From c29a1f6185b35a3a12b4f8004859e3987ce2c9ea Mon Sep 17 00:00:00 2001
From: Hayden MacIntyre <haydenpmac@gmail.com>
Date: Tue, 7 Apr 2026 12:34:42 -0400
Subject: [PATCH] ci: upgrade actions to Node.js 24 and add compat env for
 lagging deps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Upgrade actions with Node.js 24 releases available:
- amannn/action-semantic-pull-request @v5 → @v6
- actions/cache/save and actions/cache/restore @v4 → @v5

Add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 env workaround for actions
that lack a Node.js 24 release upstream:
- googleapis/release-please-action@v4
- actions/dependency-review-action@v4
- davelosert/vitest-coverage-report-action@v2

Node.js 20 will be removed from GitHub runners on 2026-09-16.
---
 .github/workflows/ci.yml             | 12 ++++++++----
 .github/workflows/pr-title.yml       |  2 +-
 .github/workflows/release-please.yml |  2 ++
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b9b9afc..bef217b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
         run: npm ci
 
       - name: Cache node_modules
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: node_modules
           key: node-modules-${{ runner.os }}-node${{ matrix.node-version }}-${{ hashFiles('package-lock.json') }}
@@ -53,7 +53,7 @@ jobs:
           node-version: ${{ matrix.node-version }}
 
       - name: Restore node_modules
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: node_modules
           key: node-modules-${{ runner.os }}-node${{ matrix.node-version }}-${{ hashFiles('package-lock.json') }}
@@ -80,7 +80,7 @@ jobs:
           node-version: ${{ matrix.node-version }}
 
       - name: Restore node_modules
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: node_modules
           key: node-modules-${{ runner.os }}-node${{ matrix.node-version }}-${{ hashFiles('package-lock.json') }}
@@ -100,6 +100,8 @@ jobs:
       - name: Coverage report on PR
         if: always() && matrix.node-version == 22 && github.event_name == 'pull_request'
         uses: davelosert/vitest-coverage-report-action@v2
+        env:
+          FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
         with:
           json-summary-path: coverage/coverage-summary.json
           json-final-path: coverage/coverage-final.json
@@ -124,7 +126,7 @@ jobs:
           node-version: 22
 
       - name: Restore node_modules
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: node_modules
           key: node-modules-${{ runner.os }}-node22-${{ hashFiles('package-lock.json') }}
@@ -139,5 +141,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: actions/dependency-review-action@v4
+        env:
+          FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
         with:
           fail-on-severity: moderate
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 2f64df2..667aa3a 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -19,7 +19,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 749818c..03a5dd5 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -12,6 +12,8 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - uses: googleapis/release-please-action@v4
         with: