Bump CI actions off deprecated Node.js 20

[rdimitrov]

Summary

GitHub is deprecating the Node.js 20 runtime for JavaScript actions (changelog): it is forced to Node.js 24 on 2026-06-16 and removed from runners on 2026-09-16. This currently surfaces "Node.js 20 actions are deprecated" warnings across nearly every workflow.

This PR bumps every affected action that has a Node.js 24 release to clear the warnings. All bumps are runtime-only major-version changes — verified against upstream release notes that the only breaking change is the Node bump, with no input or behavior changes for how we use them:

• azure/setup-helmv4.3.1 → v5.0.0
• docker/login-actionv3.7.0 → v4.2.0
• docker/setup-buildx-actionv3.12.0 → v4.1.0
• docker/metadata-actionv5.10.0 → v6.1.0
• docker/build-push-actionv6.19.2 → v7.2.0
• codecov/codecov-actionv5 → v6.0.1 (also resolves its embedded actions/github-scriptv7 → v8)
• slackapi/slack-github-actionv2.1.1 → v3.0.3 (webhook/webhook-type/payload inputs unchanged)

Type of change

• Dependency update

Test plan

• Manual testing (describe below)

Workflow-only change with no local entry point, so verification was done at the source level:

• Confirmed each target commit SHA corresponds to its pinned tag and that the tag's action.yml declares using: node24.
• Reviewed upstream release notes to confirm each major bump's only breaking change is the Node.js runtime.
• Validated all 8 edited workflow files still parse as YAML.
• The authoritative check is this PR's own CI run — the Node 20 deprecation annotations for these actions should no longer appear.

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Changes

File	Change
image-build-and-publish.yml	docker/login, setup-buildx, metadata, build-push bumps
skills-build-and-publish.yml	docker/login bump
test.yml	codecov-action bump
releaser.yml	slack-github-action bump
helm-publish.yml, helm-charts-test.yml, test-e2e-lifecycle.yml, operator-ci.yml	azure/setup-helm bump (dropped a stale # pin@v4.3.0 note)

Does this introduce a user-facing change?

No.

Special notes for reviewers

Two Node 20 actions are intentionally left as-is because no Node.js 24 release exists upstream yet:

• arduino/setup-task — latest is v2.0.0 (still node20); needs a separate fix (e.g. go install) and is out of scope here.
• golang/govulncheck-action@v1.0.4 — we are already on its latest release; the setup-go@v5.0.0 → v6.2.0 fix is only on an unreleased upstream commit. Renovate will bump it once a new release ships; GitHub force-migrates it to Node 24 on 2026-06-16 regardless.

renovate.json is untouched; arduino/setup-task remains in the "setup and language actions" group.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.83%. Comparing base (ab2d3a1) to head (31d82b7).

Additional details and impacted files

@@ Coverage Diff @@## main #5421 +/- ##
==========================================
- Coverage 68.84% 68.83% -0.02% 
==========================================
Files 634 634 Lines 64433 64433 ==========================================
- Hits 44358 44350 -8 - Misses 16795 16801 +6 - Partials 3280 3282 +2 

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.