[Chore] Bump GitHub Actions to node24 runtimes to fix Node 20 deprecation warnings

[zoomote]

​Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Discord.

Related GitHub Issue

N/A — initiated from a maintainer request in Discord (no tracking issue exists; Renovate has no open PR or config covering github-actions updates in this repo). Happy to file/link an issue if preferred.

Description

GitHub deprecated the Node.js 20 action runtime, and the runner now force-runs node20-era actions on its node24 runtime while emitting deprecation warnings on every job (e.g. "The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache/restore, actions/cache/save, actions/cache, actions/checkout, actions/setup-node, pnpm/action-setup").

This is separate from the project's Node toolchain: there are two Node versions in play on GitHub Actions. The project toolchain (installed by actions/setup-node, pinned to 22.23.1 via .nvmrc, .tool-versions, package.json engines, and the setup-node-pnpm composite action default) is unchanged by this PR. What changes is the runtime the helper actions themselves execute on, declared by each action's own action.yml (runs.using).

Every pinned node20-era action is bumped to the latest stable release declaring node24 (verified against each action's action.yml at the pinned commit; annotated tags pinned at their peeled commit SHA):

Action	Old	New
actions/checkout	34e1148 # v4	3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
actions/setup-node	49933ea # v4	820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
actions/cache, cache/restore, cache/save	0057852 # v4	55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
pnpm/action-setup	b906aff # v4	0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
actions/upload-artifact	ea165f8 # v4	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
actions/download-artifact	d3f86a1 # v4	3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
codecov/codecov-action	b9fd7d1 # v4	fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
github/codeql-action (init, analyze)	411c4c9 # v3	cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
actions/stale	5bef64f # v9	4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0

Reviewer notes:

• setup-node v6+ limits its built-in caching to npm — not an issue here: no workflow uses the cache: input on setup-node (verified by search); pnpm store caching uses explicit actions/cache steps, which are bumped in the same pass.
• Already current, not changed: actions/dependency-review-action v5.0.0 and actions/github-script v8 already declare node24.
• Known remaining warning source: 8398a7/action-slack@v3 (used only in the slack-notify composite action) is an archived repo with no node24 release; it stays as-is. Replacing it would be a separate change.
• codecov-action v5+ is a composite action wrapping the Codecov CLI; the existing inputs (files, disable_search, flags, token) are still supported.
• upload/download-artifact breaking changes (immutable artifacts, no hidden-file pickup) landed in v4.4, which the repo already ran (ea165f8); v5+ are runtime bumps.
• No Node toolchain pins changed anywhere; 22.23.1 remains the project version.

Test Procedure

• pnpm test — full turbo run passes: 10/10 packages, 468 test files, 8064 tests passed, 39 skipped.
• Pre-commit hooks passed: pnpm lint (11/11 packages) and pnpm check-types (11/11 packages).
• All 14 workflow/action YAML files parse cleanly (js-yaml).
• Repo-wide search confirms zero remaining references to the 9 old SHAs outside .git.
• Runtime claim verified per action by reading runs.using from the upstream action.yml at each new pinned SHA.
• Reviewers can confirm end-to-end by checking this PR's own CI run: the "Node.js 20 is deprecated" annotation should be gone (except possibly the action-slack note above on jobs that notify Slack).

Pre-Submission Checklist

• Issue Linked: No issue exists; request came via Discord (see above).
• Scope: Single concern — CI action runtime bumps only.
• Self-Review: Full diff reviewed; all 46 changed lines are SHA pin + trailing comment swaps.
• Testing: No source code changed; full test suite, lint, and type checks pass.
• Visual Snapshot (UI changes only): N/A — no UI changes.
• Documentation Impact: No user-facing documentation impact (internal CI config only).
• Contribution Guidelines: I have read and agree to the Contributor Guidelines.

Visual Snapshots

N/A — CI configuration change with no rendered UI.

Videos (interaction / animation only)

N/A.

Documentation Updates

• No documentation updates are required.

Additional Notes

Nothing is merged by this automation; PR opened as a draft for maintainer review.

Get in Touch

Requested by Elliott de Launay via Discord; follow up by mentioning @roomote in the linked Discord thread or the task web UI above.

[github-actions]

Review status

This PR was opened by an automated account. A human maintainer must verify the change intent, provenance, and validation before merging.

Current step: The required review sequence passed. Remaining merge requirements apply.

Review-state labels are managed by this workflow; do not edit them manually.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!