chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • actions/setup-go@v5 → @b7ad1dad... # v7.0.0
  • goreleaser/goreleaser-action@v5 → @f06c13b6... # v7.2.3
  • actions/upload-artifact@v4 → @043fb46d... # v7.0.1

Supersedes #40
Supersedes #41
Supersedes #37
Supersedes #34

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• cloudposse/github-action-docker-promote@0.3.0 — no node24 release at the time of writing; left as-is

docker-build-push 1.15.1 → v3.1.0 (major crossed — added after the original body)

• Why: 1.15.1's Get Metadata step has a shell syntax error that failed ci-docker on every
  branch since 2025-12-24 — the job could not run at all. v3.1.0 fixes it.
• Inputs: all six passed by this workflow exist unchanged in v3's action.yml.
• Tag generation: the docker/metadata-action tag templates are byte-identical between 1.15.1
  and v3.1.0; what changes underneath is metadata-action v5→v6 / build-push-action →v7 — the
  layer to watch on the first push to the default branch.
• Not transitive: this pin does not pin v3.1.0's own internals (it floats docker/* majors).
• Now pinned to v3.2.1 (ff59bd5b...), which ships the null-Entrypoint/Cmd guards —
  the interim summary: "false" workaround is reverted.

[Copilot]

Pull request overview

Updates the repository’s CI workflow to use SHA-pinned GitHub Actions versions that run on the Node 24 runtime, aligning with the deprecation of Node 20 on GitHub-hosted runners and improving supply-chain integrity via immutable refs.

Changes:

• Replace actions/checkout, actions/setup-go, goreleaser/goreleaser-action, and actions/upload-artifact version tags with verified, full-length commit SHAs plus version comments.
• Keep existing workflow behavior/config the same (inputs and step wiring unchanged), only upgrading the action runtimes/refs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

CI triage for this PR

ci-go — caused by this PR, fixed in 44b34ff. Bumping goreleaser/goreleaser-action v5 → v7 changed what version: latest resolves to: v5 locked to GoReleaser ~> v1, v7 locks to ~> v2 (v2.17.1), which refuses the old version: 0 config. Migrated dev.goreleaser.yaml to the v2 schema (version: 2, archives.formats, changelog.disable) and validated it with goreleaser check using the same v2.17.1 binary CI downloads. (Corroborating evidence: the renovate/goreleaser-goreleaser-action-7.x branch failed the same way on 2026-02-21, while renovate branches that kept v5 passed ci-go.)

ci-docker — pre-existing, needs a maintainer. The build itself succeeds; the failure is the Get Metadata step inside cloudposse/github-action-docker-build-push@1.15.1, which inlines the buildx metadata JSON into a single-quoted shell string and dies with syntax error near unexpected token '('. The same failure has been hitting renovate branches that don't touch this job: renovate/actions-setup-go-7.x (run 29480214208, 2026-07-16), renovate/actions-checkout-7.x (2026-06-18), renovate/alpine-3.x (2026-06-09) — Feature branch has been red on every renovate PR since 2025-12-24. This PR only bumped actions/checkout in that job. Fix belongs upstream in github-action-docker-build-push, or take the open renovate PR bumping it to v3.x.

[John C. Bland II (johncblandii)]

Rather than leaving ci-docker as needs-maintainer: bumped cloudposse/github-action-docker-build-push@1.15.1 → @02993d67... # v3.1.0 (1209937). The 1.15.1 composite's Get Metadata step has a shell syntax error that's failed this job on every branch since Dec 2025; all six inputs this workflow passes exist unchanged in v3 (verified against its action.yml), and the SHA is verified against the v3.1.0 tag.

[John C. Bland II (johncblandii)]

Body updated to match the diff: the original "left as-is" note about docker-build-push@1.15.1 predated the later bump to v3.1.0 — the body now documents that major crossing (rationale, input verification, byte-identical tag templates between the two versions, non-transitive pinning caveat, and the temporary summary: "false" workaround). Same correction as requested by review on github-status-updater#32.

🤖 Addressed by Claude Code

[John C. Bland II (johncblandii)]

Follow-through as promised: docker-build-push released v3.2.1 with the null-Entrypoint/Cmd guards, so the pin is bumped v3.1.0 → @ff59bd5b... # v3.2.1 (SHA verified against the tag, guards confirmed in its action.yml) and the interim summary: "false" workaround is reverted — summary generation is safe again. PR body updated to match.