chore: upgrade actions to Node 24 runtime and enforce SHA pinning

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the shared workflows to versions running on the Node 24 runtime:
  • actions/checkout@v4/@v6 → v7.0.1
  • actions/create-github-app-token@v1 / @v2 → v3.2.0
  • actions/github-script@v7 → v9.0.0
  • actions/setup-go@v5 → v7.0.0
  • actions/setup-node@v4 → v7.0.0
  • aws-actions/configure-aws-credentials@v4 → v6.2.3
  • cloudposse-github-actions/get-pr@v2 → v3.1.0
  • crazy-max/ghaction-import-gpg@v6 → v7.0.0
  • goreleaser/goreleaser-action@v5 → v7.2.3
  • hashicorp/setup-terraform@v3 → v4.0.1
  • peter-evans/create-or-update-comment@v4 → v5.0.0
  • robherley/go-test-action@v0 → v1.1.0
  • stefanzweifel/git-auto-commit-action@v5 → v7.2.0
• One input fix required by a breaking change: aws-actions/configure-aws-credentials v5+ rejects
  non-YAML-1.2 booleans (throws instead of coercing), so mask-aws-account-id: "no" in
  shared-terraform-chatops.yml is now "false".
• SHA-pin every third-party action reference (owner/repo@<sha> # vX.Y.Z), and add a
  verify-sha-pinning workflow + composite action (adapted from
  cloudposse/atmos)
  that enforces it on PRs and weekly via cron:
  • Coverage — fails if any third-party uses: ref is not SHA-pinned
  • Drift — fails if a pinned SHA no longer matches the tag named in its version comment
    (catches force-pushed tags / supply-chain tampering)
  • References to this repo's own shared-*.yml@main reusable workflows are exempt — distributing
    at @main is this repository's core model, for this repo's own workflows as much as for the
    181 downstream repos
  • Un-taggable refs are SHA-pinned to their current branch head with a # main comment
    (cloudposse-github-actions/screenshot, mpoc/nexus-validate-using-remote-schema-action)
• Every new ref was verified two ways: runs.using: node24 (or composite/docker) at the pinned ref,
  and pinned SHA == the peeled commit of the version tag in its comment (64 tag-verified,
  0 mismatches, 0 unpinned). Release notes for each major bump were reviewed; all other inputs in
  use are unchanged.

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and are
  already being force-migrated to Node 24
• Pinning explicitly to Node 24 releases makes the migration deliberate rather than implicit
• These shared workflows are consumed via @main by ~181 downstream cloudposse/* repos, so this
  single change clears the warning across most of the org — and SHA pinning means a compromised or
  force-pushed upstream tag can no longer silently change what runs in every consumer's CI
• Renovate keeps SHA pins current the same way it does tag pins (it updates the SHA and the comment)

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
• https://github.com/cloudposse/atmos/blob/main/.github/workflows/verify-sha-pinning.yml
• Supersedes the narrower Renovate PRs Update actions/checkout action to v7 #258 (actions/checkout v7) and Update actions/create-github-app-token action to v3 - autoclosed #260 (actions/create-github-app-token v3)

still on Node 20 (or older)

• actions-tools/yaml-outputs@4950620 in repo-banner.yml — node16; latest release (v2.1) is
  still node20, so there is no node24 version to pin. Needs a replacement or upstream release.
  https://github.com/actions-tools/yaml-outputs
• cloudposse/actions/github/create-pull-request@0.33.0 in shared-scheduled-context.yml —
  node16; needs replacement (e.g. peter-evans/create-pull-request), not a version bump.
  https://github.com/cloudposse/actions
• mpoc/nexus-validate-using-remote-schema-action@main in shared-ci-github-action.yml —
  node12; unmaintained, needs replacement, not a version bump.
  https://github.com/mpoc/nexus-validate-using-remote-schema-action

[Kevin (kevcube)]

lgtm. only non-standard change is shared-terraform-chatops.yml:314.
i'd unquote the bool but it doesn't matter.

[Copilot]

Pull request overview

Updates shared GitHub Actions workflows to use newer major versions that run on the Node 24 runtime (to avoid Node 20 deprecation warnings across downstream consumers).

Changes:

• Bumped multiple commonly used actions (checkout, github-script, setup-go, setup-node, create-github-app-token, configure-aws-credentials, etc.) to Node 24-capable major versions across shared workflows.
• Applied an input compatibility fix for aws-actions/configure-aws-credentials v5+ boolean parsing (mask-aws-account-id: "false").
• Updated commit/comment helper actions used by several workflows (e.g., git-auto-commit-action, create-or-update-comment).

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/shared-terraform-chatops.yml	Upgraded ChatOps workflow action versions (checkout/github-script/setup-go/configure-aws-credentials/etc.) for Node 24 compatibility.
.github/workflows/shared-scheduled-context.yml	Bumped checkout to v7 in the scheduled context workflow.
.github/workflows/shared-release-branches.yml	Upgraded create-github-app-token and github-script major versions for Node 24 runtime.
.github/workflows/shared-go-feature-release.yml	Updated PR/context/comment actions (get-pr, github-script, create-or-update-comment) to newer majors.
.github/workflows/shared-go-auto-release.yml	Updated release workflow actions (create-github-app-token/checkout/setup-go/import-gpg/goreleaser) to newer majors.
.github/workflows/shared-codeowners.yml	Updated checkout and create-github-app-token major versions.
.github/workflows/shared-ci-typescript-app-check-dist.yml	Updated checkout/setup-node/git-auto-commit-action majors for Node 24 runtime.
.github/workflows/shared-ci-terraform.yml	Updated checkout to v7 and setup-terraform to v4.
.github/workflows/shared-ci-github-action.yml	Updated checkout to v7 in GitHub Action CI workflow.
.github/workflows/shared-auto-release.yml	Updated create-github-app-token major; updated commented github-script reference to v9.
.github/workflows/shared-atmos-readme.yml	Updated create-github-app-token and checkout to newer majors.
.github/workflows/repo-banner.yml	Updated checkout/github-script/git-auto-commit-action majors for Node 24 runtime.
.github/workflows/org-banner.yml	Updated checkout and git-auto-commit-action majors for Node 24 runtime.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mergify]

Important

Cloud Posse Engineering Team Review Required

This pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes.

To expedite this process, reach out to us on Slack in the #pr-reviews channel.

[John C. Bland II (johncblandii)]

Added SHA-pin enforcement per request (3b49dba), modeled on atmos's verify-sha-pinning:

• New .github/workflows/verify-sha-pinning.yml + .github/actions/verify-sha-pinning composite action (PR + weekly cron + manual dispatch) — fails on any unpinned third-party ref and on SHA↔tag drift, with a sticky PR comment on violations.
• Every third-party uses: ref in this repo is now owner/repo@<sha> # vX.Y.Z with the precise release tag in the comment (major aliases like v7 move on every upstream release and would trip the weekly drift check).
• One adaptation vs. atmos: refs to this repo's own shared-*.yml@main reusable workflows are exempt — @main distribution is the point of this repo, so pinning self-references would freeze the shared workflows this repo exists to serve.
• screenshot@main and mpoc/nexus-validate-...@main are SHA-pinned to current branch heads with # main comments (branch-pinned: coverage-checked, not drift-checked).
• Locally verified with the same parse/resolve logic: 64 tag-verified, 0 mismatches, 0 unpinned, 4 branch-pinned; actionlint clean.

Note for reviewers: Renovate updates SHA pins + comments natively, so routine bumps keep working.

[mergify]

💥 This pull request now has conflicts. Could you fix it John C. Bland II (@johncblandii)? 🙏

[Kevin (kevcube)]

John C. Bland II (@johncblandii) can you link to the request for sha pinning for posterity?

also this PR is starting to greatly outgrow its title. I think it should merge and additions/improvements can follow after.

[John C. Bland II (johncblandii)]

Kevin (@kevcube) sha pinning was a request by Erik Osterman (Cloud Posse) (@osterman) in chat.

[Kevin (kevcube)]

lgtm.

one note is that dependabot can also do updates of sha-pinned gha workflows and maybe we should depend on that, because it's just bundled with github.

requires a dependabot.yml config and a github actions workflows group, can be a follow-on change.

[John C. Bland II (johncblandii)]

Works for me.