Update GitHub Actions to Node.js 24 before Sep 2026 deadline

[labgadget015-dotcom]

Node.js 20 Deprecation Deadline: September 16, 2026

GitHub Actions will remove Node.js 20 from runners on September 16, 2026. The following actions in this repo need updating:

Actions to Update

Action	Current	Recommended
actions/checkout	v4 (Node 20)	v4 latest or v5
actions/setup-python	v5 (Node 20)	v5 latest
actions/upload-artifact	v4 (Node 20)	v4 latest

Steps

1. Check each workflow file in .github/workflows/
2. Update each action to its latest version that supports Node.js 24
3. Test workflows after updating
4. Optionally opt in early by setting FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true in workflow env

References

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

---

Auto-created by scheduled Claude Code agent.

[labgadget015-dotcom]

@copilot Please review this feature request and provide implementation suggestions and potential challenges.

[labgadget015-dotcom]

🤖 DRC Agent Analysis

Recommendation: 🟠 P1 IMPORTANT

Summary: Realist recommended Solution 2 (Renovate Bot Continuous Governance) with Solution 1 (Manual Surgical Bump) as immediate bootstrap, deferring Solution 4 (Claude Agent Self-Healing CI Pipeline) due to high complexity and cost risk.

Next steps:

1. Step 1 (P0 - Do today): Execute Solution 1 manual surgical bump — grep all workflow files, update actions/checkout to v4, actions/setup-python to v5, actions/upload-artifact to v4, add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true to each workflow env block, open PR, verify CI passes, merge. Estimated 2-3 hours. This eliminates all deadline risk immediately.
2. Step 2 (P1 - This week): Install Renovate GitHub App or configure self-hosted Renovate via GitHub Actions. Add renovate.json to repo root with github-actions package manager enabled, weekly schedule, and automerge restricted to patch and minor updates with CI gate required.
3. Step 3 (P1 - This week): Enable branch protection on main requiring status checks to pass before merge. Verify Renovate onboarding PR appears and CI gates function correctly. Monitor first two weekly cycles.
4. Step 4 (P1 - This week): Add CONTRIBUTING.md entry documenting Renovate governance policy so future action additions are automatically covered.
5. Step 5 (P2 - Next sprint): Implement scoped Solution 4 variant — a weekly scheduled GitHub Actions workflow that calls Claude API to audit action versions and opens a GitHub Issue with findings (no auto-PR generation). This captures product demo value, generates a real case study, and costs 8-10 hours and minimal API tokens. Showcase as autonomous CI governance agent to consulting prospects.

Strategic fit: Consulting: high · Product: medium · Tech debt: reduces

---

Analysed by GadgetLab DRC Agent (Dreamer → Realist → Critic) · Run run_1785574899182

[labgadget015-dotcom]

PR #282 bumps every remaining Node 20 action ahead of the 2026-09-16 runner removal.

The list in this issue was close but not complete. Classifying by each action's own action.yml runs.using rather than by version found 18 references across 8 workflow files plus the repo-root action.yml, and it also cleared three actions this issue flagged as needing work: actions/checkout, actions/setup-python and actions/upload-artifact were already on Node 24 majors in most places.

Bumped: checkout@v4→v5 (7), setup-node@v4→v5 (3), setup-python@v4/v5→v6 (3), github-script@v7→v8 (1), stale@v9→v10 (1), dependabot/fetch-metadata@v2→v3 (1), softprops/action-gh-release@v2→v3 (1).

The root action.yml finding is the one worth noting: the composite action external repos consume via @main pinned setup-python@v4, so consumers would have broken on the 16th too.

Verified by execution rather than by version table. stale@v10 ran on the branch with debug-only on and processed real items. checkout@v5 and setup-node@v5 built the landing page with the npm cache intact. fetch-metadata@v3 and action-gh-release@v3 have no trigger that fires from a PR, so they first execute on a real Dependabot PR and a real release tag.

[labgadget015-dotcom]

Done. PR #282 merged as 22ac201.

Every action reference in the repo was swept before merging, including composite actions and SHA-pinned forms. Nothing on Node 20 remains in a live workflow.

One cosmetic leftover, tracked separately from this deadline: .github/scripts/cost_calculator.py emits example advice that still cites actions/cache@v4. It is a string in generated output, not a live reference, so it carries no deadline risk.

[labgadget015-dotcom]

@copilot Please review this feature request and provide implementation suggestions and potential challenges.