Bump GitHub Actions versions

[masteradhoc]

What?

Bump GitHub Actions versions to resolve Node.js 20 deprecation warnings.

Why?

GitHub has announced that Node.js 20 will be removed from Actions runners by default on June 2nd, 2026, with full removal in fall 2026. The workflows were producing deprecation warnings for actions/checkout, actions/setup-node, and nick-fields/retry. Additionally, deploy.yml was lagging further behind on @v3 versions.

How?

Version bumps only — no logic or input changes:

• actions/checkout@v3 / @v4 → @v6 (Node.js 24 runtime, also improves credential security)
• actions/setup-node@v3 / @v4 → @v5 (Node.js 24 runtime)

Testing Instructions

1. Open a PR or push a commit to trigger the Test workflow
2. Confirm no Node.js 20 deprecation warnings appear in the Actions run logs
3. Confirm all jobs in test.yml pass as before
4. For deploy.yml, confirm it is syntactically valid (a dry-run merge to master or a test tag would exercise it fully)

Important Note
We'll still have two issues:
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: nick-fields/retry@v3, shivammathur/setup-php@v2.

Those repositories still need to work on the upgrade

• shivammathur/setup-php see Update to Node 24 shivammathur/setup-php#1049 (Update: should work soon now as its released)
• nick-fields/retry see Migrate from node 20 to 24. nick-fields/retry#162
• WordPress/props-bot-action see Upgrade Node.js action version from 20 to 24 props-bot-action#227

Subscribed to them to bump those as well as soon as they are available

Changelog Entry

Changed - Bump actions/checkout to v6, actions/setup-node to v5 to resolve Node.js 20 deprecation warnings ahead of the June 2026 deadline.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>
Co-authored-by: desrosj <desrosj@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[masteradhoc]

rework

[desrosj]

Thanks! There are some adjustments that I see should be made to a few of these action calls, but not a blocker for this. I will open up some follow up tickets.

[desrosj]

The Props Bot is currently the only one that we do not strictly enforce this policy with at this time because it's a "first-party" action under the WordPress project's umbrella. But this is fine to include. Once the dust settles from 7.0 I plan to convert this into a proper action vs. a composite one, which will make it easier for Dependabot to manage updates for (currently there is not true versioning in place).

[masteradhoc]

Thanks! Yeah we can easily update this after the WP7.0 release. I know a lot work needed to get that out :)