From 856afeb283bf1e5431426be7d45af97facf3c1d4 Mon Sep 17 00:00:00 2001
From: Chuck McAndrew <6248903+dcmcand@users.noreply.github.com>
Date: Tue, 7 Jul 2026 10:36:52 +0200
Subject: [PATCH] ci: move GitHub Actions off the Node 20 runtime

Node 20 reached end of life in April 2026 and GitHub is winding down the
node20 action runtime in favor of node24. Every action the repo pins to a
node20-runtime major is bumped to the current node24 major:

- actions/checkout            v4 -> v6   (docs.yml; rest of repo already v6)
- actions/setup-node          v4 -> v6   (docs.yml; ci.yml already v6)
- azure/setup-helm            v4 -> v5
- cloudflare/wrangler-action  v3 -> v4
- goreleaser/goreleaser-action v6 -> v7
- docker/setup-buildx-action  v3 -> v4
- docker/metadata-action      v5 -> v6
- docker/build-push-action    v6 -> v7
- docker/login-action         v3 -> v4

Each bump was checked against its release notes: they are node24-runtime
(+ internal ESM/dep) changes with no impact on the inputs this repo uses.
Two notes:

- goreleaser-action v7 does not change the goreleaser binary version; that
  stays pinned to "~> v2" via the `version` input.
- wrangler-action v4 also changes the default Wrangler CLI to v4. It only
  runs in the secret-gated Pages deploy step (not the PR build gate), and
  `pages deploy`/`pages project create` are compatible across v3 and v4.

thollander/actions-comment-pull-request stays on v3: its latest release is
still node20, so there is no node24 version to move to yet.
---
 .github/workflows/build-images.yaml | 12 ++++++------
 .github/workflows/ci.yml            |  2 +-
 .github/workflows/docs.yml          |  6 +++---
 .github/workflows/release.yml       |  2 +-
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
index 2f46233..c24d59d 100644
--- a/.github/workflows/build-images.yaml
+++ b/.github/workflows/build-images.yaml
@@ -24,11 +24,11 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       # latest is applied only on the default branch (is_default_branch); tag
       # pushes get only the semver tag plus sha-. Do not "simplify" this.
-      - uses: docker/metadata-action@v5
+      - uses: docker/metadata-action@v6
         id: meta
         with:
           images: |
@@ -47,7 +47,7 @@ jobs:
       # Build once and load locally so the image can be smoke-tested before
       # any tag is pushed. The push step below is a cache hit of this build.
       - name: Build for smoke test
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64
@@ -81,20 +81,20 @@ jobs:
 
       # Logins happen after the build and smoke test so a missing registry
       # secret fails here, adjacent to the push, with build signal already green.
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@v4
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_TOKEN }}
 
       - name: Push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5255e28..42a76a3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: azure/setup-helm@v4
+      - uses: azure/setup-helm@v5
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index e601c6f..aa7b11c 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -30,7 +30,7 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with: { fetch-depth: 0 }
       - uses: actions/setup-go@v6
         with:
@@ -46,7 +46,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '22'
           cache: npm
@@ -101,7 +101,7 @@ jobs:
       - name: Deploy to Cloudflare Pages
         id: deploy
         if: ${{ steps.candeploy.outputs.ok == 'true' }}
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c859757..168ad95 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - uses: goreleaser/goreleaser-action@v6
+      - uses: goreleaser/goreleaser-action@v7
         with:
           distribution: goreleaser
           # Pinned to v2: the brews section is deprecated and scheduled for