ci(build): standardize Node.js 24 across all CI workflows

[WilliamBerryiii]

Description

Standardized Node.js 24 across all CI/CD workflow files to resolve compatibility failures with packages requiring Node >= 22.18.0. Six GitHub Actions workflows were updated — three received new setup-node steps that were previously missing (relying on the runner's default Node 20.x), and three had existing Node.js version references upgraded from older versions to 24.

This change unblocks the cspell 10.0.0 upgrade (PR #342), which requires Node >= 22.18.0 at runtime. An audit of all 28 workflow files in .github/workflows/ confirmed no other workflows require Node.js setup changes.

Related Issue

• Related to ci(workflows): standardize Node.js 24 across all CI workflows #353
• Related to PR chore(deps)(deps): bump cspell from 9.7.0 to 10.0.0 #342

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe):

Implementation Details

New setup-node Steps Added

Three workflows lacked explicit Node.js setup and relied on the runner's default version. Each received a new actions/setup-node step positioned before the first npm command:

• code-quality-lint.yml — added setup-node with node-version: '24' before dependency installation
• docs-lint.yml — added setup-node with node-version: '24' before dependency installation
• security-scan.yml — added setup-node with node-version: '24' before secretlint installation

Existing Node.js Versions Upgraded

Three workflows had explicit but outdated Node.js version references that were bumped to 24:

• docs-automation.yml — upgraded from '18' to '24' in two job steps (validate-links and build-documentation)
• pages-deploy.yml — upgraded from '18' to '24'
• cluster-test-terraform.yml — upgraded from '22.x' to '24'

Supply Chain Security

All setup-node steps use the same pinned action SHA (actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4.3.0) for supply chain integrity.

Testing Performed

• Terraform plan/apply
• Blueprint deployment test
• Unit tests
• Integration tests
• Bug fix includes regression test (see Test Policy)
• Manual validation
• Other:

Validation Steps

1. Verify all 6 workflow files reference node-version: '24'
2. Confirm all setup-node steps use pinned SHA 53b83947a5a98c8d113130e565377fae1a50d02f
3. Trigger a CI run to confirm workflows execute successfully with Node 24

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

Additional Notes

• The unchecked Terraform and Bicep checklist items are not applicable — this PR modifies only CI/CD workflow YAML files.
• Documentation updates are not required; no user-facing behavior changed.

Screenshots (if applicable)

N/A — CI/CD pipeline changes only.