Node.js 20 deprecation: GitHub Actions pins need Node.js 24 runtimes

[piyushsinghgaur1]

Describe the bug

GitHub Actions runs in this repository emit the following annotation:

Node.js 20 is deprecated. Please update to a supported Node.js version. For more information see: https://github.blog/changelog/2025-09-19-github-actions-transition-from-node-20-to-node-24/

The cause is that several first-party actions are still pinned to majors whose action.yml declares using: node20:

• .github/workflows/main.yaml — actions/checkout@v4, actions/setup-node@v4
• .github/workflows/release.yaml — actions/checkout@v4, actions/setup-node@v4
• .github/workflows/sync-docs.yaml — actions/checkout@v4 (x2)
• .github/workflows/trivy.yaml — actions/checkout@v4

Separately, release.yaml still provisions Node 22 (node-version: '22') for the publish job, while the CI matrix already covers Node 24.

To Reproduce

Steps to reproduce the behavior:

1. Open any recent workflow run in the Actions tab (e.g. the CI or Trivy Scan workflow).
2. Look at the run summary / annotations panel.
3. See the "Node.js 20 is deprecated" warning attached to the checkout and setup-node steps.

Expected behavior

Workflow runs complete with no Node.js runtime deprecation annotations, and every first-party action executes on the node24 runtime.

Fix needed:

• Bump actions/checkout to a major that runs on node24 (v5).
• Bump actions/setup-node to a major that runs on node24 (v5).
• Bump the release job's node-version from '22' to '24'.
• Leave the CI matrix (node-version: [22, 24]) as is, so runtime coverage for consumers on Node 22 is not reduced.
• Leave the SHA-pinned aquasecurity/trivy-action alone; it is a third-party action pinned by digest and is not part of this annotation.

Additional context

GitHub has announced that the node20 runtime for Actions will be removed, after which actions still declaring using: node20 will fail rather than warn. This mirrors the same change tracked in sourcefuse/loopback4-microservice-catalog#2601.

[piyushsinghgaur1]

Additional pin found while scoping the fix: .github/workflows/stale.yml uses actions/stale@v1, which is even older than the node20 line. Its latest major (v11) declares using: node24 and still supports every input the workflow passes (repo-token, stale-issue-message, stale-pr-message, stale-issue-label, stale-pr-label), so it is included in the same fix.