ci: upgrade actions, pin to SHAs, and harden workflows

[jeanduplessis]

Summary

Problem

GitHub Actions warned that actions/setup-node@v4 and dorny/paths-filter@v3 run on the deprecated Node.js 20 runtime. Node 20 actions will be forced to Node 24 starting June 2, 2026, and removed from runners September 16, 2026. Additionally, several other actions were outdated, none were pinned to commit SHAs, and multiple workflows had security and reliability gaps.

Solution

• Upgrade all actions to their latest Node 24-compatible versions.
• Pin every action reference to its commit SHA with a version comment for auditability.
• Add explicit cache: 'pnpm' to deploy workflows where setup-node@v6 dropped implicit pnpm caching.
• Standardize pnpm/action-setup on v4.4.0 across all workflows (was split between v2 and v4), removing the now-conflicting version: latest parameter.
• Add least-privilege permissions: contents: read to 5 workflows that were missing explicit permissions blocks.
• Add timeout-minutes to every job to prevent hung runners from burning minutes indefinitely.
• Remove dead deploy-gateway job (disabled with if: false due to missing R2_ACCOUNT_ID secret).
• Replace manual pnpm cache logic in chromatic's second job with setup-node's built-in cache: 'pnpm'.
• Standardize node-version quoting (remove unnecessary quotes in chromatic.yml).

Actions upgraded:

Action	Old	New
actions/setup-node	v4	v6.3.0
actions/cache	v4	v5.0.4
actions/checkout	v4	v6.0.2
actions/upload-artifact	v4	v5.0.0
actions/download-artifact	v4	v5.0.0
dorny/paths-filter	v3	v4.0.1
docker/login-action	v3	v4.0.0
pnpm/action-setup	v2 / v4	v4.4.0
chromaui/action	@latest	v16.0.0

Why this approach

Pinning to commit SHAs prevents a compromised or hijacked tag from injecting malicious code into CI. The version comment after each SHA preserves readability. All actions are official major version bumps from their maintainers — no behavioral changes beyond the runtime upgrade. Adding permissions and timeouts are low-risk hardening measures recommended by GitHub's security best practices.

Verification

• Verified no remaining unpinned action references via grep
• Verified no remaining version: latest in pnpm/action-setup steps
• Pre-push hooks passed (typecheck, format, lint)

Visual Changes

N/A

Reviewer Notes

• actions/setup-node skipped v5 and went straight to v6.
• chromaui/action was previously pinned to @latest (mutable) — now pinned to v16.0.0 SHA.
• setup-node@v6 drops implicit pnpm caching; explicit cache: 'pnpm' was added where missing.
• pnpm/action-setup@v4 errors when both version is specified in the workflow and packageManager is set in package.json — all version: latest parameters were removed.
• The dead deploy-gateway job in deploy-production.yml was removed entirely. If it needs to be restored, the R2_ACCOUNT_ID secret must be configured first.
• trufflehog.yml intentionally keeps actions/checkout instead of useblacksmith/checkout for security scanning integrity.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (9 files)

• .github/workflows/bump-openclaw.yml
• .github/workflows/chromatic.yml
• .github/workflows/ci.yml
• .github/workflows/deploy-kiloclaw.yml
• .github/workflows/deploy-production.yml
• .github/workflows/deploy-workers.yml
• .github/workflows/kilo-app-ci.yml
• .github/workflows/kilo-app-release.yml
• .github/workflows/trufflehog.yml

---

_{Reviewed by gpt-5.4-20260305 · 212,321 tokens}