CI: track Node 20 deprecation in GitHub Actions runtime

[andrewmarconi]

Context

The 1.0.4 release workflow run surfaced this annotation:

Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/attest-build-provenance/predicate@1176ef556905f349f669722abf30bce1a6e16e01, actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc, actions/checkout@v4, actions/setup-node@v4.

Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026.

Reference: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

What this is (and isn't)

This is about the GitHub Actions runtime that hosts third-party actions like actions/checkout, actions/setup-node, and actions/attest-build-provenance — not the Node version we use for our own build steps (we already use Node 22 — see #17).

These actions internally bundle Node.js 20 to execute their JavaScript. GitHub is forcing them to upgrade to Node 24.

Action

Watch for new major versions of these actions that ship with Node 24:

• actions/checkout (currently v4)
• actions/setup-node (currently v4)
• actions/attest-build-provenance (currently v2)

Upgrade .github/workflows/release.yml once compatible versions exist.

Timeline

• June 2, 2026 — Node 24 becomes the default; old actions may still run with a forced upgrade
• September 16, 2026 — Node 20 removed entirely; un-upgraded actions break

Escape hatch

If we get caught flat-footed before the action maintainers ship updates, we can opt into Node 24 early via FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true env var, or temporarily opt back to Node 20 via ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true after the cutover.