enhancement: Audit and update actions using deprecated Node.js 20 runtime

[don-petry]

Summary

Multiple GitHub Actions across the org use the Node.js 20 runtime, which is deprecated. GitHub will force Node.js 24 starting June 2, 2026 and remove Node.js 20 on September 16, 2026.

Known Affected Actions

• google-github-actions/auth (broodly)
• oven-sh/setup-bun (broodly)
• Potentially others — a full audit is needed

Recommended Actions

1. Run an org-wide audit of all workflow files to identify actions using Node.js 20
2. Create Dependabot PRs or manual updates for each affected action
3. Prioritize actions on critical paths (CI, deploy, security scanning)
4. Set a deadline of May 2026 to complete all updates (before forced migration)

Timeline

Date	Event
Now	Deprecation warnings in logs
2026-06-02	GitHub forces Node.js 24 runtime
2026-09-16	Node.js 20 runtime removed entirely

Context

Identified during weekly org CI/Security survey on 2026-04-05.

[claude]

Claude finished @don-petry's task in 4m 45s —— View job

---

Auditing and updating deprecated Node.js 20 actions

• Gather context and read CLAUDE.md
• Audit all workflow files for Node.js 20 usage
• Identify fix for node-version: '20' in ci.yml
• Attempted push — blocked by GitHub App workflows permission

Audit Findings

Files in this repo (.github/workflows/):

File	Line	Issue	Required Fix
ci.yml	89	node-version: '20' explicit pin in AgentShield step	Change to '24'

Actions using node20 internal runtime (awaiting upstream node24 releases):

Action	Version	Runtime	Notes
dependabot/fetch-metadata	v2	node20	No node24 version available yet
DavidAnson/markdownlint-cli2-action	v9	node20	No node24 version available yet
pnpm/action-setup	v4	node20	No node24 version available yet
dtolnay/rust-toolchain	@stable	node20	No node24 version available yet
actions/create-github-app-token	v3	node20	Check for updates

Already on Node.js 24 runtime: actions/checkout@v6, actions/setup-node@v6, actions/upload-artifact@v7, actions/download-artifact@v8

Limitation: Cannot push workflow file changes

The GitHub App token used here lacks the workflows permission, so I cannot push changes to .github/workflows/ci.yml directly. The fix is a one-line change:

# .github/workflows/ci.yml, line 89
-          node-version: '20'
+          node-version: '24'

Recommended next steps

1. Apply the ci.yml fix manually — the change is one line (above). A maintainer with workflows permission can do this directly.
2. Enable Dependabot for GitHub Actions — add .github/dependabot.yml with package-ecosystem: github-actions so future version bumps are automated. Once upstream actions publish node24-compatible releases, Dependabot will surface those PRs automatically.
3. Track upstream action updates — the actions still on node20 runtime (dependabot/fetch-metadata, markdownlint-cli2-action, pnpm/action-setup, dtolnay/rust-toolchain) have not yet published node24 versions. Monitor their release pages and update pins when node24 versions ship (before the June 2, 2026 deadline).

[claude]

Claude finished @don-petry's task in 5m 24s —— View job • claude/issue-34-20260406-0341 • [Create PR ➔](https://github.com/petry-projects/.github/compare/main...claude/issue-34-20260406-0341?quick_pull=1&title=Issue%20%2334%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2334%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Implementing fix for issue #34

• Gather context and read AGENTS.md
• Audit all instances of deprecated Node.js 20 references
• Update standards/ci-standards.md — Node 20 → 24 in npm and pnpm pattern examples
• Push branch and create PR #62
• Self-review PR — changes are minimal and correct, no issues found
• CI — all checks passing (Lint, ShellCheck, Agent Security Scan, CodeQL, SonarCloud, Dependency audit)
• Tag CODEOWNERS — no CODEOWNERS file; tagging PR author @don-petry

Summary

PR #62 is ready for review and merge.

Changes merged in PR:

File	Line	Change
standards/ci-standards.md	325	node-version: '20' → '24' (npm pattern example)
standards/ci-standards.md	343	node-version: 20 → 24 (pnpm pattern example)

Remaining manual step — workflows permission required

The GitHub App cannot push to .github/workflows/ files. A maintainer needs to apply this one-line fix directly:

# .github/workflows/ci.yml, line 89
-          node-version: '20'
+          node-version: '24'

@don-petry — please apply the ci.yml fix above and merge PR #62 when ready.
| PR #62