chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows and action.yml to versions running on the
  Node 24 runtime, SHA-pinned with precise version comments:
  • actions/checkout@v6 → @3d3c42e5... # v7.0.1
  • nick-fields/assert-action@v2 → @0efd6166... # v4.0.1

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

Supersedes #91
Supersedes #90
Supersedes #87 (partially — the checkout and assert-action pins)

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• cloudposse-github-actions/install-gh-releases@v1 — no Node 24 release exists yet
• Left as-is (already on current majors / outside this upgrade matrix):
  actions/setup-node@v6, hashicorp/setup-terraform@v4,
  aws-actions/configure-aws-credentials@v6 (its mask-aws-account-id: false is already a
  valid boolean), cloudposse/github-action-setup-atmos@49625d9f # v3 (already SHA-pinned;
  Renovate chore(deps): update cloudposse/github-action-setup-atmos digest to 60878d4 #92 proposes the v3.5.0 digest), cloudposse/github-action-matrix-extended@v0

[Copilot]

Pull request overview

Upgrades GitHub Actions used by this repository’s composite action and test workflows to versions that run on the Node 24 runtime, using full commit-SHA pinning with tag comments to improve supply-chain safety and remove Node 20 deprecation warnings.

Changes:

• Pin actions/checkout to a verified Node 24–compatible SHA (# v7.0.1) in the composite action and all affected workflows.
• Pin nick-fields/assert-action to a verified Node 24–compatible SHA (# v4.0.1) in test assertion steps.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
action.yml	Pins actions/checkout to the SHA for v7.0.1 inside the composite action steps.
.github/workflows/test-positive.yml	Pins actions/checkout and nick-fields/assert-action to Node 24–compatible SHAs.
.github/workflows/test-no-changes.yml	Pins actions/checkout and nick-fields/assert-action to Node 24–compatible SHAs.
.github/workflows/test-matrix-3-levels.yml	Pins actions/checkout and nick-fields/assert-action to Node 24–compatible SHAs.
.github/workflows/test-matrix-2-levels.yml	Pins actions/checkout and nick-fields/assert-action to Node 24–compatible SHAs.
.github/workflows/_test-negative.yml	Pins actions/checkout and nick-fields/assert-action to Node 24–compatible SHAs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.