chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • actions/setup-go@v5 → @b7ad1dad... # v7.0.0
  • goreleaser/goreleaser-action@v5 → @f06c13b6... # v7.2.3
  • actions/upload-artifact@v4 → @043fb46d... # v7.0.1

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• mszostok/codeowners-validator@v0.7.1 — Docker-based action, not affected by the Node runtime deprecation; no Node 24 release exists
• cloudposse/github-action-docker-promote@0.3.0 and cloudposse/github-action-docker-build-push@1.15.1 — composite actions not in the upgrade matrix; left as-is

[Copilot]

Pull request overview

Updates this repository’s GitHub Actions workflow dependencies to SHA-pinned revisions that run on the Node 24 runtime, addressing the Node 20 deprecation and improving supply-chain safety via immutable references.

Changes:

• Pin actions/checkout to a specific SHA (# v7.0.1) in workflows that perform checkouts.
• Pin actions/setup-go, goreleaser/goreleaser-action, and actions/upload-artifact to specific SHAs (with tag comments) in the feature-branch workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/validate-codeowners.yml	Pins actions/checkout to a specific SHA with a version comment.
.github/workflows/feature-branch.yml	Pins multiple commonly-used actions to specific SHAs with version comments.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

CI triage for this PR

ci-go — caused by this PR, fixed in 6adbad3. Bumping goreleaser/goreleaser-action v5 → v7 changed what version: latest resolves to: v5 locked to GoReleaser ~> v1, v7 locks to ~> v2 (v2.17.1), which refuses the old version: 0 config ("only version: 2 configuration files are supported"). Migrated dev.goreleaser.yaml to the v2 schema (version: 2, archives.formats, changelog.disable) and validated it with goreleaser check using the same v2.17.1 binary CI downloads.

ci-docker — pre-existing, needs a maintainer. The build itself succeeds; the failure is the Get Metadata step inside cloudposse/github-action-docker-build-push@1.15.1, which inlines the buildx metadata JSON into a single-quoted shell string and dies with syntax error near unexpected token '('. This PR only bumped actions/checkout in that job, which cannot affect metadata parsing. The identical failure hits slack-notifier renovate branches that don't touch this job at all (e.g. renovate/actions-setup-go-7.x run 29480214208 on 2026-07-16; renovate branches failing since 2025-12-24). Fix belongs upstream in github-action-docker-build-push (or bump to its v3.x — a renovate PR for that exists in slack-notifier).

validate-codeowners — pre-existing, fixed in efc17cd. The owners check failed with Teams for organization "cloudposse" could not be queried. Requires GitHub authorization. — the dead org token issue, unrelated to any changed line. Replaced the workflow with the org-standard shared cloudposse/.github/.github/workflows/shared-codeowners.yml@main (this workflow triggers on pull_request, so the fix takes effect on this PR).

[John C. Bland II (johncblandii)]

Rather than leaving ci-docker as needs-maintainer: bumped cloudposse/github-action-docker-build-push@1.15.1 → @02993d67... # v3.1.0 (dd5d95f). The 1.15.1 composite's Get Metadata step has a shell syntax error that's failed this job on every branch since Dec 2025; all six inputs this workflow passes exist unchanged in v3 (verified against its action.yml), and the SHA is verified against the v3.1.0 tag.