Lucas RayanandClaude Opus 5
43dcea1ade
Concurrency. release.yml calls ci.yml, so a push to main started the called workflow and the standalone one, both landing in the concurrency group ci-<ref>. One cancelled the other and every merge left a cancelled run behind. main is now excluded from the push trigger: release.yml is already the entry point there, and pull_request still covers changes before they land. Node 20 deprecation (23 warnings). Every action was pinned to a major that still declares node20. Each replacement was checked by reading the action.yml at the new tag and confirming "using: node24", and the inputs in use were confirmed to still exist there: checkout v4->v7, setup-node v4->v7, setup-go v5->v7, upload-artifact v4->v7, download-artifact v4->v7, setup-buildx-action v3->v4, build-push-action v6->v7, login-action v3->v4, metadata-action v5->v6 download-artifact has a v8, but v7 is also node24 and matches the upload side, so the pair stays on one major. trivy-action is a composite action and has no Node runtime to deprecate. Go cache (1 warning). setup-go looked for go.sum at the repository root and skipped its cache: defaults.run.working-directory applies to run steps, not to actions. cache-dependency-path now points at services/protocols/go.sum. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>