From 93ca7587cec71e5c48b786ee2e6a011aa111e25c Mon Sep 17 00:00:00 2001
From: cproudlock <cproudlock@localhost>
Date: Fri, 28 Aug 2026 15:22:13 -0400
Subject: [PATCH] Move the workflow actions onto their Node 24 releases

Every job on GitHub is warning:

    Node.js 20 is deprecated. The following actions target Node.js 20 but are
    being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4

Working today because the runners shim it, and a hard failure the day that shim
goes. checkout@v5, setup-node@v5 and setup-python@v6 are the releases built for
Node 24, so the warning goes away rather than being suppressed.

Nine references across five jobs. The comment above them says why, so nobody
pins them back to the v4 generation on the assumption it is the safer number.

The org's actions policy allows GitHub-owned actions with no SHA pinning
required, so the tag change needs no allow-list update.
---
 .github/workflows/ci.yml | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8abb2382..bfa99c3d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,11 @@
 
 name: CI
 
+# Action versions are the Node 24 native releases (checkout@v5, setup-node@v5,
+# setup-python@v6). The v4/v5 generation targets Node 20, which the runners now
+# force onto Node 24 with a deprecation warning on every job - working today,
+# a hard failure whenever GitHub drops the shim.
+#
 # Jobs run on the org's self-hosted "arc-runner-set" (enterprise
 # ge-aerospace-runner-group, Linux). GitHub-hosted runners are blocked by the
 # org IP allow list (hosted Azure runner IPs are not allow-listed -> checkout
@@ -34,8 +39,8 @@ jobs:
   backend:
     runs-on: arc-runner-set
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.14'
           cache: pip
@@ -45,7 +50,7 @@ jobs:
   naming:
     runs-on: arc-runner-set
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - run: bash scripts/check-naming-and-style.sh
 
   gates:
@@ -58,8 +63,8 @@ jobs:
     # it again.
     runs-on: arc-runner-set
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.14'
           cache: pip
@@ -72,8 +77,8 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: '20'
           cache: npm
@@ -88,8 +93,8 @@ jobs:
     # code is absent from the bundle - the delete-a-plugin guarantee in CI.
     runs-on: arc-runner-set
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: '20'
           cache: npm