From b361963ca69fd5210966605faa08cd3cb1e47b64 Mon Sep 17 00:00:00 2001
From: Jacob Heider <jacob@pkgx.dev>
Date: Fri, 13 Mar 2026 11:57:54 -0400
Subject: [PATCH 1/2] ci-node24

---
 .github/actions/setup/action.yml   | 4 ++--
 .github/workflows/ci.yml           | 4 ++--
 .github/workflows/pkg-platform.yml | 8 ++++----
 .github/workflows/pkg.yml          | 2 +-
 .github/workflows/restock.yml      | 2 +-
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 57bff3b895..3316cee242 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -41,7 +41,7 @@ runs:
       if: runner.os == 'macOS' && inputs.p12-password && inputs.p12-file-base64
       run: security delete-keychain signing_temp.keychain || true
 
-    - uses: apple-actions/import-codesign-certs@v2
+    - uses: apple-actions/import-codesign-certs@v6
       if: runner.os == 'macOS' && inputs.p12-password && inputs.p12-file-base64
       with:
         p12-file-base64: ${{ inputs.p12-file-base64 }}
@@ -49,7 +49,7 @@ runs:
 
     # Needed for self-hosted runner, since it doesn't destroy itself automatically.
     - name: Delete keychain
-      uses: webiny/action-post-run@3.0.0
+      uses: webiny/action-post-run@1bf3b5b9b29d8c6141db0222d20b6f9fb5e75c46
       if: runner.os == 'macOS' && inputs.p12-password && inputs.p12-file-base64
       with:
         run: security delete-keychain signing_temp.keychain
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 093d284a18..26b19fa407 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
     outputs:
       matrix: ${{ steps.process-diff.outputs.matrix }}
     steps:
-      - uses: pkgxdev/setup@v4
+      - uses: pkgxdev/setup@v5
       - uses: actions/checkout@v6
       - uses: technote-space/get-diff-action@v6
         id: get-diff
@@ -64,7 +64,7 @@ jobs:
           p12-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
           APPLE_IDENTITY: ${{ github.repository == 'pkgxdev/pantry' && secrets.APPLE_IDENTITY || '-' }}
 
-      - uses: pkgxdev/setup@v4
+      - uses: pkgxdev/setup@v5
         with:
           PKGX_DIR: /opt
 
diff --git a/.github/workflows/pkg-platform.yml b/.github/workflows/pkg-platform.yml
index 75a882832e..2f4a8c3383 100644
--- a/.github/workflows/pkg-platform.yml
+++ b/.github/workflows/pkg-platform.yml
@@ -81,7 +81,7 @@ jobs:
           p12-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
           APPLE_IDENTITY: ${{ secrets.APPLE_IDENTITY }}
 
-      - uses: pkgxdev/setup@v4
+      - uses: pkgxdev/setup@v5
         with:
           PKGX_DIR: /opt
 
@@ -131,7 +131,7 @@ jobs:
 
       - uses: actions/checkout@v6
       - uses: ./.github/actions/setup
-      - uses: pkgxdev/setup@v4
+      - uses: pkgxdev/setup@v5
 
       - uses: pkgxdev/brewkit/download-build-artifact@v1
         with:
@@ -152,7 +152,7 @@ jobs:
       AWS: ${{ inputs.dry-run && 'echo' || 'aws' }}
       PREFIX: ${{ needs.build.outputs.project }}/${{ needs.build.outputs.platform }}/${{ needs.build.outputs.arch }}/v${{ needs.build.outputs.version }}.tar.${{ matrix.compression }}
     steps:
-      - uses: pkgxdev/setup@v4
+      - uses: pkgxdev/setup@v5
 
       - uses: actions/checkout@v6
 
@@ -263,7 +263,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-east-1
 
-      - uses: pkgxdev/setup@v4
+      - uses: pkgxdev/setup@v5
 
       - name: generate versions.txt
         run: |
diff --git a/.github/workflows/pkg.yml b/.github/workflows/pkg.yml
index 8f4f421029..5e88f4adce 100644
--- a/.github/workflows/pkg.yml
+++ b/.github/workflows/pkg.yml
@@ -24,7 +24,7 @@ jobs:
       matrix: ${{ steps.matrix.outputs.matrix }}
       pkg: ${{ steps.id.outputs.pkg-json }}
     steps:
-      - uses: pkgxdev/setup@v4
+      - uses: pkgxdev/setup@v5
       - uses: actions/checkout@v6
       - run: .github/scripts/get-matrix.ts ${{ inputs.pkg }}
         id: matrix
diff --git a/.github/workflows/restock.yml b/.github/workflows/restock.yml
index 2d9d17ad85..64b6e82eee 100644
--- a/.github/workflows/restock.yml
+++ b/.github/workflows/restock.yml
@@ -15,7 +15,7 @@ jobs:
     outputs:
       versions: ${{ steps.inventory.outputs.versions }}
     steps:
-      - uses: pkgxdev/setup@v4
+      - uses: pkgxdev/setup@v5
       - uses: actions/checkout@v6
       - run: ./.github/scripts/inventory.ts ${{ inputs.project }}
         id: inventory

From 3d5d7463a755942e39ae608aa4610192a4e8dfdc Mon Sep 17 00:00:00 2001
From: Jacob Heider <jacob@pkgx.dev>
Date: Fri, 13 Mar 2026 12:20:47 -0400
Subject: [PATCH 2/2] apple's job handles this now

---
 .github/actions/setup/action.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 3316cee242..df748bb94e 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -47,13 +47,6 @@ runs:
         p12-file-base64: ${{ inputs.p12-file-base64 }}
         p12-password: ${{ inputs.p12-password }}
 
-    # Needed for self-hosted runner, since it doesn't destroy itself automatically.
-    - name: Delete keychain
-      uses: webiny/action-post-run@1bf3b5b9b29d8c6141db0222d20b6f9fb5e75c46
-      if: runner.os == 'macOS' && inputs.p12-password && inputs.p12-file-base64
-      with:
-        run: security delete-keychain signing_temp.keychain
-
     # the intention is to make none of these required eventually
     - name: apt-get install
       run: |