node24: GitHub is already force-running the action on Node 24 (+ the @actions/* majors that clear the last advisories)

[mmcky]

action.yml declares using: 'node20', but GitHub is already ignoring that and running the action on Node 24 — in production, today. Every workflow run in the 2026-07-15 harness carries:

##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: ./action, actions/checkout@v4, actions/setup-node@v4

This reframes PLAN 5.8. It is not "Node 20 reached EOL, we should migrate sometime" — we are already getting the Node 24 runtime without having declared, tested, or built for it. The declared runtime and the actual runtime have diverged, and the divergence is invisible unless you read a warning in the log.

Scope

PLAN 5.8 and PLAN 1.4 are coupled: both force a dist-action/ rebuild, so they should land together as one release.

• action.yml:93 — using: 'node20' → 'node24'
• .github/workflows/ci.yml:25 — node-version: 20 → 24
• build-action.mjs:23 — esbuild target: 'node20' → 'node24'
• @types/node — ^20 → ^24
• package.json engines.node — >=20 → >=24 (added in High-severity fixes from the 2026-07-15 deep review #83)
• CONTRIBUTING.md — Node 20 prerequisite
• @actions/core 1.11.1 → 3.x and @actions/github 6.0.1 → 9.x — the reason to do this now: these are the last open prod advisories. npm audit --omit=dev reports 1 high / 2 moderate, all undici reaching us through these two, and all of it inlined into the committed dist-action/index.js. npm audit fix cannot clear them without the majors.
• Rebuild dist-action/, confirm the freshness gate passes
• Consider @anthropic-ai/sdk 0.78 → 0.111 in the same release (also bundle-affecting; re-run translator-retry.test.ts)

Risk

The @actions/* majors are the real work — v1→v3 and v6→v9 are several majors each, and the action uses core.getInput/setOutput/setFailed/info/error plus github.context and getOctokit throughout. Worth reading their changelogs rather than assuming a drop-in.

Everything else is a one-line change per site.

Verification

src/index.ts is at 0% coverage (PLAN 5.2), so the test suite will not catch an @actions/* API break — it would surface as a runtime failure in a real sync. The e2e harness (tool-test-action-on-github/) is the check that would: 26 scenarios × 2 languages against real GitHub. Pin its templates to the candidate build first (they now carry an explicit ref: after #86).

Refs: PLAN 5.8, PLAN 1.4, REVIEW-FABLE5-2026-07-15.md §5

[mmcky]

Production sighting during the intro.zh-cn onboarding (2026-07-18): every review-workflow run in lecture-intro.zh-cn now ends with

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: QuantEcon/action-translation@v0

so the forced-run divergence this issue describes is visible on every fresh wiring too, not just the programming series. No functional failures attributable to it in ~40 runs today — the failures we did hit were input/metadata issues (#104) — but the warning is now the loudest line in otherwise-green logs.

[mmcky]

The ESM migration's value has risen — it is no longer only a dependency-currency task (2026-07-21).

The Jest-CJS limitation this issue parks behind "no deadline, advisories at 0" now has two demonstrated costs from this week: src/index.ts uses import.meta.url, which the Jest CJS registry cannot load at all — attempting to import from it fails with SyntaxError: Identifier '__filename' has already been declared. That structural zero-coverage is (a) how the first #115 fix shipped missing its third enforcement point (an early return in runRebase nothing could test), caught only in review, and (b) why #124's refresh helper had to be extracted into a separate module to be testable at all.

A Jest ESM story — the core of this issue's remaining scope — would make index.ts loadable and therefore testable, closing the gap that produced a real defect. Worth weighing when this gets scheduled: the advisories argument says "no urgency", but the testability argument now says otherwise. (Advisories re-verified today: still 0 on main.)

[mmcky]

The 2026-07-23 technical-debt audit ran npm audit and reached the same place from the dependency side, and this issue is the better framing of the fix.

Measured: all seven advisories trace to a single EOL devDependency chain (ESLint 8 + @typescript-eslint 6). None of them ships in the action bundle — worth stating explicitly in any risk assessment, since "six high advisories" reads worse than it is.

Tracked as findings #96, #34 and #101 in #177 (trigger-gated backlog) rather than scheduled, on the grounds that the @actions/* majors named here clear them as a side effect. If that upgrade stalls, the ESLint 9 flat-config migration becomes the fallback route.

Related: #101 notes there is no dependabot or renovate configuration, so dependency drift currently has no automated discovery channel — which is why this issue had to be opened by hand.

[mmcky]

Closing per the 2026-08-10 backlog review (tracker #257, W0 #258). Verified against v0.25.0 (3db2f9f): action.yml runs node24, esbuild targets node24, engines.node >=24, @actions/core 2.0.3 and @actions/github 8.0.1 are in, and npm audit --omit=dev reports 0 vulnerabilities (CHANGELOG v0.18.0). The ESM-only @actions/* 3.x/9.x majors remain deliberately deferred; that residual is recorded as #177 F35's trigger.