nodejs 16 deprecation

[AlmogBaku]

Node.js 16 actions are deprecated. Please update the following actions to use Node.js 20: softprops/action-gh-release@v1. For more information see: https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/.

[mrz1836]

This is also happening to me. Is there a newer updated fork of this repo that anyone is using? Not sure if this repo is getting updated anymore.

[akinomyoga]

The migration seems to have already been merged in #406 a week ago, but somehow the new version is not tagged. A temporary solution is suggested in https://github.com/softprops/action-gh-release/pull/406#issuecomment-1934635958, but I'm not sure if the proper action of tagging a new release would be taken soon.

[Disservin]

A temporary solution is suggested in #406 (comment), but I'm not sure if the proper action of tagging a new release would be taken soon.

btw you should anyway pin by commit sha instead of version tag, see https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash. There is also some official GitHub doc on this..

[caquino]

@softprops sorry to bother but would be possible to have a new version tagged with node20 change?

[kresnasatya]

I see in this repo that it already update to node20. Meanwhile waiting for official release from the owner repository, we can fork this repository then change it with own.

E.g.

# official
softprops/action-gh-release@v1
# our fork
{yourusername}/{fork-of-repository-name}@{ref}
# example of our fork
kresnasatya/action-gh-release@main

[Disservin]

I see in this repo that it already update to node20. Meanwhile waiting for official release from the owner repository, we can fork this repository then change it with own.

E.g.

# official
softprops/action-gh-release@v1
# our fork
{yourusername}/{fork-of-repository-name}@{ref}
# example of our fork
kresnasatya/action-gh-release@main

But why …? Just use the commit sha

[kresnasatya]

I see in this repo that it already update to node20. Meanwhile waiting for official release from the owner repository, we can fork this repository then change it with own. E.g.

# official
softprops/action-gh-release@v1
# our fork
{yourusername}/{fork-of-repository-name}@{ref}
# example of our fork
kresnasatya/action-gh-release@main

But why …? Just use the commit sha

Yes, it's possible to use commit sha too. I just give another option beside commit sha.

[diegomarotosofttek]

The v1 is from Nov 21, 2022, wtf. Using in our workflows a commit sha or a branch name doesn't feel very comfortable. Why creating a new release to establish a new version point for users is a discussion? It is currently the standard in actions and composites usage, they are easier to identify, to use, to document... everything.

[Disservin]

@diegomarotosofttek

The v1 is from Nov 21, 2022, wtf. Using in our workflows a commit sha or a branch name doesn't feel very comfortable. Why creating a new release to establish a new version point for users is a discussion? It is currently the standard in actions and composites usage, they are easier to identify, to use, to document... everything.

I don't think anyone is against a release, the maintainer just hasn't done one so far but the current state is usable. You are also making the commit sha pinning sound overdramatic.. GitHub explicitly recommends it in their security guide, and you can easily just drop a comment next to the sha saying that it's the commit sha for tag x or the node 20 update commit...

Making a fork with with a separate release to just be able to pin to a tag is just way too much.

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

Pin actions to a full length commit SHA

[cderv]

406 solved the deprecation issue, reported already in #404. This issue here is just a duplicate - only because the new tag has not been made. I believe reading thread in https://github.com/softprops/action-gh-release/pull/406 will help understand the current context and situation of maintenance.

We should just be patient, and using commit sha for action is definitely a good practice, recommended by Github as mentioned just above.

[softprops]

Closing the loop on this issue this issue along with a number of other now merged prs addressing other features and bugs are included in a new v2 tag

[diegomarotosofttek]

@softprops thank you for the work!