Node.js 20 deprecation warning in GitHub Actions workflows

[piyushsinghgaur1]

Describe the bug

GitHub Actions runs in this repository emit the deprecation annotation:

Node.js 20 is deprecated. Please update to a version that is supported by GitHub Actions. Please see https://github.blog/changelog/2025-09-19-github-actions-transitioning-from-node20-to-node24 for more information.

The cause is that our workflows still pin actions/checkout@v4 and actions/setup-node@v4. Those majors declare using: node20 in their action.yml, so every job that uses them raises the warning. GitHub will eventually stop providing the Node 20 runtime, at which point these steps fail rather than warn.

Separately, .github/workflows/release.yaml pins node-version: '24'-eligible tooling to Node 22, which is behind the version the CI matrix already tests against.

Affected workflows:

• .github/workflows/main.yaml — actions/checkout@v4, actions/setup-node@v4
• .github/workflows/release.yaml — actions/checkout@v4, actions/setup-node@v4, node-version: '22'
• .github/workflows/sync-docs.yaml — actions/checkout@v4 (x2)
• .github/workflows/trivy.yaml — actions/checkout@v4

To Reproduce

Steps to reproduce the behavior:

1. Open any recent workflow run in the Actions tab (for example the CI workflow on a pull request).
2. Look at the run summary / annotations panel.
3. See the "Node.js 20 is deprecated" warning attached to the checkout and setup-node steps.

Expected behavior

Workflow runs complete with no Node runtime deprecation annotations. Every first-party actions/* step should resolve to a major version whose action.yml declares using: node24.

Fix needed

• Bump actions/checkout@v4 to @v5 (node24) in all four workflows.
• Bump actions/setup-node@v4 to @v5 (node24) in main.yaml and release.yaml.
• Bump the release workflow's node-version from '22' to '24'.

Additional context

• The node_matrix_tests matrix in main.yaml is already [22, 24] and should stay as-is — dropping 22 would reduce our supported-version coverage.
• aquasecurity/trivy-action in trivy.yaml is SHA-pinned and is a Docker-based action, so it is unaffected by the Node runtime transition and should be left alone.
• Reference: https://github.blog/changelog/2025-09-19-github-actions-transitioning-from-node20-to-node24