From 593bbda8694f9afad8cc3b2068961f6cc942d85a Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Thu, 12 Mar 2026 15:38:01 +0100 Subject: [PATCH 1/4] Remove dead launcher composite action MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This composite action built the Rust launcher using deprecated actions-rs/toolchain@v1 and actions-rs/cargo@v1 (Node 16). It also had a YAML bug (duplicate `uses:` keys in one step). No workflow references it — the launcher build now happens directly in release scripts. --- .github/workflows/actions/launcher/action.yml | 20 ------------------- 1 file changed, 20 deletions(-) delete mode 100644 .github/workflows/actions/launcher/action.yml diff --git a/.github/workflows/actions/launcher/action.yml b/.github/workflows/actions/launcher/action.yml deleted file mode 100644 index 6313c9bd6be..00000000000 --- a/.github/workflows/actions/launcher/action.yml +++ /dev/null @@ -1,20 +0,0 @@ -# working-directory -# rust version / toolchain -# out-dir - -name: 'Build Launcher' -description: 'Builds the Quarto Launcher' -runs: - using: "composite" - steps: - - uses: actions/checkout@v4 - uses: actions-rs/toolchain@v1 - with: - toolchain: 1.63.0 - override: true - components: rustfmt, clippy - - uses: actions-rs/cargo@v1 - working-directory: package/launcher - with: - command: build - args: --release --all-features From 5f90f891344b00bc6423d5046c8c9154a7fe54a3 Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Thu, 12 Mar 2026 15:53:25 +0100 Subject: [PATCH 2/4] Update official GitHub Actions for Node.js 24 compatibility MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub is deprecating Node.js 20 for Actions runners (forced Node.js 24 starting June 2, 2026). Bump all official actions to their latest Node.js 24-compatible versions: - actions/checkout v4 → v6 - actions/cache (+ /restore, /save) v4 → v5 - actions/upload-artifact v4 → v7 - actions/download-artifact v4 → v8 - actions/setup-node v4 → v6 - actions/stale v9 → v10 Also bump node-version 18 → 22 in create-release.yml (Node 18 EOL'd April 2025). --- .github/actions/cache-typst/action.yml | 2 +- .../workflows/actions/quarto-dev/action.yml | 4 +- .github/workflows/create-release.yml | 62 +++++++++---------- .github/workflows/performance-check.yml | 2 +- .github/workflows/publish-cloudsmith.yml | 2 +- .github/workflows/stale-needs-repro.yml | 2 +- .github/workflows/test-bundle.yml | 2 +- .github/workflows/test-quarto-latexmk.yml | 4 +- .github/workflows/test-smokes-parallel.yml | 2 +- .github/workflows/test-smokes.yml | 16 ++--- .github/workflows/update-test-timing.yml | 4 +- .github/workflows/verify-tinytex-patterns.yml | 6 +- 12 files changed, 54 insertions(+), 54 deletions(-) diff --git a/.github/actions/cache-typst/action.yml b/.github/actions/cache-typst/action.yml index 018cc9faae8..bbcb23a9633 100644 --- a/.github/actions/cache-typst/action.yml +++ b/.github/actions/cache-typst/action.yml @@ -41,7 +41,7 @@ runs: - name: Cache Typst package folder id: cache-typst-restore - uses: actions/cache/restore@v4 + uses: actions/cache/restore@v5 with: path: ${{ env.TYPST_CACHE }} key: ${{ runner.os }}-typst-1 diff --git a/.github/workflows/actions/quarto-dev/action.yml b/.github/workflows/actions/quarto-dev/action.yml index 072c6f71e81..cc5292af525 100644 --- a/.github/workflows/actions/quarto-dev/action.yml +++ b/.github/workflows/actions/quarto-dev/action.yml @@ -5,7 +5,7 @@ runs: using: "composite" steps: - name: Cache deno std deps - uses: actions/cache@v4 + uses: actions/cache@v5 with: path: ./src/resources/deno_std/cache key: ${{ runner.os }}-deno_std-2-${{ hashFiles('./src/resources/deno_std/deno_std.lock', './package/scripts/deno_std/deno_std.ts') }} @@ -13,7 +13,7 @@ runs: ${{ runner.os }}-deno_std-2- - name: Cache Cargo dependencies - uses: actions/cache@v4 + uses: actions/cache@v5 with: path: | ~/.cargo/registry diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 5f9b584e5cc..f4db596d7bf 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -35,7 +35,7 @@ jobs: tag_pushed: ${{ steps.version_commit.outputs.tag_pushed }} if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli') steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: fetch-depth: 0 @@ -44,9 +44,9 @@ jobs: uses: ./.github/workflows/actions/prevent-rerun # we _also_ need npm, specifically for webui/preview - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: - node-version: 18 + node-version: 22 - name: Get previous version id: read-version @@ -78,7 +78,7 @@ jobs: # echo -e "Due to an issue with upstream dependency, the RHEL build may not included in this release." >> "release_note.md" - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: News path: | @@ -103,7 +103,7 @@ jobs: runs-on: ubuntu-latest needs: [configure] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} @@ -116,7 +116,7 @@ jobs: tar --owner=root --group=root -zcvf quarto-${{needs.configure.outputs.version}}.tar.gz * - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: Source path: ./quarto-${{needs.configure.outputs.version}}.tar.gz @@ -125,7 +125,7 @@ jobs: runs-on: ubuntu-latest needs: [configure] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} @@ -153,7 +153,7 @@ jobs: popd - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: Deb Zip path: ./package/quarto-${{needs.configure.outputs.version}}-linux-amd64.tar.gz @@ -162,7 +162,7 @@ jobs: runs-on: ubuntu-latest needs: [configure] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} @@ -190,7 +190,7 @@ jobs: popd - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: Deb Arm64 Zip path: ./package/quarto-${{needs.configure.outputs.version}}-linux-arm64.tar.gz @@ -201,7 +201,7 @@ jobs: if: false needs: [configure] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} @@ -240,7 +240,7 @@ jobs: popd - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: RHEL Zip path: ./package/quarto-${{needs.configure.outputs.version}}-linux-rhel7-amd64.tar.gz @@ -253,7 +253,7 @@ jobs: arch: [x86_64, aarch64] format: [deb, rpm] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} @@ -302,7 +302,7 @@ jobs: fi - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: Linux-${{ matrix.format }}-${{ matrix.arch }}-Installer path: ./package/out/quarto-${{needs.configure.outputs.version}}-linux-${{ steps.pkg_arch.outputs.arch_name }}.${{ matrix.format }} @@ -311,7 +311,7 @@ jobs: runs-on: ubuntu-latest needs: [configure, make-tarball] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} sparse-checkout: | @@ -321,7 +321,7 @@ jobs: if: ${{ inputs.publish-release }} uses: ./.github/workflows/actions/prevent-rerun - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: name: Deb Zip path: . @@ -352,7 +352,7 @@ jobs: needs: [configure] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} @@ -417,13 +417,13 @@ jobs: CERT_FINGERPRINT: ${{ secrets.SM_CLIENT_CERT_FINGERPRINT }} - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: Windows Installer path: ./package/out/quarto-${{needs.configure.outputs.version}}-win.msi - name: Upload Zip - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: Windows Zip path: ./package/out/quarto-${{needs.configure.outputs.version}}-win.zip @@ -432,7 +432,7 @@ jobs: runs-on: windows-latest needs: [configure, make-installer-win] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} sparse-checkout: | @@ -443,7 +443,7 @@ jobs: uses: ./.github/workflows/actions/prevent-rerun - name: "Download Windows Zip" - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: Windows Zip path: . @@ -480,7 +480,7 @@ jobs: runs-on: macos-latest needs: [configure] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} @@ -529,13 +529,13 @@ jobs: QUARTO_APPLE_CONNECT_PW: ${{ secrets.APPLE_CONNECT_PW }} - name: Upload Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: Mac Installer path: ./package/out/quarto-${{needs.configure.outputs.version}}-macos.pkg - name: Upload Zip - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: Mac Zip path: ./package/out/quarto-${{needs.configure.outputs.version}}-macos.tar.gz @@ -549,7 +549,7 @@ jobs: runs-on: macos-latest needs: [configure, make-installer-mac] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} sparse-checkout: | @@ -559,7 +559,7 @@ jobs: if: ${{ inputs.publish-release }} uses: ./.github/workflows/actions/prevent-rerun - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: name: Mac Zip path: . @@ -603,7 +603,7 @@ jobs: ] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: ref: ${{ needs.configure.outputs.version_commit }} path: quarto-cli @@ -615,7 +615,7 @@ jobs: uses: ./quarto-cli/.github/workflows/actions/prevent-rerun - name: Download Artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 - name: Rename news run: | @@ -723,7 +723,7 @@ jobs: ] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Prevent Re-run if: ${{ inputs.publish-release }} @@ -751,7 +751,7 @@ jobs: runs-on: ubuntu-latest needs: [configure, publish-release] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: sparse-checkout: | .github @@ -761,7 +761,7 @@ jobs: uses: ./.github/workflows/actions/prevent-rerun - name: Download Artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 - uses: ./.github/actions/docker with: diff --git a/.github/workflows/performance-check.yml b/.github/workflows/performance-check.yml index e35b81d5653..73702dd0fe0 100644 --- a/.github/workflows/performance-check.yml +++ b/.github/workflows/performance-check.yml @@ -16,7 +16,7 @@ jobs: if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli') steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: # checkout full tree fetch-depth: 0 diff --git a/.github/workflows/publish-cloudsmith.yml b/.github/workflows/publish-cloudsmith.yml index 78ab47d6c78..8756c72f507 100644 --- a/.github/workflows/publish-cloudsmith.yml +++ b/.github/workflows/publish-cloudsmith.yml @@ -36,7 +36,7 @@ jobs: version: ${{ steps.resolve.outputs.version }} is_prerelease: ${{ steps.resolve.outputs.is_prerelease }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: sparse-checkout: | .github diff --git a/.github/workflows/stale-needs-repro.yml b/.github/workflows/stale-needs-repro.yml index 73f1771e945..e88ea42e51a 100644 --- a/.github/workflows/stale-needs-repro.yml +++ b/.github/workflows/stale-needs-repro.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli') steps: - - uses: actions/stale@v9 + - uses: actions/stale@v10 with: start-date: 2023-01-01T01:00:00Z stale-issue-label: "stale" diff --git a/.github/workflows/test-bundle.yml b/.github/workflows/test-bundle.yml index 847a3018d9e..ca43b88890c 100644 --- a/.github/workflows/test-bundle.yml +++ b/.github/workflows/test-bundle.yml @@ -16,7 +16,7 @@ jobs: if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli') steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: # checkout full tree fetch-depth: 0 diff --git a/.github/workflows/test-quarto-latexmk.yml b/.github/workflows/test-quarto-latexmk.yml index db865e38dad..266d3d407e8 100644 --- a/.github/workflows/test-quarto-latexmk.yml +++ b/.github/workflows/test-quarto-latexmk.yml @@ -22,7 +22,7 @@ jobs: - { os: ubuntu-latest } steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 with: fetch-depth: 0 @@ -55,7 +55,7 @@ jobs: ../dist/bin/tinitex/x86_64-unknown-linux-gnu/tinitex --help - name: Upload binary - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: tinitex-${{ matrix.config.os }} path: | diff --git a/.github/workflows/test-smokes-parallel.yml b/.github/workflows/test-smokes-parallel.yml index ef93a87d48c..d36cbe86b6e 100644 --- a/.github/workflows/test-smokes-parallel.yml +++ b/.github/workflows/test-smokes-parallel.yml @@ -53,7 +53,7 @@ jobs: BUCKETS: ${{ steps.tests-buckets.outputs.BUCKETS }} steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Set up Quarto uses: quarto-dev/quarto-actions/setup@v2 diff --git a/.github/workflows/test-smokes.yml b/.github/workflows/test-smokes.yml index 5adfde80c06..65e8788f4f0 100644 --- a/.github/workflows/test-smokes.yml +++ b/.github/workflows/test-smokes.yml @@ -60,7 +60,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Fix temp dir to use runner one (windows) if: runner.os == 'Windows' @@ -79,13 +79,13 @@ jobs: windows-path-include-rtools: false - name: Install node (for Playwright, MECA) - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version: 20 - name: Cache multiplex server node_modules if: ${{ runner.os != 'Windows' || github.event_name == 'schedule' }} - uses: actions/cache@v4 + uses: actions/cache@v5 with: path: tests/integration/playwright/multiplex-server/node_modules key: ${{ runner.os }}-multiplex-server-${{ hashFiles('tests/integration/playwright/multiplex-server/package.json') }} @@ -121,7 +121,7 @@ jobs: - name: Restore Renv package cache id: cache-renv-packages-restore - uses: actions/cache/restore@v4 + uses: actions/cache/restore@v5 with: path: | ${{ env.RENV_PATHS_ROOT }} @@ -340,7 +340,7 @@ jobs: shell: pwsh - name: Upload test timing file - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 if: matrix.time-test with: name: timed test file @@ -348,7 +348,7 @@ jobs: - name: Save Typst cache if: always() && steps.cache-typst.outputs.cache-hit != 'true' - uses: actions/cache/save@v4 + uses: actions/cache/save@v5 with: key: ${{ steps.cache-typst.outputs.cache-primary-key }} path: ${{ steps.cache-typst.outputs.cache-path }} @@ -356,14 +356,14 @@ jobs: - name: Save Renv package cache # don't save cache if we have extra R packages if: ${{ always() && steps.cache-renv-packages-restore.outputs.cache-hit != 'true' && inputs.extra-r-packages == '' }} - uses: actions/cache/save@v4 + uses: actions/cache/save@v5 with: path: | ${{ env.RENV_PATHS_ROOT }} renv/library key: ${{ steps.cache-renv-packages-restore.outputs.cache-primary-key }} - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 # Upload pLaywright test report if they exists (playwright is only running on Linux for now) if: ${{ !cancelled() && runner.os != 'Windows' && hashFiles('tests/integration/playwright/playwright-report/**/*') != '' }} with: diff --git a/.github/workflows/update-test-timing.yml b/.github/workflows/update-test-timing.yml index acd5de6f110..ad62b2afcdf 100644 --- a/.github/workflows/update-test-timing.yml +++ b/.github/workflows/update-test-timing.yml @@ -23,10 +23,10 @@ jobs: pull-requests: write steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Download timing file artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: timed test file path: tests/ diff --git a/.github/workflows/verify-tinytex-patterns.yml b/.github/workflows/verify-tinytex-patterns.yml index 29fb1359c8d..c7654dadd32 100644 --- a/.github/workflows/verify-tinytex-patterns.yml +++ b/.github/workflows/verify-tinytex-patterns.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Download and extract regex.json env: @@ -32,7 +32,7 @@ jobs: - name: Restore cached regex.json id: cache-restore - uses: actions/cache/restore@v4 + uses: actions/cache/restore@v5 with: path: .cache/regex.json key: tinytex-regex-latest @@ -160,7 +160,7 @@ jobs: - name: Save new cache if: steps.compare.outputs.changed == 'true' || steps.compare.outputs.first_run == 'true' - uses: actions/cache/save@v4 + uses: actions/cache/save@v5 with: path: .cache/regex.json key: tinytex-regex-latest From 0f1d93ad6b9e920c2bdb70d41ce454795ca334ff Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Thu, 12 Mar 2026 15:54:49 +0100 Subject: [PATCH 3/4] Update third-party GitHub Actions for Node.js 24 compatibility MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - astral-sh/setup-uv v3 → v7 - peter-evans/create-pull-request v7 → v8 - cloudsmith-io/cloudsmith-cli-action v1.0.8 → v2.0.2 --- .github/workflows/publish-cloudsmith.yml | 2 +- .github/workflows/test-smokes.yml | 2 +- .github/workflows/update-test-timing.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish-cloudsmith.yml b/.github/workflows/publish-cloudsmith.yml index 8756c72f507..4edcd8a2ea1 100644 --- a/.github/workflows/publish-cloudsmith.yml +++ b/.github/workflows/publish-cloudsmith.yml @@ -175,7 +175,7 @@ jobs: GH_REPO: quarto-dev/quarto-cli - name: Install and authenticate Cloudsmith CLI - uses: cloudsmith-io/cloudsmith-cli-action@v1.0.8 + uses: cloudsmith-io/cloudsmith-cli-action@v2.0.2 with: api-key: ${{ secrets.CLOUDSMITH_API_KEY }} diff --git a/.github/workflows/test-smokes.yml b/.github/workflows/test-smokes.yml index 65e8788f4f0..ebc05d40384 100644 --- a/.github/workflows/test-smokes.yml +++ b/.github/workflows/test-smokes.yml @@ -182,7 +182,7 @@ jobs: shell: Rscript {0} - name: Install uv for Python - uses: astral-sh/setup-uv@v3 + uses: astral-sh/setup-uv@v7 with: version: "0.9.5" enable-cache: true diff --git a/.github/workflows/update-test-timing.yml b/.github/workflows/update-test-timing.yml index ad62b2afcdf..94ffeb7a5d6 100644 --- a/.github/workflows/update-test-timing.yml +++ b/.github/workflows/update-test-timing.yml @@ -33,7 +33,7 @@ jobs: - name: Create Pull Request for new tests timing id: cpr - uses: peter-evans/create-pull-request@v7 + uses: peter-evans/create-pull-request@v8 with: token: ${{ secrets.GITHUB_TOKEN }} add-paths: tests/timing-for-ci.txt From 79cdf2ac7647f7efb5ee85743f30ff465da1be90 Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Thu, 12 Mar 2026 16:02:37 +0100 Subject: [PATCH 4/4] =?UTF-8?q?Bump=20Node.js=2020=20=E2=86=92=2022=20for?= =?UTF-8?q?=20Playwright/MECA=20in=20smoke=20tests?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Node 20 EOL is April 30, 2026. --- .github/workflows/test-smokes.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test-smokes.yml b/.github/workflows/test-smokes.yml index ebc05d40384..863e0d951ba 100644 --- a/.github/workflows/test-smokes.yml +++ b/.github/workflows/test-smokes.yml @@ -81,7 +81,7 @@ jobs: - name: Install node (for Playwright, MECA) uses: actions/setup-node@v6 with: - node-version: 20 + node-version: 22 - name: Cache multiplex server node_modules if: ${{ runner.os != 'Windows' || github.event_name == 'schedule' }}