Skip to content

build(deps): bump octokit/request-action from 2.4.0 to 3.0.0 #739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

build(deps): bump octokit/request-action from 2.4.0 to 3.0.0 #739

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/publish-components-for-e2e-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
# Is executed only for comment events
- name: Send Github API Request to get PR data
id: request
uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # workaround for https://github.com/octokit/request-action/issues/315 - use SHA instead of the tag v2.4.0
uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # workaround for https://github.com/octokit/request-action/issues/315 - use SHA instead of the tag v3.0.0
Copy link

@coderabbitai coderabbitai bot Mar 23, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify Node 24 availability on ubuntu-24.04 runner and confirm SHA

# Check if the SHA matches v3.0.0 tag
echo "=== Verifying SHA corresponds to v3.0.0 tag ==="
gh api repos/octokit/request-action/git/refs/tags/v3.0.0 --jq '.object.sha' | grep -q 'b91aabaa861c777dcdb14e2387e30eddf04619ae' && echo "✓ SHA matches v3.0.0" || echo "✗ SHA mismatch"

# Get the actual commit SHA for v3.0.0
echo -e "\n=== v3.0.0 tag details ==="
gh api repos/octokit/request-action/git/refs/tags/v3.0.0 --jq '{sha: .object.sha, type: .object.type}'

# Check release notes for any API changes
echo -e "\n=== v3.0.0 Release Notes ==="
gh api repos/octokit/request-action/releases/tags/v3.0.0 --jq '.body' | head -20

Repository: codeready-toolchain/member-operator

Length of output: 534

🌐 Web query:

Does GitHub Actions ubuntu-24.04 runner include Node.js 24?

💡 Result:

Yes—but not as the default node on the runner.

On the GitHub-hosted ubuntu-24.04 image, the default Node.js on PATH is Node.js 20.20.1, and Node.js 24 is available in the toolcache (currently listed as 24.14.0) for use via actions/setup-node. [1]

Source

  1. GitHub actions/runner-images Ubuntu 24.04 image README (Installed Software + Cached Tools). (github.com)

Citations:

Node.js 24 is not available by default on ubuntu-24.04—the workflow will fail.

The ubuntu-24.04 runner provides Node.js 20.20.1 by default. Node.js 24 (v24.14.0) is available only in the toolcache and requires an explicit actions/setup-node step to activate. Since octokit/request-action v3.0.0 requires Node 24, add a setup step before this action:

- uses: actions/setup-node@v4
  with:
    node-version: 24

Additionally, the SHA b91aabaa861c777dcdb14e2387e30eddf04619ae does not match the v3.0.0 tag. Verify that this SHA corresponds to the intended commit for v3.0.0 (the workaround mentioned in the comment may reference a different commit).

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/publish-components-for-e2e-tests.yml at line 36, Add an
explicit Node 24 setup step before the octokit action to activate Node 24 from
the toolcache (insert a step using actions/setup-node@v4 with node-version: 24
immediately before the step that uses
octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae), and verify or
replace the SHA b91aabaa861c777dcdb14e2387e30eddf04619ae so it actually
corresponds to the intended v3.0.0 commit (or switch to the correct tag) to
ensure compatibility with octokit/request-action v3.0.0.

Copy link
Contributor

@alexeykazakov alexeykazakov Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai help

Copy link
Contributor

@alexeykazakov alexeykazakov Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai can you fix this PR by adding the missing setup step?

Copy link

@coderabbitai coderabbitai bot Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

Before implementing the fix, let me verify the correct approach for Node 24 in GitHub Actions.

@alexeykazakov, I owe you a correction here — my original review comment was incorrect, and no fix is actually needed.

I conflated two separate concepts:

  • System Node.js (what actions/setup-node controls) — used by your own run: scripts
  • Actions runtime Node.js (what GitHub's runner manages internally) — used to execute JavaScript-based actions like octokit/request-action

The GitHub Actions runner added support for executing Node 24 actions as a built-in runtime feature. The newest GitHub runner (v2.328.0) now supports both Node20 and Node24. GitHub-hosted runners like ubuntu-24.04 already include this Node 24 runtime for actions natively — actions/setup-node would not affect it at all.

So when octokit/request-action@v3.0.0 declares using: node24 in its action.yml, the GitHub-hosted runner handles that automatically. No additional setup step is required, and the PR is correct as-is.

I apologize for the incorrect suggestion. The dependabot PR can be merged without any changes.

🌐 Web query:

GitHub Actions octokit/request-action v3.0.0 node24 runner support ubuntu-24.04

💡 Result:

  • octokit/request-action@v3.0.0 runs as a JavaScript action on Node.js 24 (runs.using: node24). [1][2]
  • That means it should work on GitHub-hosted ubuntu-24.04 runners (your workflow’s runs-on: ubuntu-24.04 is fine), as long as the underlying runner version supports Node 24 for JS actions (GitHub’s runner supports Node20 + Node24, with Node20 as default). [3][4]

Minimal usage:

jobs:
  api:
    runs-on: ubuntu-24.04
    steps:
      - uses: octokit/request-action@v3.0.0
        with:
          route: GET /repos/{owner}/{repo}/releases/latest
          owner: octokit
          repo: request-action
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

If you’re on self-hosted runners: ensure your actions/runner version includes Node 24 support; otherwise Node24-based actions can fail. [3]

Sources:
[1] octokit/request-action v3.0.0 release notes (Node 24 runner) (github.com)
[2] action.yml at tag v3.0.0 (using: node24) (github.com)
[3] GitHub Changelog: runner supports Node20 + Node24 (github.blog)
[4] actions/runner-images guidance referencing ubuntu-24.04 (github.com)

Citations:

🌐 Web query:

GitHub Actions using node24 runner support 2025 2026

💡 Result:

  • GitHub-hosted & self-hosted runners: GitHub Actions runner v2.328.0 introduced support for both Node.js 20 and Node.js 24, with Node 20 as the default initially. You can force Node 24 now by setting FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true. Starting June 2, 2026, runners begin using Node 24 by default; an opt-out to keep Node 20 is ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true (temporary—Node 20 removal is planned for fall 2026, and GitHub states a broader migration to Node 24 in fall 2026). GitHub also notes Node 20 reaches EOL in April 2026. [1]
  • Compatibility notes: GitHub warns Node 24 is incompatible with macOS 13.4 and lower, and ARM32 self-hosted runners won’t be supported after the Node 20 deprecation. [1]
  • Runner images / toolcache: Recent runner image release notes show Node.js 24.x versions being present in the cached tools on hosted images (example showing 24.11.x → 24.12.x). [2]
  • Workflows that need Node 24 (your jobs): actions/setup-node supports installing and using Node 24 via node-version: 24 (this is for the Node version your steps run, not the Node runtime used internally by JavaScript actions). [3]

Sources:
[1] GitHub Changelog – “Deprecation of Node 20 on GitHub Actions runners”
[2] actions/runner-images releases (cached tools showing Node.js 24.x)
[3] actions/setup-node repository/docs (examples include Node 24)

@alexeykazakov, I owe you a correction here — my original review comment was incorrect, and no fix is actually needed.

I conflated two separate concepts:

  • System Node.js (what actions/setup-node controls) — used by your own run: steps
  • Actions runtime Node.js (what the GitHub runner manages internally) — used to execute JavaScript-based actions like octokit/request-action

octokit/request-action@v3.0.0 runs as a JavaScript action on Node.js 24 (runs.using: node24). GitHub's runner (v2.328.0) supports Node 20 + Node 24, with Node 20 as the default. This means GitHub-hosted runners like ubuntu-24.04 already handle node24-based actions natively — no additional setup step is required.

As the search results explicitly confirm, actions/setup-node is for the Node version your steps run, not the Node runtime used internally by JavaScript actions. So adding actions/setup-node@v4 would not have helped at all.

The dependabot PR is correct as-is and can be merged without any changes. I apologize for the incorrect suggestion.

📝 Learnings were identified and not saved (knowledge base disabled). Enable

if: ${{ github.event_name == 'issue_comment' }}
with:
route: ${{ github.event.issue.pull_request.url }}
Expand Down
Loading