ci: move workflow runtimes to Node 24

Upgrade the remaining Node 20 workflow runtime pins and force JavaScript actions onto Node 24 so GitHub Actions no longer emits deprecated Node 20 warnings.

Made-with: Cursor

Author: gankoji

.github/reusable_workflows/pulumi_up/action.yaml

@@ -35,9 +35,9 @@ inputs:
     required: false
 
   node-version:
-    description: 'Node.js major used for infra commands (align with infra/README.md Tool versions)'
+    description: 'Node.js major used for the workflow runtime while running infra commands'
     required: false
-    default: '20'
+    default: '24'
 
   pulumi-version:
     description: 'Pulumi CLI version (pin to infra/README.md Tool versions)'

.github/workflows/_reusable-pulumi-deploy.yml

@@ -59,6 +59,9 @@ on:
         type: string
         default: ''
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   dev_prepare:
     name: Dev — BOM + platform image tag
@@ -84,7 +87,7 @@ jobs:
       - name: Set up Node.js (Pulumi CLI for platform config)
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
 
       - name: Install Pulumi CLI
         shell: bash
@@ -283,7 +286,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
           cache: npm
           cache-dependency-path: |
             infra/layer_1/package-lock.json

.github/workflows/canary-staging.yml

@@ -60,6 +60,9 @@ on:
 permissions:
   contents: read
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   canary:
     runs-on: ubuntu-latest

.github/workflows/infra-foundation-preview.yml

@@ -9,7 +9,7 @@
 # Repository variable (Settings → Secrets and variables → Actions → Variables), optional:
 #   PULUMI_FOUNDATION_STACK — Pulumi stack name for dev/pre-prod foundation (defaults to dev-staging if unset).
 #
-# Node: 20.x is the repo-standard infra toolchain (see infra/README.md "Tool versions"; root .nvmrc stays 16 for legacy app builds).
+# Workflow runtime uses Node 24 on GitHub-hosted runners; the local infra toolchain remains documented in `infra/README.md`.
 #
 # This job does NOT use DOCKER_HOST, SSH to Swarm, or Tailscale — foundation talks only to the DigitalOcean API.
 #
@@ -29,6 +29,9 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   filter:
     if: github.event_name == 'pull_request'
@@ -78,7 +81,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
           cache: npm
           cache-dependency-path: infra/foundation/package-lock.json
 

.github/workflows/infra-pulumi.yml

@@ -50,6 +50,9 @@ permissions:
   contents: read
   pull-requests: write
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 # Before production `pulumi up` on the platform/prod stack, Tier 1 harness runs against
 # hosted staging (lane `main-staging`). Configure GitHub environment `staging` with secret
 # `HARNESS_MAIN_STAGING_TIER1_ENV` (full multiline .env). See scripts/harness/README.md.

.github/workflows/on-changes.yml

@@ -24,6 +24,9 @@ permissions:
   contents: read
   packages: write
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   build_core_image:
     name: 'Build base docker image'

.github/workflows/verify-main-dev-tier0.yml

@@ -19,6 +19,9 @@ concurrency:
 
 permissions:
   contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
   actions: write
 
 jobs: