Skip to content
build

security: harden contribution workflow governance #83

Sign in to view logs

security: harden contribution workflow governance

security: harden contribution workflow governance #83

Triggered via pull request September 2, 2026 04:23
@lawrencecchenlawrencecchen
opened #11
security/governance-hardening
Status Success
Total duration 40s
Artifacts –

nodejs.yml

on: pull_request
Matrix: build
Fit to window
Zoom out
Zoom in

Annotations

22 warnings
build (22.x)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11d5960a326750d5838078e36cf38b85af677262, actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
build (22.x)
Ignored a CLA marker comment because it was not written by the canonical GitHub Actions bot.
build (22.x)
Ignored a CLA marker comment because it was not written by the canonical GitHub Actions bot.
build (22.x)
Another Pull Request created the CLA signature ledger concurrently. Continuing with the confirmed ledger.
build (22.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (22.x)
Another Pull Request created the CLA signature ledger concurrently. Continuing with the confirmed ledger.
build (22.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (22.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (22.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (22.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (22.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (24.x)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11d5960a326750d5838078e36cf38b85af677262, actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
build (24.x)
Another Pull Request created the CLA signature ledger concurrently. Continuing with the confirmed ledger.
build (24.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (24.x)
Another Pull Request created the CLA signature ledger concurrently. Continuing with the confirmed ledger.
build (24.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (24.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (24.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (24.x)
Ignored a CLA marker comment because it was not written by the canonical GitHub Actions bot.
build (24.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.
build (24.x)
Ignored a CLA marker comment because it was not written by the canonical GitHub Actions bot.
build (24.x)
The deprecated 'allowlist' input is ignored because names, emails, and globs can be spoofed in commit metadata. Use 'allowlist-ids' only for authenticated Pull Request opener IDs.