CI: remove Node 20 GitHub Action runtime deprecation

[seonghobae]

Current state — 2026-09-15

Protected main@193a87ef54c3fe6dcda4755bce4d6bc81e3a0297 still carries the older Node-20-backed GitHub Action pins, so this warning is not shipped as repaired.

The current canonical LifeOS-local repair is Draft PR #276, exact bcea58b3eacc612578c59850e7d7f1cac2aa4151, open/mergeable on that protected main. It replaces the persistent LifeOS actions/checkout and actions/setup-node boundary with immutable Node-24-backed releases:

• actions/checkout v7.0.1 exact 3d3c42e5aac5ba805825da76410c181273ba90b1;
• actions/setup-node v7.0.0 exact 820762786026740c76f36085b0efc47a31fe5020.

The same owner branch also explicitly supplies Git's init.defaultBranch=main to persistent checkout initialization rather than suppressing the separate default-branch warning. This is a source repair, not ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION, FORCE_JAVASCRIPT_ACTIONS_TO_NODE24, stderr filtering, advice.defaultBranchName=false, or another warning-hiding switch.

Evidence and remaining acceptance

Current #276 has already passed its LifeOS-local AppGuardrail lane. Commercial Readiness run 34792004500 successfully crossed the repaired checkout/setup boundary and then failed later at Collect bounded GitHub evidence, which is canonical #247 territory rather than an action-runtime failure. CI, SAST, CodeQL PR, and Security Scan on the exact #276 head were still queued at the latest fresh owner read, so repository-wide warning-free GREEN is not claimed and predecessor evidence is not promoted.

The original reproduction remains useful historical evidence: #275 predecessor e28e619e7c7db02d25bf6a084aee04c5a97cabca, CI 34609556607, emitted both the Node-20 action-runtime warning and setup-node's Node [DEP0040] punycode deprecation. The final acceptance must establish on one unchanged #276/restacked descendant that these action-owned warnings are absent on hosted runners. If the punycode warning survives the current setup-node v7 pin, route it to the actual action/runtime dependency rather than hiding it.

Acceptance

• Replace the LifeOS persistent checkout/setup-node pins with current Node-24-backed releases pinned by immutable SHA on canonical owner fix(ci): adopt Node 24 GitHub Action runtimes #276.
• Preserve exact-head checkout, persist-credentials: false, permissions, required workflows and security gates in the owner repair.
• Do not use runtime compatibility switches, stderr filtering, generic warning suppression or floating action tags.
• Obtain terminal applicable current-head CI/SAST/Security/CodeQL evidence on the final fix(ci): adopt Node 24 GitHub Action runtimes #276 candidate and verify the Node-20 and setup-node punycode warnings are absent, or route any surviving warning to its real upstream owner with exact evidence.
• Satisfy independent current-head review/thread authority.
• Integrate fix(ci): adopt Node 24 GitHub Action runtimes #276 normally into protected main; dependent fix(ci): materialize bounded SARIF PR provenance #279 then adopts that protected ancestry by ordinary non-force restack and reacquires its own evidence.

Do not close this issue merely because the Draft source repair exists. Closure requires the warning-free repair to reach protected authority or a verified successor to assume the full acceptance boundary.

Refs #276 #279 #247 #249 #273 #275; ContextualWisdomLab/.github#2106.

[seonghobae]

Fresh owner audit narrows the repair. Protected main@193a87ef54c3fe6dcda4755bce4d6bc81e3a0297 still has checkout v4 SHA 11d5960a326750d5838078e36cf38b85af677262 in .github/workflows/ci.yml and .github/workflows/deploy.yml; other persistent workflows already use checkout v7.0.1 SHA 3d3c42e5aac5ba805825da76410c181273ba90b1. GitHub's current checkout v7.0.1 action.yml declares runs.using: node24.

The wider stale surface is setup-node v4 SHA 49933ea5288caeca8642d1e84afbd3f7d6820020: it remains in CI, Commercial Readiness, AI proposal live conformance, and OpenCode commercial-development workflows, with exact-pin assertions in their contract tests. Current upstream actions/setup-node release is immutable v7.0.0 (published 2026-07-14), tag SHA 820762786026740c76f36085b0efc47a31fe5020; its action.yml declares runs.using: node24.

So the next owner slice should replace only those stale action-runtime pins, preserve exact-head refs / persist-credentials: false / permissions / concurrency and deployment semantics, update the existing workflow contract tests to require the Node-24-backed SHAs, then run exact-head CI plus representative deploy validation. No ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION suppression is justified.

[seonghobae]

Fresh exact-head recurrence on PR #273 643846bb4ad0c4be8487ac210a776aec261ad595: CI validate run 34603376984, job 103276087761 emits the GitHub Actions runtime deprecation twice. The workflow currently pins actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 and actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4; hosted runner 2.337.0 reports that Node.js 20 is deprecated and forces those actions onto Node 24. This exact run otherwise confirms the dependency-policy repair: frozen pnpm 10.15.0 executes both esbuild@0.28.1 postinstall and opencode-ai postinstall. Keep #270 as the canonical root-fix owner; do not suppress with ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION or filter the warning.

[seonghobae]

#270 owner update — Node 24 migration source is now published as Draft #276 on exact 711c991ef9a17497b170e0718b1d9a5fd1886f56 over protected main@193a87ef54c3fe6dcda4755bce4d6bc81e3a0297.

Authoritative reviewed pins are actions/checkout v7.0.1 3d3c42e5aac5ba805825da76410c181273ba90b1 and actions/setup-node v7.0.0 820762786026740c76f36085b0efc47a31fe5020; both declare Node 24. The candidate replaces the remaining persistent checkout/setup-node Node-20 pins, removes the four now-purpose-complete FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 switches, updates existing contract fixtures, adds a permanent action-runtime regression, and records CHANGELOG currentness.

Exact v6 writer run 34615343235 / job 103315748299 passed touched-file Prettier, Commercial Development workflow/runtime tests 21/21, AI live-workflow tests 7/7, old-pin/FORCE absence checks and git diff --check, then created candidate 711c991e... with its temporary workflow deleted. Its final push was rejected only because the intentionally bounded token lacked GitHub workflows permission; the tested descendant was then published by non-force fast-forward ref update rather than widening the token.

#276 remains Draft while normal exact-head repository/security/CodeQL/review evidence is reacquired. Do not close #270 until this reaches protected ancestry normally. Ignored build scripts: esbuild observed in the same hosted run remains #273-owned and is not duplicated here.

[seonghobae]

Normal hosted acceptance on unchanged #276 head 711c991ef9a17497b170e0718b1d9a5fd1886f56 now adds the missing non-writer evidence: AppGuardrail 34615486603 SUCCESS and SAST 34615486484 SUCCESS; CI 34615486509 has merge-compatibility, Compose, Today concurrency, and browser acceptance GREEN; Commercial Readiness 34615486367 reached its #247-owned evidence-size failure after running the new checkout/setup-node pins. Across these normal lanes the prior Node-20 GitHub Action runtime deprecation and [DEP0040] punycode warning are absent. CI validate's only format RED is protected-main .github/workflows/appguardrail.yml drift already canonicalized in #249. Keep #270 open until #276 reaches protected ancestry and its owner prerequisites/review converge.

[seonghobae]

#270 owner update on exact #276 head 75ba0ea9287cd60bb5c1748f1b32f409a563c6be: the first manual CodeRabbit pass had found a real regression gap in node24-actions-contract.test.mjs—the matcher only enumerated already-40-hex refs, so actions/checkout@v7 / actions/setup-node@main could evade the immutable-pin contract. A hosted regression-only verifier (34620012358 / 103331333492) reproduced that false-negative. The minimum repair broadened enumeration to every checkout/setup-node ref and still requires complete equality to the reviewed Node-24 exact SHA; focused rerun 34620138432 passed all 3 tests, and the temporary verifier was removed in ordinary descendant 75ba0ea....

CodeRabbit has now manually reviewed exact 75ba0ea... and reports no #276-local findings, re-verifying the repaired floating-ref regression, the reviewed Node-24 checkout/setup-node pins, removal of executable FORCE_JAVASCRIPT_ACTIONS_TO_NODE24, and AppGuardrail jobs.scan.steps structure. Normal exact-head AppGuardrail/SAST remain GREEN; repository-wide CI/Commercial Readiness/Security/CodeQL remain blocked only by the already-routed #249/#247/#273/#275 and central CodeQL owner paths documented on #276.

Keep #270 open: this clean conversation review is not a submitted GitHub APPROVED review, and #276 has not reached protected ancestry. No self-approval, bypass merge, or mutable sibling-source adoption.

[seonghobae]

Fresh downstream evidence from #264 exact 24ad8bf87404452f66baf66d3d3a99e2632b419e: Commercial Readiness run 35156132639 hosted job 104995874364 still emits both the implicit Git master initialization warning and setup-node's Node [DEP0040] punycode deprecation while using the older actions/setup-node@49933e.... The actual job failure is later and separate (GitHub API response exceeded the size limit, already owner-repaired in #247 Finding #68). This confirms #270 remains open and #276 remains the canonical action-runtime/default-branch owner; do not suppress either warning in #264 or copy the repair into the Habit lane. Revalidate warning absence only after #276 reaches protected authority and #264/descendants ordinary-adopt that ancestry.