
      MDBOOK_VERSION: "0.4.22"
      MDBOOK_LINKCHECK_VERSION: "0.7.4"
      MDBOOK_MERMAID_VERSION: "0.12.2"
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - name: Install mdbook
        run: |
          mkdir ~/tools
          curl -L https://github.com/rust-lang/mdBook/releases/download/v$MDBOOK_VERSION/mdbook-v$MDBOOK_VERSION-x86_64-unknown-linux-gnu.tar.gz | tar xz -C ~/tools
          curl -L https://github.com/badboy/mdbook-mermaid/releases/download/v$MDBOOK_MERMAID_VERSION/mdbook-mermaid-v$MDBOOK_MERMAID_VERSION-x86_64-unknown-linux-gnu.tar.gz | tar xz -C ~/tools
          curl -L https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases/download/v$MDBOOK_LINKCHECK_VERSION/mdbook-linkcheck.v$MDBOOK_LINKCHECK_VERSION.x86_64-unknown-linux-gnu.zip -O
          curl -L https://github.com/gist-rs/mdbook-svgbob/releases/download/v0.3.0/mdbook-svgbob_v0.3.0_x86_64-unknown-linux-musl.tar.gz | tar xz -C ~/tools
          unzip mdbook-linkcheck.v$MDBOOK_LINKCHECK_VERSION.x86_64-unknown-linux-gnu.zip -d ~/tools
          chmod +x ~/tools/mdbook-linkcheck
          curl -s https://api.github.com/repos/zjp-CN/mdbook-theme/releases/latest \
                 | grep browser_download_url \
                 | grep mdbook-theme_linux \
                 | cut -d '"' -f 4 \
                 | wget -qi -
          tar -xzf mdbook-theme_linux.tar.gz -C ~/tools
          echo ~/tools >> $GITHUB_PATH

      - name: Build
        run: mdbook build
      # share between different jobs
      - uses: actions/upload-artifact@v3
        with:
          name: book
          path: book/