From c8647e31ee314f7f7c7e88c3af763e3d8e9af0ae Mon Sep 17 00:00:00 2001
From: Dhruv2mars <dhruv2mars@gmail.com>
Date: Fri, 20 Mar 2026 14:09:05 +0530
Subject: [PATCH] chore: harden release actions

---
 .github/workflows/release.yml              | 12 ++++++------
 Cargo.toml                                 |  2 +-
 packages/cli/CHANGELOG.md                  |  6 ++++++
 packages/cli/package.json                  |  2 +-
 packages/cli/test/release-contract.test.js |  4 ++++
 5 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 04b4dcb..847a340 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,11 +17,11 @@ jobs:
     outputs:
       version: ${{ steps.meta.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 24
       - id: meta
@@ -40,7 +40,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
       - env:
@@ -87,7 +87,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
       - uses: dtolnay/rust-toolchain@stable
@@ -135,10 +135,10 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 24
           registry-url: "https://registry.npmjs.org"
diff --git a/Cargo.toml b/Cargo.toml
index d388cd9..90fc4a8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ members = ["crates/codexchat-core", "crates/codexchat-cli"]
 resolver = "2"
 
 [workspace.package]
-version = "0.1.8"
+version = "0.1.9"
 edition = "2024"
 license = "MIT"
 authors = ["Dhruv Mars"]
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index e985699..e791aea 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @dhruv2mars/codexchat
 
+## 0.1.9
+
+### Patch Changes
+
+- Upgrade GitHub release workflow actions to the Node 24 majors and remove the deprecation warning.
+
 ## 0.1.8
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index caaddc4..4ee2f24 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@dhruv2mars/codexchat",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "ChatGPT terminal app with official Codex bridge",
   "type": "module",
   "bin": {
diff --git a/packages/cli/test/release-contract.test.js b/packages/cli/test/release-contract.test.js
index 7429a3f..02f2a6a 100644
--- a/packages/cli/test/release-contract.test.js
+++ b/packages/cli/test/release-contract.test.js
@@ -58,6 +58,10 @@ test("release workflow keeps tag and npm publish contract", () => {
   assert.match(text, /tags:\s*\n\s*-\s*["']v\*["']/);
   assert.match(text, /gh release create "\$\{RELEASE_TAG\}" --title "\$\{RELEASE_TAG\}" --generate-notes/);
   assert.match(text, /npm publish --provenance --access public/);
+  assert.match(text, /actions\/checkout@v5/);
+  assert.match(text, /actions\/setup-node@v5/);
+  assert.doesNotMatch(text, /actions\/checkout@v4/);
+  assert.doesNotMatch(text, /actions\/setup-node@v4/);
   assert.doesNotMatch(text, /NPM_TOKEN:\s*\$\{\{\s*secrets\.NPM_TOKEN\s*\}\}/);
   assert.doesNotMatch(text, /trusted publisher not configured and NPM_TOKEN missing/);
   assert.match(text, /FORCE_JAVASCRIPT_ACTIONS_TO_NODE24:\s*true/);