fix: bump github actions to node24 runtimes

[talalashraf]

GitHub removes Node ≤20 action runtimes from runners on 2026-09-16 (forced Node 24 default since 2026-06-16) — changelog. Actions updated to their Node 24 releases:

• actions/checkout v3 → v6
• actions/setup-node v4 → v6

[linear-code]

PLA-1666 Upgrade all Node ≤20 GitHub Actions org-wide before runner removal (deadline 2026-09-16)

GitHub is deprecating Node 20 action runtimes (changelog). Two dates matter:

• 2026-06-16 — Node 20 actions are forced to run on Node 24 by default (temporary opt-out via ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true). Behavior changes possible from this date.
• 2026-09-16 — Node 20 removed from runners entirely. Hard deadline: anything still pinned to a Node ≤20 major stops working.

Deprecation warnings are already appearing in runs (e.g. terraform-infra elasticache-pending-updates run).

Scope (expanded 2026-06-11)

Originally 3 repos / 2 providers. Now: every 0xProject repo with a workflow run in the last 60 days, every provider on a Node ≤20 runtime.

Org sweep results: 152 active repos → 42 with workflow runs since 2026-04-12 → 40 affected repos, ~100 workflow files, 47 distinct providers on node12/16/20 (including pins as old as checkout@v2, cache@v2, setup-node@v1, configure-aws-credentials@v1).

Audit methodology (done)

Every provider was verified with hard evidence, not release-page claims:

• resolved runs.using from each pinned ref's action.yml (node12/16/20/24, composite, docker)
• diffed inputs:/outputs: between our pinned ref and the upgrade target
• cross-checked removed/changed inputs against the with: keys our workflows actually pass
• grepped release notes of every crossed major for breaking changes

All bump targets are continuously validated in the live canary repo: https://github.com/0xProject/gha-canary (monthly schedule + on demand; includes a forced-Node-24 preview of the 2026-06-16 flip — all stragglers survive it).

Findings

37 of 47 providers are drop-in safe for the inputs we use. Headline bumps: checkout v2–v4 → v6, configure-aws-credentials v1–v4 → v6, create-github-app-token v1/v2 → v3, cache v2–v4 → v5 (v4 is still node20!), setup-node → v6, pnpm/action-setup → v6 (v4 still node20), upload/download-artifact → v7/v8, docker/* → latest majors, setup-terraform → v4, setup-tflint → v6, github-script → v9.

Gotchas baked into the plan:

• github-script v9's ESM break is narrow: only require('@actions/github') and const/let getOctokit redeclaration fail — require() of node builtins still works (canary-verified). Zero org scripts use the breaking patterns, so v9 is a pin-only bump everywhere.
• setup-node v5+ auto-enables caching when package.json has packageManager
• stale v6+ closes issues as not_planned by default (affects 0x-main-infra)
• setup-tflint v5+ fails the step on tflint exit code 2; setup-terraform v3 changed wrapper stdout/stderr passthrough
• astral-sh/setup-uv v8 dropped floating major tags — pin exact version (v8.2.0)
• All new majors require Actions Runner ≥ 2.327.1 — self-hosted runners (custom labels ubuntu-32c128gb, bigboy, …) must be verified/updated first

3 migrations + 7 stragglers (no clean bump possible) are tracked in the audit comment and will be handled separately from the mechanical bump PRs.

Confirmed unaffected: foundry-toolchain, rust-cache, nuclei-action@v3, secrets-fetch-action@v2 (already node24); dtolnay/rust-toolchain, taiki-e/install-action, claude-code-action (composite); tfsec, terrateam, hadolint (docker).

Rollout (40 PRs, one per repo)

1. Tier 1: terraform-infra (0xProject/terraform-infra#978 — CI green), 0x-main-infra, 0x-labs
2. Tier 2 (~16 repos): multi-action bumps — matcha, 0x-solana (SHA-pinned), terrateam, 0x-event-pipeline (node12-era), 0x-parser, 0x-docs, etc.
3. Tier 3 (~21 repos): checkout-only mechanical bumps — scriptable clone → sed → PR loop
4. Verify per PR: green CI, zero node20/node16 deprecation annotations; spot-check elasticache-pending-updates
5. Optionally set FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true on a canary workflow before 2026-06-16 (already running continuously in gha-canary)

Full upgrade matrix with per-provider verdicts lives in the working repo's CLAUDE.md (PLA-1666 workspace) and the per-repo checklist table there tracks PR status.

Manual steps

MUST: PR merge approvals across 40 repos (line up per-team codeowners); confirm custom runner labels are GitHub larger runners or self-hosted on ≥ 2.327.1; configure gha-canary secrets/vars for full coverage (OIDC role, canary GitHub App — see repo README).

SHOULD (live CI/CD, human preferred): merge terraform-infra (gates terragrunt plan/apply), 0x-main-infra k8s-manifests.yaml (gates GitOps), and terrateam/terrateam-action during low-activity windows, watching first runs.

References

• Canary repo: https://github.com/0xProject/gha-canary
• Node 20 deprecation changelog: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
• actions/checkout releases (v5+ = Node 24): https://github.com/actions/checkout/releases
• aws-actions/configure-aws-credentials releases (v6 = Node 24): https://github.com/aws-actions/configure-aws-credentials/releases
• actions/create-github-app-token releases (v3 = Node 24): https://github.com/actions/create-github-app-token/releases
• hmarr/auto-approve-action (still Node 20): https://github.com/hmarr/auto-approve-action/releases
• autero1/action-terragrunt (still Node 20): https://github.com/autero1/action-terragrunt/releases

Review in Linear

[tobernguyen]

Clean node24 runtime bump (GitHub Actions version pins only) — LGTM ✅. Note: pre-existing CI failures are in the project's own jobs, unrelated to these version-pin bumps.

[jlin27]

@talalashraf, thanks for bumping the GH actions. I see this PR was cut before the tests were updated. Could you rebase before merging? Thanks in advance!

git rebase origin/main

[talalashraf]

@talalashraf, thanks for bumping the GH actions. I see this PR was cut before the tests were updated. Could you rebase before merging? Thanks in advance!

git rebase origin/main

Done