Node 20 action deprecation: bump actions/checkout and actions/setup-node before 2026-06-02 #55

Problem

Every workflow run surfaces this annotation:

Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-node@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026.

This affects at least:

• .github/workflows/publish.yml
• .github/workflows/ci.yml
• .github/workflows/code-review.yml

...and probably every other workflow that checks out code or sets up node.

Deadline impact

The aictrl publish workflow runs on releases, so a forced migration that breaks the workflow would be another silent release-pipeline outage like the promise-retry one (see #49). Worth being proactive.

Fix

Bump the pinned action versions to the latest that ship as Node 24-native bundles:

• actions/checkout@v4 → check for v5 or latest v4.x that supports Node 24
• actions/setup-node@v4 → same
• oven-sh/setup-bun@v2 → not mentioned in the annotation, but worth confirming it's Node-24-ready

Short-term escape hatch if we need more time: add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true at the workflow level to force Node 24 now (and surface any breakage early) without bumping action versions. But we should just bump the versions — it's the same end state with less config drift.

Acceptance criteria

• All workflow files bumped to action versions that are explicitly Node 24-compatible
• Workflow runs no longer surface the deprecation annotation
• CI and publish workflows both still green after the bump
• Optionally: add a Dependabot config entry (.github/dependabot.yml) for github-actions so future action updates surface as PRs automatically

Related

• Cosmetic today, load-bearing by 2026-06-02
• No current user impact