INFL-21383: chore: clear the Node 20 warnings on the ECR build job by Kuses129 · Pull Request #86 · infralight/.github

Kuses129 · 2026-08-26T10:57:17Z

What kind of change does this PR introduce?

Code maintenance

Description of the changes included in this PR

Two lines. Clears the Node 20 deprecation annotation on every Build & Push ECR Docker Image job, e.g. run 32721041959:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@0400d5f6, aws-actions/configure-aws-credentials@ff717079

configure-aws-credentials v4 (node20) → v6.2.1 (node24). That exact pin already runs on master in frontend-s3-managed.yaml.
actions/cache@0400d5f6 isn't a step in this workflow — it's nested insideaquasecurity/trivy-action at the old pin, which calls actions/cache v4.2.4 internally. v0.36.0 pins actions/cache v5.0.5. The step keeps version: 'v0.69.2', so the Trivy scanner itself does not change — only the action wrapper.

Input surfaces of both actions are identical between old and new pins; nothing added, removed or renamed. Both new pins verified to resolve to real commits.

The app-server half of this annotation is already on main (app-server#3003).

Testing. Reusable workflows can't be exercised from a branch — callers reference @master — so this is static review plus the prior art above. To execute it before merge, point a caller at this branch and dispatch a dev deploy:

uses: infralight/.github/.github/workflows/cached-node-ecr-image-managed.yaml@INFL-21383-node24-deploy-warnings

Scope is deliberately limited to the annotation. The broader Node 24 / pinning / permissions work is parked in #85.

Does this PR introduce a breaking change?

No.

🤖 Generated with Claude Code

https://claude.ai/code/session_01A7RuYKDvUftG8c3AiWbZD3

Summary by CodeRabbit

Chores
- Updated AWS authentication and container security scanning tools to newer supported versions.
- Existing scan conditions and configuration remain unchanged.

Deploy runs annotate every "Build & Push ECR Docker Image" job with: Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@0400d5f6, aws-actions/configure-aws-credentials@ff717079 Both come from this workflow: - configure-aws-credentials v4 is node20 -> v6.2.1, which is node24. That exact pin already runs on master in frontend-s3-managed.yaml. - actions/cache@0400d5f6 is not a step here at all; it is nested inside aquasecurity/trivy-action at the old pin, which calls actions/cache v4.2.4 internally. trivy-action v0.36.0 pins actions/cache v5.0.5. The step keeps `version: 'v0.69.2'`, so the Trivy scanner itself is unchanged - only the action wrapper moves. Input surfaces of both actions are identical between old and new; no inputs were added, removed or renamed. Scope is deliberately limited to the two lines that cause the annotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A7RuYKDvUftG8c3AiWbZD3

coderabbitai · 2026-08-26T10:57:34Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: infralight/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2ff1b17d-3cf0-4bd4-ae32-8f742dcc498b

📥 Commits

Reviewing files that changed from the base of the PR and between 555882f and 725237e.

📒 Files selected for processing (1)

.github/workflows/cached-node-ecr-image-managed.yaml

Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

📜 Recent review details

🔇 Additional comments (1)

.github/workflows/cached-node-ecr-image-managed.yaml (1)
151-159: LGTM!

📝 Walkthrough

Walkthrough

The workflow updates the AWS credentials action to v6.2.1 and the Trivy action to v0.36.0. Existing credentials and scan conditions remain unchanged.

Changes

Workflow action updates

Layer / File(s)	Summary
Update workflow action versions `.github/workflows/cached-node-ecr-image-managed.yaml`	The workflow pins `aws-actions/configure-aws-credentials` to v6.2.1 and `aquasecurity/trivy-action` to v0.36.0. Credentials and scan conditions remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk:⚪ Minimal · up to 72523

This localized workflow maintenance updates action pins to remove Node 20 warnings without changing the scanner version or intended job behavior; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers:sapircohenn

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: removing Node 20 warnings from the ECR build job by updating workflow actions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch INFL-21383-node24-deploy-warnings

Warning

Your free Security trial is over. An organization admin can activate billing to continue.

_{Comment @coderabbitai help to get the list of available commands.}

3l1k · 2026-08-26T11:19:09Z


 - name: Configure AWS Credentials
- uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
+ uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1


why do we need to update major version in this step?

v5 doesn't clear the warning — it's still node20. v6 is the minimum bump that does:
tag runs.using
v4 node20 ← the deprecated one
v5 node20
v6 node24
And v6.0.0's only breaking change is exactly the thing we're after:
⚠ BREAKING CHANGES — Update action to use node24 (#1632)
Nothing this step passes is affected. v5.0.0's single breaking change was "changes invalid boolean input behavior", and this step passes no booleans — only role-to-assume, role-session-name and aws-region. The input surface from v4 to v6 is purely additive: 12 inputs added, none removed or renamed.
254c19bd (v6.2.1) is also the exact pin already running on master in frontend-s3-managed.yaml, so it's proven against the same OIDC assume-role pattern in this org.

3l1k · 2026-08-26T11:45:33Z

 - name: Run Trivy Vulnerability Scanner
 if: ${{ inputs.trivy-scan && inputs.environment == 'dev' }}
- uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # master (v0.69.2)
+ uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0


why version downgrade? please use 0.69.2

3l1k

0.69.2

Kuses129 mentioned this pull request Aug 26, 2026
INFL-21383: chore: Node 24 runtimes, least-privilege permissions and repaired action pins #85
Draft
6 tasks

3l1k reviewed Aug 26, 2026
View reviewed changes

3l1k requested changes Aug 26, 2026
View reviewed changes

Kuses129 requested a review from 3l1k August 26, 2026 11:33

3l1k reviewed Aug 26, 2026
View reviewed changes

3l1k approved these changes Aug 26, 2026
View reviewed changes

3l1k requested changes Aug 26, 2026
View reviewed changes

3l1k approved these changes Aug 26, 2026
View reviewed changes

Kuses129 merged commit a8256ec into masterAug 27, 2026
1 check passed

Navigation Menu

Uh oh!

INFL-21383: chore: clear the Node 20 warnings on the ECR build job - #86

INFL-21383: chore: clear the Node 20 warnings on the ECR build job#86
Kuses129 merged 1 commit into
masterfrom
INFL-21383-node24-deploy-warnings

Kuses129 commented Aug 26, 2026•
edited by coderabbitai Bot
Loading

Uh oh!

coderabbitaiBot commented Aug 26, 2026•
edited
Loading

Walkthrough

Changes

Uh oh!

3l1kAug 26, 2026

Uh oh!

Kuses129Aug 26, 2026

Uh oh!

3l1kAug 26, 2026

Uh oh!

3l1k left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Kuses129 commented Aug 26, 2026• edited by coderabbitai BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitaiBot commented Aug 26, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

3l1kAug 26, 2026

Choose a reason for hiding this comment

Uh oh!

Kuses129Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

3l1kAug 26, 2026

Choose a reason for hiding this comment

Uh oh!

3l1k left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Kuses129 commented Aug 26, 2026•
edited by coderabbitai Bot
Loading

coderabbitaiBot commented Aug 26, 2026•
edited
Loading