From c4ab23044bccf497cb5851f4bd314ad17a279dd2 Mon Sep 17 00:00:00 2001
From: Cedric Conday <277679649+CedricConday@users.noreply.github.com>
Date: Sun, 6 Sep 2026 16:43:06 +0000
Subject: [PATCH] Move the pinned first-party actions off the node20 runtime

action.yml pinned setup-python, cache, cache/save, setup-node and
upload-artifact at versions whose action runtime is node20. GitHub has
deprecated node20 and is force-running those on node24; every consumer
gets a deprecation annotation on its check today, and the action breaks
outright when node20 support is removed.

Bumped to the current majors, which all declare `using: node24`:

  setup-python    v5.6.0 -> v7.0.0
  cache           v4.3.0 -> v6.1.0
  cache/save      v4.3.0 -> v6.1.0
  setup-node      v4.4.0 -> v7.0.0
  upload-artifact v4.6.2 -> v7.0.1

Every input this action passes is still accepted by the new majors:
python-version; path, key and restore-keys; node-version; and name, path,
retention-days and if-no-files-found. Pins stay commit-hash pinned with
the version in a trailing comment, as before.

Closes #118
---
 action.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/action.yml b/action.yml
index 0e10e6a..b4ada9e 100644
--- a/action.yml
+++ b/action.yml
@@ -69,14 +69,14 @@ runs:
         echo "::endgroup::"
     
     - name: Set up Python
-      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 pinned to commit hash
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 pinned to commit hash
       with:
         python-version: '3.x'
     
     - name: Check ClaudeCode run history
       id: claudecode-history
       if: github.event_name == 'pull_request'
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 pinned to commit hash
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 pinned to commit hash
       with:
         path: .claudecode-marker
         key: claudecode-${{ github.repository_id }}-pr-${{ github.event.pull_request.number }}-${{ github.sha }}
@@ -149,14 +149,14 @@ runs:
     
     - name: Save ClaudeCode reservation to cache
       if: steps.claudecode-check.outputs.enable_claudecode == 'true' && github.event_name == 'pull_request'
-      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 pinned to commit hash
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 pinned to commit hash
       with:
         path: .claudecode-marker
         key: claudecode-${{ github.repository_id }}-pr-${{ github.event.pull_request.number }}-${{ github.sha }}
     
     - name: Set up Node.js
       if: steps.claudecode-check.outputs.enable_claudecode == 'true'
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 pinned to commit hash
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 pinned to commit hash
       with:
         node-version: '18'
     
@@ -307,7 +307,7 @@ runs:
     
     - name: Upload scan results
       if: always() && inputs.upload-results == 'true'
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 pinned to commit hash
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 pinned to commit hash
       with:
         name: security-review-results
         path: |