From f820411f4c0c2801873c69f13820ddc6ef7c4d3e Mon Sep 17 00:00:00 2001
From: Piyush Singh <piyush.singh@sourcefuse.com>
Date: Mon, 17 Aug 2026 13:58:07 +0530
Subject: [PATCH] fix(ci-cd): bump github actions to node 24 runtimes

Clears the "Node.js 20 is deprecated" GitHub Actions annotation by moving
every first-party action to a major that declares using: node24.

- bump actions/checkout from v4 to v5 in audit.yml, main.yml, release.yml,
  sync-docs.yaml and trivy.yaml
- bump actions/setup-node from v4 to v5 in audit.yml, main.yml and release.yml
- bump node-version from 22.x to 24.x in audit.yml
- bump node-version from '22' to '24' in release.yml
- drop the stale "UPDATED to v4" comment on the release.yml setup-node step
- leave the main.yml test matrix at [22, 24]; it already covers node 24 and
  dropping 22 would reduce coverage
- leave the SHA-pinned aquasecurity/trivy-action step untouched

GH-175
---
 .github/workflows/audit.yml      | 6 +++---
 .github/workflows/main.yml       | 4 ++--
 .github/workflows/release.yml    | 6 +++---
 .github/workflows/sync-docs.yaml | 4 ++--
 .github/workflows/trivy.yaml     | 2 +-
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index d8cfa8b..59ea11a 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
-          node-version: 22.x
+          node-version: 24.x
 
       - name: Install Monorepo Deps
         run: npm ci
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7a38ec0..f57ea6c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,8 +13,8 @@ jobs:
       matrix:
         node-version: [22, 24]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install Dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bbc07dd..71b6e86 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ jobs:
     # environment: production  # Uncomment if you set an environment name in npm trusted publisher settings
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           # fetch-depth is necessary to get all tags
           # otherwise lerna can't detect the changes and will end up bumping the versions for all packages
@@ -21,9 +21,9 @@ jobs:
           token: ${{ secrets.RELEASE_COMMIT_GH_PAT }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4  # UPDATED to v4
+        uses: actions/setup-node@v5
         with:
-          node-version: '22'
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org'
           always-auth: false  # important for trusted publishing
 
diff --git a/.github/workflows/sync-docs.yaml b/.github/workflows/sync-docs.yaml
index aca802e..85e8e54 100644
--- a/.github/workflows/sync-docs.yaml
+++ b/.github/workflows/sync-docs.yaml
@@ -18,13 +18,13 @@ jobs:
 
     steps:
       - name: Checkout Extension Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           token: ${{env.GITHUB_TOKEN}}
           path: './extension/'
 
       - name: Checkout Docs Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           token: ${{env.GITHUB_TOKEN}}
           repository: ${{env.DOCS_REPO}}
diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
index 2fceafc..0abca6a 100644
--- a/.github/workflows/trivy.yaml
+++ b/.github/workflows/trivy.yaml
@@ -19,7 +19,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Run Trivy vulnerability scanner in repo mode
         uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0