chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to Node 24 runtimes, SHA-pinned with precise
  version comments:
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • actions/setup-go@v5 → @b7ad1dad... # v7.0.0
  • goreleaser/goreleaser-action@v5 → @f06c13b6... # v7.2.3 (with .goreleaser config
    migrated to the v2 schema, validated with GoReleaser v2.17.1's check)
  • actions/upload-artifact@v4 → @043fb46d... # v7.0.1
  • cloudposse/github-action-docker-build-push@1.15.1 → @02993d67... # v3.1.0 — see below

docker-build-push 1.15.1 → v3.1.0 (majors crossed — read this)

• Why: 1.15.1's Get Metadata step has a shell syntax error that has failed ci-docker on
  every branch since 2025-12-24 — the job could not run at all. v3.1.0 fixes it.
• Inputs: all six passed by this workflow (registry, organization, repository, login,
  password, platforms) exist unchanged in v3's action.yml.
• Tag generation: the docker/metadata-action tag templates are byte-identical between
  1.15.1 and v3.1.0 (type=sha, type=schedule, branch/pr refs, semver patterns,
  latest on default branch, type=sha,format=long,priority=1001 — all present in both).
  The underlying docker/metadata-action moves v5→v6 and docker/build-push-action to v7,
  which should not change rendered tags for these template types, but is the layer to watch on
  the first push to main.
• Not transitive: pinning here does not pin v3.1.0's own internals — it floats
  docker/metadata-action@v6, docker/build-push-action@v7, etc. inside its composite.
• Now pinned to v3.2.1 (ff59bd5b...), which ships the null-Entrypoint/Cmd guards in
  the step-summary inspect — the interim summary: "false" workaround is reverted.

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit deprecation warnings and are
  being force-migrated to Node 24
• SHA pinning with verified tag comments per the org's supply-chain direction (chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261);
  every pinned SHA verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on legacy runtimes (deliberately not bumped)

• mszostok/codeowners-validator@v0.7.1 — docker-based, unaffected by the node runtime deprecation
• cloudposse/github-action-docker-promote@0.3.0 — no node24 release at the time of writing

[Copilot]

Pull request overview

Updates this repository’s GitHub Actions workflow dependencies to SHA-pinned revisions that run on the Node 24 runtime, addressing the Node 20 deprecation and improving supply-chain safety via immutable references.

Changes:

• Pin actions/checkout to a specific SHA (# v7.0.1) in workflows that perform checkouts.
• Pin actions/setup-go, goreleaser/goreleaser-action, and actions/upload-artifact to specific SHAs (with tag comments) in the feature-branch workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/validate-codeowners.yml	Pins actions/checkout to a specific SHA with a version comment.
.github/workflows/feature-branch.yml	Pins multiple commonly-used actions to specific SHAs with version comments.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

CI triage for this PR

ci-go — caused by this PR, fixed in 6adbad3. Bumping goreleaser/goreleaser-action v5 → v7 changed what version: latest resolves to: v5 locked to GoReleaser ~> v1, v7 locks to ~> v2 (v2.17.1), which refuses the old version: 0 config ("only version: 2 configuration files are supported"). Migrated dev.goreleaser.yaml to the v2 schema (version: 2, archives.formats, changelog.disable) and validated it with goreleaser check using the same v2.17.1 binary CI downloads.

ci-docker — pre-existing, needs a maintainer. The build itself succeeds; the failure is the Get Metadata step inside cloudposse/github-action-docker-build-push@1.15.1, which inlines the buildx metadata JSON into a single-quoted shell string and dies with syntax error near unexpected token '('. This PR only bumped actions/checkout in that job, which cannot affect metadata parsing. The identical failure hits slack-notifier renovate branches that don't touch this job at all (e.g. renovate/actions-setup-go-7.x run 29480214208 on 2026-07-16; renovate branches failing since 2025-12-24). Fix belongs upstream in github-action-docker-build-push (or bump to its v3.x — a renovate PR for that exists in slack-notifier).

validate-codeowners — pre-existing, fixed in efc17cd. The owners check failed with Teams for organization "cloudposse" could not be queried. Requires GitHub authorization. — the dead org token issue, unrelated to any changed line. Replaced the workflow with the org-standard shared cloudposse/.github/.github/workflows/shared-codeowners.yml@main (this workflow triggers on pull_request, so the fix takes effect on this PR).

[John C. Bland II (johncblandii)]

Rather than leaving ci-docker as needs-maintainer: bumped cloudposse/github-action-docker-build-push@1.15.1 → @02993d67... # v3.1.0 (dd5d95f). The 1.15.1 composite's Get Metadata step has a shell syntax error that's failed this job on every branch since Dec 2025; all six inputs this workflow passes exist unchanged in v3 (verified against its action.yml), and the SHA is verified against the v3.1.0 tag.

[Erik Osterman (Cloud Posse) (osterman)]

Verified all five SHAs against upstream tags and confirmed the six inputs this workflow passes all exist in v3's action.yml — the change works. But the description is actively wrong about the riskiest part of it, and I don't want that in the merge commit.

The body contradicts the diff. Under "still on Node 20" it states cloudposse/github-action-docker-build-push@1.15.1 was "left as-is." The diff bumps it to v3.1.0 — a major, added in commit dd5d95f, on the action that builds and pushes the published ghcr.io image. The body was never updated. Please fix it before merge.

That bump deserves a callout, not a footnote. ci-docker runs on push to main with packages: write and push: true. v3.1.0 changes tag generation — adds type=sha,format=long,priority=1001, adds type=schedule, applies latest on the default branch — and swaps to docker/build-push-action@v7. The tags consumers pull may differ after the next push to main. If that's intended, say so in the body; if not, it needs pinning down.

Also worth noting, not blocking:

• Pinning doesn't go transitive. v3.1.0's own action.yml floats docker/metadata-action@v6, docker/build-push-action@v7, docker/login-action@v4, docker/setup-qemu-action@v4 and third-party dcarbone/install-jq-action@v3.2.0. The supply-chain-safe claim stops at the first hop.
• version: latest for the goreleaser binary is still floating — which is exactly what caused the v1→v2 schema break this PR is fixing. Worth pinning in the same pass.
• The shared codeowners workflow's owners job is hard-disabled upstream (if: ${{ false && ... }}), so real CODEOWNERS owner validation now runs nowhere. Pre-existing org-wide, but it's why that check reads "skipped" rather than "fixed."

Net positive that this drops the PUBLIC_REPO_ACCESS_TOKEN PAT usage. Just fix the body and I'll approve.

[John C. Bland II (johncblandii)]

Erik Osterman (Cloud Posse) (@osterman) — body rewritten, thank you for catching the contradiction. Two things, one of them a respectful correction:

Fixed: the "left as-is" line was stale — it predated commit dd5d95f. The body now leads with a dedicated section on the docker-build-push 1.15.1→v3.1.0 bump: why (1.15.1's Get Metadata shell syntax error has failed ci-docker on every branch since 2025-12-24), the six inputs verified against v3's action.yml, the non-transitive-pinning caveat you raised, and the summary: "false" workaround (upstream fix already on the action's main; to be reverted at the next release).

Verified before writing it into the body: the tag templates are actually byte-identical between 1.15.1 and v3.1.0 — type=sha,format=long,priority=1001, type=schedule, and latest-on-default-branch are all present in 1.15.1's metadata-action config too (compare action.yml at both tags, lines ~113-130 vs ~149-166). What does change underneath is docker/metadata-action v5→v6 and docker/build-push-action →v7, which shouldn't alter rendered tags for these template types — the body flags that layer as the thing to watch on the first push to main.

🤖 Addressed by Claude Code

[John C. Bland II (johncblandii)]

Follow-through as promised: docker-build-push released v3.2.1 with the null-Entrypoint/Cmd guards, so the pin is bumped v3.1.0 → @ff59bd5b... # v3.2.1 (SHA verified against the tag, guards confirmed in its action.yml) and the interim summary: "false" workaround is reverted — summary generation is safe again. PR body updated to match.