fix: update GitHub Actions to Node.js 24-compatible versions (#38)

* fix: update GitHub Actions to Node.js 24-compatible versions

Closes #35

Update all GitHub Actions to versions that use Node.js 24 runtime,
ahead of the June 2, 2026 deprecation of Node.js 20 runners.

Actions updated:
- actions/checkout: v3/v4 → v6
- actions/upload-artifact: v4 → v7
- actions/download-artifact: v4 → v8
- actions/create-github-app-token: v1 → v3
- codecov/codecov-action: v3 → v5
- azure/setup-kubectl: v3 → v4
- docker/setup-qemu-action: v3 → v4
- docker/setup-buildx-action: v3 → v4
- docker/login-action: v3 → v4
- docker/build-push-action: v5 → v7

Replaced archived kenji-miyake/setup-git-cliff@v2 (node20, will
never get node24) with cargo install git-cliff.

Actions already compatible (composite/no Node runtime, unchanged):
- Swatinem/rust-cache@v2, sigstore/cosign-installer@v3,
  dtolnay/rust-toolchain@stable, taiki-e/install-action

Actions with no node24 release yet (kept current):
- azure/setup-helm@v4, softprops/action-gh-release@v2

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use intermediate FROM stage for buildx COPY --from

Newer BuildKit (shipped with docker/build-push-action v7) no longer
supports variable expansion in COPY --from=builder-${TARGETARCH}.
Use an intermediate FROM stage instead, since FROM supports global
ARG expansion.

Fixes #39

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: miguelgila

.github/workflows/auto-release.yml

@@ -21,13 +21,13 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 0
@@ -92,7 +92,7 @@ jobs:
 
       - name: Install git-cliff
         if: steps.loop-guard.outputs.skip != 'true'
-        uses: kenji-miyake/setup-git-cliff@v2
+        run: cargo install git-cliff
 
       - name: Generate changelog
         if: steps.loop-guard.outputs.skip != 'true'

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
@@ -36,7 +36,7 @@ jobs:
     name: Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -48,7 +48,7 @@ jobs:
     name: Security Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - name: Install cargo-audit
         run: cargo install cargo-audit
@@ -59,7 +59,7 @@ jobs:
     name: Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Run tests
@@ -69,15 +69,15 @@ jobs:
     name: Coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Install tarpaulin
         uses: taiki-e/install-action@cargo-tarpaulin
       - name: Generate coverage
         run: cargo tarpaulin
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         with:
           files: ./cobertura.xml
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -88,7 +88,7 @@ jobs:
     name: Build and Cache
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Build all binaries (musl static)
         run: |
           docker run --rm \
@@ -101,7 +101,7 @@ jobs:
               --bin reaper-agent \
               --bin reaper-controller \
               --target x86_64-unknown-linux-musl
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: musl-binaries
           path: |
@@ -116,9 +116,9 @@ jobs:
     needs: build-musl
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: musl-binaries
           path: target/x86_64-unknown-linux-musl/release/
@@ -127,7 +127,7 @@ jobs:
         run: chmod +x target/x86_64-unknown-linux-musl/release/*
 
       - name: Install kubectl
-        uses: azure/setup-kubectl@v3
+        uses: azure/setup-kubectl@v4
         with:
           version: "v1.30.0"
 
@@ -163,7 +163,7 @@ jobs:
     needs: cargo-test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install kind
         run: |
@@ -173,7 +173,7 @@ jobs:
           sudo mv ./kind /usr/local/bin/kind
 
       - name: Install kubectl
-        uses: azure/setup-kubectl@v3
+        uses: azure/setup-kubectl@v4
         with:
           version: "v1.30.0"
 

.github/workflows/manual-release.yml

@@ -30,13 +30,13 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 0
@@ -95,7 +95,7 @@ jobs:
           fi
 
       - name: Install git-cliff
-        uses: kenji-miyake/setup-git-cliff@v2
+        run: cargo install git-cliff
 
       - name: Generate changelog
         run: git-cliff --tag "v${{ steps.bump.outputs.version }}" -o CHANGELOG.md

.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
     needs: resolve-tag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.resolve-tag.outputs.tag }}
 
@@ -75,7 +75,7 @@ jobs:
             arch: aarch64
             musl_image: messense/rust-musl-cross:aarch64-musl
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.resolve-tag.outputs.tag }}
 
@@ -116,7 +116,7 @@ jobs:
           echo "TARBALL=${DIRNAME}.tar.gz" >> "$GITHUB_ENV"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-${{ matrix.target }}
           path: "*.tar.gz"
@@ -138,18 +138,18 @@ jobs:
           - image: reaper-node
             dockerfile: Dockerfile.node
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.resolve-tag.outputs.tag }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -163,7 +163,7 @@ jobs:
 
       - name: Build and push
         id: build-push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ${{ matrix.dockerfile }}
@@ -193,7 +193,7 @@ jobs:
       packages: write
       id-token: write  # Required for cosign keyless signing via GitHub OIDC
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.resolve-tag.outputs.tag }}
 
@@ -206,7 +206,7 @@ jobs:
             helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin
 
       - name: Login to GHCR (cosign/Docker credentials)
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -246,13 +246,15 @@ jobs:
       contents: write
       id-token: write  # Required for cosign keyless signing via GitHub OIDC
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.resolve-tag.outputs.tag }}
           fetch-depth: 0
 
+      - uses: dtolnay/rust-toolchain@stable
+
       - name: Install git-cliff
-        uses: kenji-miyake/setup-git-cliff@v2
+        run: cargo install git-cliff
 
       - name: Generate release notes
         id: release-notes
@@ -267,7 +269,7 @@ jobs:
         uses: sigstore/cosign-installer@v3
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts/
 

Dockerfile.agent

@@ -15,8 +15,11 @@ COPY . .
 RUN cargo build --release --features agent --bin reaper-agent --target aarch64-unknown-linux-musl && \
     cp target/aarch64-unknown-linux-musl/release/reaper-agent /reaper-agent
 
+# --- Arch selector (FROM supports global ARG expansion, COPY --from does not) ---
+ARG TARGETARCH
+FROM builder-${TARGETARCH} AS builder
+
 # --- Runtime stage ---
 FROM gcr.io/distroless/static-debian12
-ARG TARGETARCH
-COPY --from=builder-${TARGETARCH} /reaper-agent /reaper-agent
+COPY --from=builder /reaper-agent /reaper-agent
 ENTRYPOINT ["/reaper-agent"]

Dockerfile.controller

@@ -15,9 +15,12 @@ COPY . .
 RUN cargo build --release --features controller --bin reaper-controller --target aarch64-unknown-linux-musl && \
     cp target/aarch64-unknown-linux-musl/release/reaper-controller /reaper-controller
 
+# --- Arch selector (FROM supports global ARG expansion, COPY --from does not) ---
+ARG TARGETARCH
+FROM builder-${TARGETARCH} AS builder
+
 # --- Runtime stage ---
 FROM gcr.io/distroless/static-debian12:nonroot
-ARG TARGETARCH
-COPY --from=builder-${TARGETARCH} /reaper-controller /usr/local/bin/reaper-controller
+COPY --from=builder /reaper-controller /usr/local/bin/reaper-controller
 USER nonroot:nonroot
 ENTRYPOINT ["/usr/local/bin/reaper-controller"]

Dockerfile.node

@@ -27,10 +27,14 @@ RUN cargo build --release \
     cp target/aarch64-unknown-linux-musl/release/containerd-shim-reaper-v2 /out/ && \
     cp target/aarch64-unknown-linux-musl/release/reaper-runtime /out/
 
+# --- Arch selector (FROM supports global ARG expansion, COPY --from does not) ---
+ARG TARGETARCH
+FROM builder-${TARGETARCH} AS builder
+
 # --- Runtime stage ---
 FROM alpine:3.19
 ARG TARGETARCH
-COPY --from=builder-${TARGETARCH} /out/ /binaries/${TARGETARCH}/
+COPY --from=builder /out/ /binaries/${TARGETARCH}/
 COPY scripts/install-node.sh /install.sh
 RUN chmod +x /install.sh
 ENTRYPOINT ["/install.sh"]