chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/setup-node@v4 → @82076278... # v7.0.0
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • docker/metadata-action@v5 → @dc802804... # v6.2.0
  • aws-actions/configure-aws-credentials@v4 → @e6de0542... # v6.2.3

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• mszostok/codeowners-validator@v0.5.0 — Docker-based action, not affected by the Node runtime deprecation; no Node 24 release exists
• cloudposse/github-action-auto-release@v1 — composite action not in the upgrade matrix; left as-is

[Copilot]

Pull request overview

Updates GitHub Actions workflow dependencies to SHA-pinned revisions that run on the Node 24 action runtime, reducing Node 20 deprecation warnings and improving supply-chain integrity via immutable pins.

Changes:

• Replaced floating uses: ...@v* references with commit-SHA pins plus tag-version comments for actions/checkout, actions/setup-node, docker/metadata-action, and aws-actions/configure-aws-credentials.
• Applied the same actions/checkout SHA pin to the CODEOWNERS validation workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/validate-codeowners.yml	Pins actions/checkout to a specific commit SHA with an upstream tag comment.
.github/workflows/lambda.yml	Pins multiple actions (setup-node, checkout, metadata-action, configure-aws-credentials) to specific SHAs with tag comments.

Suppressed comments (1)

.github/workflows/lambda.yml:105

• role-session-name references ${{ env.IAM_ROLE_SESSION_NAME }}, but the workflow-level env: defines IAM_ROLE_SEESION_NAME (typo). As written, this expression will resolve to an empty string and can cause STS to use a default session name, making audit trails and debugging harder. Align the reference (or rename the env key) so the intended session name is actually used.

        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        with:
          aws-region: us-east-2
          role-to-assume: ${{ env.IAM_ROLE_ARN_S3 }}
          role-session-name: ${{ env.IAM_ROLE_SESSION_NAME }}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

Also fixed the pre-existing IAM_ROLE_SEESION_NAME env typo flagged in review — role-session-name was resolving to an empty string.

[John C. Bland II (johncblandii)]

Same follow-up as ses-lambda-forwarder: the un-typo'd session name cloudposse/token-rotator/ci violates AWS's [\w+=,.@-]* pattern (no slashes) — the typo had been masking it via empty-string fallback. Now cloudposse-token-rotator-ci (413501d).

[John C. Bland II (johncblandii)]

CI triage summary for build-test-distribute: the pin bumps are clean — after the session-name fix, Configure AWS Credentials passes and the failure is in Test Affected Projects, where the lambda's test suite calls the GitHub API and gets "Integration not found" — the GitHub App the test credentials reference no longer exists (or the secret is stale). This is pre-existing: the same workflow fails identically on every Renovate branch (e.g. renovate/node-20.x-lockfile, renovate/aws-sdk-js-v3-monorepo on Aug 12, before this PR). Needs a maintainer to rotate the App credentials/secrets; nothing in this PR can fix it.

[John C. Bland II (johncblandii)]

CI triage for this PR

build-test-distribute — pre-existing, needs a maintainer. The failing test is lambdas › token-rotator › completes without error in apps/token-rotator/src/main.spec.ts, which calls the live GitHub API and fails with HttpError: Integration not found — the GitHub App the test credentials point at no longer exists (or the App ID/private key secrets are stale). The identical failure occurs on renovate branches that predate this PR: renovate/node-20.x-lockfile (run 31643223460, 2026-08-12) and renovate/aws-sdk-js-v3-monorepo (failing since at least 2026-07-31). Nothing in this PR touches app code or test credentials. A maintainer needs to restore/replace the GitHub App credentials, or mock this integration test.

validate-codeowners — pre-existing, fixed in c39ef08. The owners check failed with Teams for organization "cloudposse" could not be queried. Requires GitHub authorization. — the dead org token issue; it fails the same way on all recent renovate branches. Replaced the workflow with the org-standard shared cloudposse/.github/.github/workflows/shared-codeowners.yml@main (this workflow triggers on pull_request, so the fix takes effect on this PR).

[John C. Bland II (johncblandii)]

Deeper root cause on build-test-distribute (158fdfd): the failing test is a live-API test wired to a dead fixture — the committed .env.test authenticates as GitHub App 217830 in the third-party skedrocket org, which no longer exists, so the GitHub API returns "Integration not found" unconditionally. This test cannot pass for anyone in any environment; it is not a secret-rotation issue as first assumed. I've marked it it.skip with restoration notes in the code rather than leave every build red.

Maintainer follow-ups:

1. Restore the test properly: recreate a test App under cloudposse (and reference its key via a secret), or mock the GitHub API (e.g. nock) so the handler test runs hermetically.
2. Hygiene: .env.test commits that App's private key to the repo. The App is dead so the key is inert, but it should be removed from the tree (and history if policy requires).

🤖 Addressed by Claude Code

[Erik Osterman (Cloud Posse) (osterman)]

The workflow changes here are sound — all four SHAs verified against upstream tags, and the IAM_ROLE_SEESION_NAME typo fix is a real bug fix, not scope creep. Two things need to happen before this merges, though.

1. The skipped test needs a tracking issue, not just a code comment.

it.skip on lambdas › token-rotator › completes without error in apps/token-rotator/src/main.spec.ts is the only handler test in the repo. The only other specs are guard.spec.ts and stringHelpers.spec.ts, and libs/github has none at all — so this leaves the entire GitHub-auth → registration-token → SSM-put path with zero test coverage, in a credential-rotation service.

I accept the premise: it was failing 100% of the time on every branch, so no working coverage is lost. But right now CI goes green forever while the rotation path is untested, and the only record is an inline comment plus a PR comment. Please open an issue with an owner and reference it from the it.skip, so this doesn't quietly become permanent.

2. .env.test still contains a committed private key.

The private key for GitHub App 217830 (third-party skedrocket org) is sitting at the repo root in a public repo. You flagged it and nobody has acted. The app is dead so the key is inert, but that's a bad thing to leave in the tree — please delete it here, and let's scrub it from history separately.

One operational note, not blocking: the session-name fix changes the STS session name from cloudposse/token-rotator/ci to cloudposse-token-rotator-ci (AWS rejects slashes — [\w+=,.@-]*). It was resolving to empty string before, so this is strictly better, but anyone reading CloudTrail for the cplive-core-ue2-public-lambda-artifacts-gha role should know the string changed.

Also odd next to a "Node 24 runtime" title: the job still installs Node 16.x (EOL) to build the Lambda. Untouched by this PR, but worth a follow-up.

Confirmed for the record: no IAM role, trust policy, or permissions changes — permissions: stays id-token: write / contents: read, and no auth logic or key-handling code was modified.

[John C. Bland II (johncblandii)]

Erik Osterman (Cloud Posse) (@osterman) — both done in 4e416f9:

1. Tracking issue opened: Restore handler test coverage for the token-rotation path #63 (owner-assignable) documents the zero-coverage gap on the GitHub-auth → registration-token → SSM-put path, the dead-fixture root cause, and both restoration options (hermetic nock mocking preferred, or a real test App with secrets-injected credentials). The it.skip comment now references it directly.
2. Private key removed: .env.test now carries obviously-fake placeholders with a comment pointing at Restore handler test coverage for the token-rotation path #63 and a never-commit-secrets note. The original key remains in git history — inert since App 217830 is deleted — which Restore handler test coverage for the token-rotation path #63 records as a hygiene follow-up should a history rewrite ever be done.

🤖 Addressed by Claude Code