putitoutthere 0.1.49 → 0.1.50

package/CHANGELOG.md

@@ -19,6 +19,8 @@ are prefixed `**BREAKING**` and link to the matching section in
 
 ### Changed
 
+- **Reusable workflow + `action.yml` bumped to Node 24-compatible action majors.** GitHub deprecated Node 20 actions in September 2025; the runner forces Node 24 starting June 2, 2026 and removes Node 20 entirely on September 16, 2026. Bumps inside `.github/workflows/release.yml`: `actions/checkout@v4 → @v6`, `actions/setup-node@v4 → @v6`, `actions/setup-python@v5 → @v6`, `actions/upload-artifact@v4 → @v7`, `actions/download-artifact@v4 → @v8`. `action.yml` `runs.using: node20 → node24`. The canonical `pypi-publish` template in the README also bumps `actions/download-artifact@v4 → @v8` so consumers can paste a warning-free template; existing `@v4` copies in consumer workflows keep working but emit the deprecation warning in the caller's context. Artifact contract is unchanged: `download-artifact@v8` preserves the per-name subdirectory layout for downloads-by-name and `upload-artifact@v7`'s default behavior still produces zipped uploads keyed by `name:`. See [MIGRATIONS.md](./MIGRATIONS.md#reusable-workflow--actionyml-move-to-node-24-actions). (#253)
+
 - **BREAKING: PyPI uploads moved to a caller-side `pypi-publish` job.** PyPI's Trusted Publisher matching filters candidates by `repository_owner` + `repository_name` *before* checking `job_workflow_ref` ([Warehouse implementation](https://github.com/pypi/warehouse/blob/main/warehouse/oidc/models/github.py)); since the OIDC `repository` claim always reflects the caller's repo even inside a reusable workflow, a TP registered against `thekevinscott/putitoutthere` is filtered out before the workflow_ref is ever checked. PyPI explicitly documents this as unsupported ([troubleshooting](https://docs.pypi.org/trusted-publishers/troubleshooting/)). Tracked at [pypi/warehouse#11096](https://github.com/pypi/warehouse/issues/11096), no timeline. The engine still does plan + build + version-rewrite + git tag for PyPI; the actual upload (`pypa/gh-action-pypi-publish`) now runs in the consumer's workflow file as a second job, gated on `needs.release.outputs.has_pypi`. The canonical template grew from ~12 → ~30 lines but remains a single copy-paste — the `if:` skips the job for non-PyPI repos. See [MIGRATIONS.md](./MIGRATIONS.md#pypi-uploads-moved-to-caller-side-job) and [`notes/audits/2026-04-28-pypi-tp-reusable-workflow-constraint.md`](./notes/audits/2026-04-28-pypi-tp-reusable-workflow-constraint.md).
 - **Public consumer surface collapsed to the README + the reusable workflow.** The CLI, the JS action (`action.yml`), and the diagnostic subcommands (`doctor`, `preflight`) are internal seams the reusable workflow invokes; consumers do not call them. The entire `docs/` directory is removed — `README.md` is the single user-facing surface. See [MIGRATIONS.md](./MIGRATIONS.md#public-surface-collapsed-to-a-reusable-workflow) for the before/after.
 - **Auth is OIDC trusted publishers only.** The reusable workflow does not pass long-lived registry tokens (`NPM_TOKEN`, `PYPI_API_TOKEN`, `CARGO_REGISTRY_TOKEN`) as secrets. The engine's env-var fallback code paths still exist (in `src/auth.ts`); they're just not reachable through the reusable workflow.

package/MIGRATIONS.md

@@ -21,6 +21,69 @@ Each section covers five things, in order:
 
 ## Unreleased
 
+### Reusable workflow + `action.yml` move to Node 24 actions
+
+**Summary.** GitHub deprecated Node 20 actions in September 2025; the
+hosted runner forces Node 24 starting June 2, 2026 and removes Node 20
+entirely on September 16, 2026.
+Every workflow run that called `putitoutthere` was emitting deprecation
+warnings — one per job inside the reusable workflow, plus a top-level
+`Actions running on Node.js 20` warning attributed to
+`thekevinscott/putitoutthere@v0` itself, which the consumer could not
+fix locally. The reusable workflow's pinned action majors and the JS
+action's `runs.using` now target Node 24-compatible versions.
+
+| Action | Before | After |
+|---|---|---|
+| `actions/checkout` | `@v4` | `@v6` |
+| `actions/setup-node` | `@v4` | `@v6` |
+| `actions/setup-python` | `@v5` | `@v6` |
+| `actions/upload-artifact` | `@v4` | `@v7` |
+| `actions/download-artifact` | `@v4` | `@v8` |
+| `action.yml` `runs.using` | `node20` | `node24` |
+
+**Required changes.** Consumers calling the reusable workflow at
+`thekevinscott/putitoutthere/.github/workflows/release.yml@v0` get the
+new pins automatically — no consumer-side YAML changes required. The
+caller-side `pypi-publish` job in the canonical template now uses
+`actions/download-artifact@v8`; existing copies still pinned at `@v4`
+keep working but should be bumped to silence the same deprecation
+warning in the consumer's own workflow file:
+
+```diff
+   pypi-publish:
+     ...
+     steps:
+-      - uses: actions/download-artifact@v4
++      - uses: actions/download-artifact@v8
+         with:
+           pattern: '*-sdist'
+           ...
+-      - uses: actions/download-artifact@v4
++      - uses: actions/download-artifact@v8
+         with:
+           pattern: '*-wheel-*'
+           ...
+```
+
+**Deprecations removed.** None.
+
+**Behavior changes without code changes.** Reusable workflow jobs now
+run under Node 24 instead of Node 20. The artifact contract is
+unchanged — `download-artifact@v8` preserves the per-name subdirectory
+layout (`artifacts/<artifact-name>/<file>`) for downloads-by-name, and
+`upload-artifact@v7`'s default still produces zipped uploads keyed by
+the `name:` parameter. `download-artifact@v8` now fails on artifact
+hash mismatches by default (was a warning in `@v4`); this is an
+integrity check, not a behavior change for healthy uploads.
+
+**Verification.** A consumer release run no longer emits the
+`Actions running on Node.js 20 ... thekevinscott/putitoutthere@v0`
+deprecation warning, nor the per-job warnings against `actions/checkout@v4`
+et al. Tag, GitHub Release, and registry uploads occur as before.
+
+---
+
 ### PyPI uploads moved to caller-side job
 
 **Summary.** PyPI's Trusted Publisher matching filters candidates by
@@ -82,12 +145,12 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: '*-sdist'
           path: dist/
           merge-multiple: true
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: '*-wheel-*'
           path: dist/

package/README.md

@@ -35,12 +35,12 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: '*-sdist'
           path: dist/
           merge-multiple: true
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: '*-wheel-*'
           path: dist/

package/action.yml

@@ -25,5 +25,5 @@ outputs:
     description: "JSON matrix emitted by `plan`. Output key is omitted when the plan resolves to zero rows or when command is anything other than plan; downstream jobs should coalesce with `|| '[]'`."
 
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'dist-action/index.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.1.49",
+  "version": "0.1.50",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {