[alexander-yevsyukov]

The Check Links job warned that Node.js 20 is deprecated for actions/cache@v4, actions/setup-node@v4, and robinraju/release-downloader@v1.7 (seen on SpineEventEngine/documentation#96). When links broke, the run page also showed only "Process completed with exit code 2", and the broken URLs were only in the raw step log. This PR fixes both in .github/workflows/check-links.yml.

Action versions

The runtimes come from runs.using in each tag's action.yml.

Action	Old	New	Breaking changes reviewed
actions/setup-node	v4 (node20)	v7 (node24)	v5 caches npm automatically when package.json has packageManager. v6 limits that automatic caching to npm. v7 moves to ESM and drops the dummy NODE_AUTH_TOKEN, which matters only with registry-url. The job sets cache: 'npm' and no registry-url, so none of these apply.
actions/cache (×3)	v4 (node20)	v6 (node24)	v5 is the node24 move. v6 migrates to ESM. Inputs are unchanged (path, key, restore-keys). cache-hit still means an exact key match, which the comment on the Lychee download step relies on.
robinraju/release-downloader	v1.7 (node16)	v1.13 (node24)	repository, tag, fileName and out-file-path work as before. v1.13 deletes the archive after extraction, but only when extract: true is set (src/main.ts), and this job doesn't set it. So the checksum and tar steps still find the tarball.
actions/checkout	v6 (node24)	unchanged
peaceiris/actions-hugo	v3 (node24)	unchanged

Lychee report on the run page

Lychee's report now also goes to the job summary, and the step log keeps it as before.

• Check links pipes Lychee through tee lychee-report.txt. The log is unchanged: locally, with Lychee 0.24.2, the output matched the current invocation apart from the timing figure.
• set -o pipefail keeps Lychee's exit code (2 on broken links). The default run: shell is bash -e without pipefail. Without it, the step would take tee's 0 and the job would pass despite broken links. I checked that locally too.
• The new Publish link report step (if: ${{ !cancelled() && hashFiles('lychee-report.txt') != '' }}) runs after a failed check too. It appends the report, in a text block, to $GITHUB_STEP_SUMMARY.

Why not --format markdown --output: in Lychee 0.24.2, --output moves the report from stdout to the file instead of copying it. Both stdout and stderr came out empty in a local run, so the log would lose the broken links. Lychee has no option for writing two formats in one run. Neither lychee.toml in documentation or spine.io sets format or output.

Consumers

./config/pull runs migrate, which copies check-links.yml into every repo with a Hugo site under docs/ or site/, unless that repo has a # config:replaces check-links.yml override. Neither has one, so documentation and spine.io get this change on their next ./config/pull.

Verification

• actionlint 1.7.12 with shellcheck reports nothing for check-links.yml.
• I ran both new step scripts locally against an HTML page with broken links. Check links exited 2, Publish link report exited 0, and the summary showed the per-page errors and the totals line.
• Config's own run of this workflow stops early, because config has no Hugo site. The first real run will be a consumer's next PR that touches docs/** after ./config/pull.

Out of scope: other distributed workflows still on node20 or older

These are in .github-workflows/, which only JVM repos receive. Config's own CI never runs them, so bumping them needs a check on a real JVM build. They are left for a follow-up:

Action	Workflow	Current	Latest node24
mikepenz/action-junit-report	build-on-ubuntu.yml, build-on-windows.yml	v4.0.3 (node20)	v6.6.1. v5 changes the summary format and rewrites nested-suite parsing.
al-cheb/configure-pagefile-action	build-on-windows.yml	v1.3 (node16)	v1.5. Same inputs and defaults.
actions/delete-package-versions	remove-obsolete-artifacts-from-packages.yaml	v5 (node20)	No node24 release yet. v5.0.0 is the latest, and main is still node20.

All other actions in .github/workflows/ and .github-workflows/ already run on node24, or are composite actions whose nested actions do.

actionlint also flags issues in files this PR doesn't touch, which are already on master: concurrency: queue: max in publishing.yml and publish-api-docs.yml (a key actionlint 1.7.12 doesn't recognize yet), and two SC2086 info notes in remove-obsolete-artifacts-from-packages.yaml.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T18:27:13.102510Z	06457ad	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approved

No active review issues are recorded for the workflow action upgrades and Lychee report-summary changes.

No open issues 🎉

What changed in this PR

Updates the shared Hugo link-checking workflow to use Node.js 24-based actions and display Lychee’s report on the workflow run page.

Changes:

• Upgrades setup-node, cache, and release-downloader to newer action versions.
• Saves Lychee’s output while preserving step logs and failure status.
• Adds the saved report to the job summary, including after failed link checks.

File	Description
.github/​workflows/​check-links.yml	Updates action versions and publishes Lychee’s report to the job summary.

_{Review effort: Balanced}