Upgrade GitHub Actions to Node 24 runtime (actions/checkout, actions/setup-node)

[strvmarv]

Summary

CI runs emit Node.js 20 deprecation warnings for actions/checkout@v4 and actions/setup-node@v4. GitHub is forcing all actions to Node.js 24 by June 2, 2026, and Node 20 will be removed from runners on September 16, 2026.

Where the warnings fire

Both workflows use the v4 actions:

.github/workflows/ci.yml

• Line 16, 35: actions/checkout@v4
• Line 19, 38: actions/setup-node@v4

.github/workflows/publish.yml

• Line 15, 33: actions/checkout@v4
• Line 18, 36: actions/setup-node@v4

oven-sh/setup-bun@v2 (ci.yml:41) does not emit a warning — its v2 runs on Node 24 already, so no change needed there.

Verbatim warning from CI run 24061759201

Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-node@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Fix options

Option A (preferred): upgrade to v5 once available

actions/checkout@v5 and actions/setup-node@v5 should ship Node 24 native. Check availability:

gh api repos/actions/checkout/releases/latest --jq .tag_name
gh api repos/actions/setup-node/releases/latest --jq .tag_name

If v5 exists and is stable, bump both workflows:

• actions/checkout@v4 → actions/checkout@v5
• actions/setup-node@v4 → actions/setup-node@v5

Four line changes across two files.

Option B (stopgap): force Node 24 on the existing v4 actions

Add to the top of each job (or globally via workflow env:):

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

This silences the deprecation warning without bumping action versions. Good as a bridge if v5 isn't out yet.

Option C: do nothing

GitHub will auto-force the migration on 2026-06-02. If the v4 actions haven't shipped a Node 24 release by then, CI may break silently. Reactive, but low-risk because the deadline is firm and visible.

Recommendation

Go with Option A once v5 exists for both actions. Until then, Option B is a zero-risk silencer. Don't wait for Option C — a forced migration on a firm date is exactly the kind of deadline that sneaks up during a release crunch.

Acceptance criteria

• No Node.js 20 actions are deprecated annotations on any CI or publish run.
• All existing CI jobs still pass (test-node, test-bun ubuntu/macos/windows).
• Publish workflow still succeeds on tag push.

Context

Surfaced during 0.6.8-beta.5 CI debugging (run 24061759201). Not urgent — just tracking so the June 2026 deadline doesn't bite during a release.