[Due for payment 2026-06-12] [No QA] Migrate third-party GitHub Actions off deprecated node20/node16 runtimes

[mountiny]

Background

Two related deadlines are converging:

1. Node 20 hit EOL on April 30, 2026 — no more security patches.
2. GitHub removes Node 20 as the default Actions runtime on June 16, 2026 — runners will default to Node 24. Actions still declaring using: node20 will emit deprecation warnings; Node 20 will be fully removed from runners in fall 2026.

Changelog: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Actions that need updating

Action	Current runtime	Fix
actions/download-artifact (pinned to v6 SHA)	node20	bump to v8.0.1
1password/load-secrets-action (two pinned SHAs)	node20	bump to v4.0.0
aws-actions/configure-aws-credentials (one of two pinned SHAs)	node20	bump to v6.1.3
actions/setup-java	node20	bump to v5.2.0
dorny/paths-filter	node20	bump to v4.0.1
mxschmitt/action-tmate	node20	bump to v3.24
ruby/setup-ruby (one of two pinned SHAs)	node20	bump to v1.310.0
cloudflare/pages-action	node16 (repo archived, will never be updated)	migrate to cloudflare/wrangler-action v4.0.0
8398a7/action-slack	node20 (repo archived, will never be updated)	migrate to slackapi/slack-github-action v3.0.3

Plan

One PR per action, all linked to this issue.