chore: harden release actions

.github/workflows/release.yml

@@ -17,11 +17,11 @@ jobs:
     outputs:
       version: ${{ steps.meta.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 24
       - id: meta
@@ -40,7 +40,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
       - env:
@@ -87,7 +87,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
       - uses: dtolnay/rust-toolchain@stable
@@ -135,10 +135,10 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 24
           registry-url: "https://registry.npmjs.org"

Cargo.toml

@@ -3,7 +3,7 @@ members = ["crates/codexchat-core", "crates/codexchat-cli"]
 resolver = "2"
 
 [workspace.package]
-version = "0.1.8"
+version = "0.1.9"
 edition = "2024"
 license = "MIT"
 authors = ["Dhruv Mars"]

packages/cli/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @dhruv2mars/codexchat
 
+## 0.1.9
+
+### Patch Changes
+
+- Upgrade GitHub release workflow actions to the Node 24 majors and remove the deprecation warning.
+
 ## 0.1.8
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dhruv2mars/codexchat",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "ChatGPT terminal app with official Codex bridge",
   "type": "module",
   "bin": {

packages/cli/test/release-contract.test.js

@@ -58,6 +58,10 @@ test("release workflow keeps tag and npm publish contract", () => {
   assert.match(text, /tags:\s*\n\s*-\s*["']v\*["']/);
   assert.match(text, /gh release create "\$\{RELEASE_TAG\}" --title "\$\{RELEASE_TAG\}" --generate-notes/);
   assert.match(text, /npm publish --provenance --access public/);
+  assert.match(text, /actions\/checkout@v5/);
+  assert.match(text, /actions\/setup-node@v5/);
+  assert.doesNotMatch(text, /actions\/checkout@v4/);
+  assert.doesNotMatch(text, /actions\/setup-node@v4/);
   assert.doesNotMatch(text, /NPM_TOKEN:\s*\$\{\{\s*secrets\.NPM_TOKEN\s*\}\}/);
   assert.doesNotMatch(text, /trusted publisher not configured and NPM_TOKEN missing/);
   assert.match(text, /FORCE_JAVASCRIPT_ACTIONS_TO_NODE24:\s*true/);