chore: update GitHub Actions to Node 24

[jonathannorris]

Summary

• Update GitHub Actions and custom action dependencies to Node 24-compatible releases.
• Update nested dependencies in composite and custom actions.
• Retain actions without an available Node 24 release.

[Copilot]

Pull request overview

Updates GitHub Actions workflow dependencies and local composite actions to Node 24–compatible action versions, while keeping existing workflows and release automation functional.

Changes:

• Bumped actions/checkout and actions/setup-node to v7 across workflows and composite actions.
• Updated peter-evans/repository-dispatch usage to v4 in the release workflow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/tests.yml	Updates checkout/setup-node versions used in CI tests workflow.
.github/workflows/cli-release.yml	Updates checkout/setup-node and repository-dispatch used during releases.
.github/actions/update-vscode-extension/action.yml	Updates checkout version used by the VSCode extension update composite action.
.github/actions/update-doc/action.yml	Updates checkout version used by the docs update composite action.
.github/actions/release/action.yml	Updates setup-node version used by the release composite action.

Suppressed comments (2)

.github/workflows/cli-release.yml:150

• Using a floating tag (@v4) for peter-evans/repository-dispatch weakens supply-chain security because tags can be retargeted. Pin this action to the specific commit SHA for v4 instead.

 if: inputs.npm-version == 'minor' || inputs.npm-version == 'patch'
uses: peter-evans/repository-dispatch@v4
with:

.github/workflows/cli-release.yml:159

• Using a floating tag (@v4) for peter-evans/repository-dispatch weakens supply-chain security because tags can be retargeted. Pin this action to the specific commit SHA for v4 instead.

 - name: Update Homebrew Formula
uses: peter-evans/repository-dispatch@v4
with:

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.