Concurrency. release.yml calls ci.yml, so a push to main started the
called workflow and the standalone one, both landing in the concurrency
group ci-<ref>. One cancelled the other and every merge left a cancelled
run behind. main is now excluded from the push trigger: release.yml is
already the entry point there, and pull_request still covers changes
before they land.
Node 20 deprecation (23 warnings). Every action was pinned to a major
that still declares node20. Each replacement was checked by reading the
action.yml at the new tag and confirming "using: node24", and the inputs
in use were confirmed to still exist there:
checkout v4->v7, setup-node v4->v7, setup-go v5->v7,
upload-artifact v4->v7, download-artifact v4->v7,
setup-buildx-action v3->v4, build-push-action v6->v7,
login-action v3->v4, metadata-action v5->v6
download-artifact has a v8, but v7 is also node24 and matches the upload
side, so the pair stays on one major. trivy-action is a composite action
and has no Node runtime to deprecate.
Go cache (1 warning). setup-go looked for go.sum at the repository root
and skipped its cache: defaults.run.working-directory applies to run
steps, not to actions. cache-dependency-path now points at
services/protocols/go.sum.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
