chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v3|v4 → @3d3c42e5... # v7.0.1
  • actions/setup-node@v4 → @82076278... # v7.0.0
  • nick-fields/assert-action@v2 → @0efd6166... # v4.0.1

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

Supersedes #26

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• github/codeql-action/{init,autobuild,analyze}@v2 (codeql.yml) — left as-is: this upgrade
  matrix only maps @v3/SHA refs of codeql-action; the @v2 refs here predate that and need a
  deliberate v2 → v4 migration (Dependabot Bump github/codeql-action from 2 to 3 #27 proposes v3). actionlint already flags the v2
  runner as too old (pre-existing).

[John C. Bland II (johncblandii)]

Follow-up: bumped the remaining github/codeql-action/{init,autobuild,analyze}@v2 refs to @ff2f1c62... # v4.37.7 — v2 has been deprecated by GitHub since early 2025 and runs a legacy runtime; the init/autobuild/analyze interface is unchanged across v2→v4 for this standard usage. Supersedes Dependabot #27's v3 proposal as well.

[Copilot]

Pull request overview

Upgrades this repository’s GitHub Actions workflow dependencies to Node 24–runtime-compatible releases by switching from floating version tags to SHA-pinned action refs with verified tag comments, improving both deprecation readiness and supply-chain safety.

Changes:

• Pin actions/checkout to 3d3c42e5... with a # v7.0.1 tag comment across workflows.
• Pin actions/setup-node to 82076278... with a # v7.0.0 tag comment across workflows.
• Pin nick-fields/assert-action to 0efd6166... with a # v4.0.1 tag comment across workflows.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/test-wrong-yaml-config.yml	SHA-pin checkout/setup-node and assert-action with version comments.
.github/workflows/test-structure.yml	SHA-pin checkout/setup-node and assert-action with version comments.
.github/workflows/test-query-3.yml	SHA-pin checkout/setup-node and assert-action with version comments.
.github/workflows/test-query-2.yml	SHA-pin checkout/setup-node and assert-action with version comments.
.github/workflows/test-query-1.yml	SHA-pin checkout/setup-node and assert-action with version comments.
.github/workflows/test-positive.yml	SHA-pin checkout/setup-node and assert-action with version comments.
.github/workflows/test-negative.yml	SHA-pin checkout/setup-node and assert-action with version comments.
.github/workflows/test-multiline.yml	SHA-pin checkout/setup-node and assert-action with version comments.
.github/workflows/codeql.yml	SHA-pin checkout with version comment (leaves CodeQL actions at v2 as noted).
.github/workflows/build-and-test.yml	SHA-pin checkout/setup-node with version comments.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mergify]

Important

Cloud Posse Engineering Team Review Required

This pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes.

To expedite this process, reach out to us on Slack in the #pr-reviews channel.