fix: broodly CI 'Push API Image' job failing on main

[don-petry]

Summary

The CI Pipeline in broodly is failing on main. The "Push API Image" job errors out, likely related to Docker/GCR authentication and Node.js 20 deprecation in google-github-actions/auth.

Evidence

• Failed run: 24011070695
• Node.js 20 deprecation warning on google-github-actions/auth action
• Also affects Claude Code workflow on PRs (run 24010943408) via oven-sh/setup-bun

Recommended Actions

1. Update google-github-actions/auth to a version that supports Node.js 22+
2. Update oven-sh/setup-bun to latest
3. Review all actions in broodly's CI for Node.js 20 deprecation (deadline: Node.js 20 removed Sept 16, 2026)
4. Verify GCR/Artifact Registry credentials are still valid

Context

Identified during weekly org CI/Security survey on 2026-04-05.

[claude]

Claude finished @don-petry's task in 2m 31s —— View job

---

CI 'Push API Image' Fix Analysis

• Gather context and analyze issue
• Read workflow files to identify exact action versions
• Identify all affected actions
• Document findings and required changes

---

Note: I'm unable to modify files in .github/workflows/ due to GitHub App permission restrictions — workflow files require elevated repository permissions. You can find more information in the FAQ. The exact changes needed are documented below.

---

Root Cause

.github/workflows/ci.yml line 183 — google-github-actions/auth is pinned to commit ba79af03... which is v2.x. The v2 action runs on the Node.js 20 runtime, which GitHub is deprecating (removal deadline: Sept 16, 2026). This is causing the Node.js 20 deprecation warning and is the likely root cause of the failing Push API Image job.

.github/workflows/claude.yml line 44 — anthropics/claude-code-action@6e2bd52... (v1.0.89) internally uses oven-sh/setup-bun, which also has a Node.js 20 deprecation warning. Updating this to the latest version should resolve the warning on Claude Code PR runs.

Required Changes

1. .github/workflows/ci.yml — update google-github-actions/auth from v2 → v3

-      - name: Authenticate to Google Cloud
-        uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@<SHA> # v3.x.x

Get the pinned SHA:

# Get latest v3 tag
gh api repos/google-github-actions/auth/releases \
  --jq '[.[] | select(.tag_name | startswith("v3"))] | first | .tag_name'

# Resolve to commit SHA
gh api repos/google-github-actions/auth/commits/<tag> --jq '.sha'

2. .github/workflows/claude.yml — update anthropics/claude-code-action to latest

-        uses: anthropics/claude-code-action@6e2bd52842c65e914eba5c8badd17560bd26b5de # v1.0.89
+        uses: anthropics/claude-code-action@<latest-SHA> # v<latest>

Get latest release:

gh api repos/anthropics/claude-code-action/releases/latest --jq '{tag: .tag_name}'
gh api repos/anthropics/claude-code-action/commits/<tag> --jq '.sha'

Additional Notes

• Dependabot is already configured (dependabot.yml line 30–37, weekly schedule, limit 10 PRs) to open GitHub Actions update PRs — it should already be queuing these. Check for open Dependabot PRs at https://github.com/petry-projects/broodly/pulls?q=is%3Apr+is%3Aopen+label%3Adependencies
• GCR credentials — the Workload Identity Federation config (GCP_WORKLOAD_IDENTITY_PROVIDER, GCP_SERVICE_ACCOUNT) should be verified in repository secrets if the auth failure persists after the action upgrade
• The node-version: 20 in the TypeScript job (line 28) sets the Node.js version for the project build — that is separate from the action runtime version and does not need to change unless you want to bump the app's target Node version