ci: upgrade setup-node action runtime

Author: rockyshi1993

.github/workflows/deploy-docs.yml

@@ -65,7 +65,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'npm'

.github/workflows/publish.yml

@@ -29,7 +29,7 @@ jobs:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm

.github/workflows/release-auth-check.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org

.github/workflows/release-preflight.yml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Node.js 20.x
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20.x'
           cache: 'npm'

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -55,7 +55,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Node.js 20.x
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20.x'
           cache: 'npm'

changelogs/v3.0.0.md

@@ -56,6 +56,7 @@ v3.0.0 consolidates the unpublished v2.0.7 work into a major release. It adds bo
 - Release candidates must be clean, have a valid installed dependency graph, and already exist on `origin`; the same preflight also verifies the docs site and packaged `MIGRATION.md` / `SECURITY.md` consumer guidance.
 - A manual pre-tag authentication workflow verifies the repository's current npm publish credential with `npm whoami` without creating a tag or publishing.
 - Build and test artifact cleanup retries transient Windows filesystem contention, so repeated release-gate compilation does not fail on short-lived `ENOTEMPTY`, `EPERM`, or `EBUSY` races.
+- GitHub workflows use `actions/setup-node@v6`, avoiding the retired Node 20 action runtime while preserving the explicit Node 18/20/22 package test matrix.
 - Stable Pages deployment separates immutable release-tag content from current release tooling, so historical stable tags can rebuild their tagged docs with the current audited website toolchain and link gate without deploying unpublished branch content; current releases still require the complete website verification chain.
 
 ## Compatibility-impacting changes

test/smoke/release-contract.test.ts

@@ -20,6 +20,7 @@ test('release paths consume the complete single-source preflight gate', () => {
     const releaseWorkflow = read('.github/workflows/release-preflight.yml');
     const releaseAuthWorkflow = read('.github/workflows/release-auth-check.yml');
     const publishWorkflow = read('.github/workflows/publish.yml');
+    const deployDocsWorkflow = read('.github/workflows/deploy-docs.yml');
     const candidateCheck = read('scripts/check-release-candidate.cjs');
     const packInstallSmoke = read('scripts/pack-install-smoke.cjs');
     const buildScript = read('scripts/build-p1.cjs');
@@ -79,6 +80,10 @@ test('release paths consume the complete single-source preflight gate', () => {
     assert.match(publishWorkflow, /GITHUB_STEP_SUMMARY/);
     assert.match(publishWorkflow, /releases\/new\?tag=/);
     assert.match(publishWorkflow, /Deploy Docs to GitHub Pages/);
+    for (const workflow of [ci, releaseWorkflow, releaseAuthWorkflow, publishWorkflow, deployDocsWorkflow]) {
+        assert.doesNotMatch(workflow, /actions\/setup-node@v4/);
+        assert.match(workflow, /actions\/setup-node@v6/);
+    }
 });
 
 test('stable docs deployment requires an npm-verified release tag', () => {