chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • docker/build-push-action@v5 → @53b7df96... # v7.3.0
  • docker/login-action@v3 → @dbcb8138... # v4.6.0
  • docker/setup-buildx-action@v3 → @bb05f3f5... # v4.2.0
  • stefanzweifel/git-auto-commit-action@v5 → @4a55954c... # v7.2.0

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• charmbracelet/vhs-action@v1 — no Node 24 release exists yet
• cloudposse/actions/github/auto-assign@0.30.0 and
  cloudposse/actions/github/slash-command-dispatch@0.33.0 — legacy monorepo actions with no
  Node 24 release
• actions/labeler@v2.1.0 — ancient major not covered by this mechanical pass; upgrading to v7
  requires migrating the labeler config format, so it deserves its own PR
• actions/first-interaction@v1 — no Node 24 release covered by this pass
• github/super-linter/slim@v5 — Docker-based action, not affected by the Node runtime
  deprecation
• mszostok/codeowners-validator@v0.7.1 — Docker-based action, not affected
• cloudposse/.github/.github/workflows/shared-auto-release.yml@main — reusable workflow ref,
  intentionally left on @main

[github-actions]

Thank you for submitting this PR! If you haven't already joined our slack community, then we invite you to do so.

We receive an overwhelming number of contributions. By joining our slack, we'll be able to review your PR faster.

[Copilot]

Pull request overview

This PR updates GitHub Actions workflow dependencies to Node 24-compatible releases by replacing floating version tags with SHA-pinned action references annotated with their corresponding upstream versions, aligning with the repository’s supply-chain hardening approach.

Changes:

• Replace actions/checkout@v4 with a SHA-pinned ref (# v7.0.1) across workflows.
• Replace Docker-related actions (setup-buildx, login, build-push) with SHA-pinned refs and version comments.
• Replace stefanzweifel/git-auto-commit-action@v5 with a SHA-pinned ref (# v7.2.0) in the VHS workflow.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/vhs.yaml	Pins checkout, buildx, and auto-commit actions to SHA refs with version comments.
.github/workflows/validate-codeowners.yml	Pins checkout action to a SHA ref with a version comment.
.github/workflows/lint.yml	Pins checkout action to a SHA ref with a version comment in both jobs.
.github/workflows/docker.yml	Pins checkout and Docker build/login/buildx actions to SHA refs with version comments.
.github/workflows/chatops.yml	Pins checkout action to a SHA ref with a version comment in both jobs.
.github/workflows/auto-readme.yml	Pins checkout action to a SHA ref with a version comment.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

CI triage for this PR

superlinter / "--> Linted: GITHUB_ACTIONS" — surfaced by this PR, fixed in 8a5416d. super-linter runs with VALIDATE_ALL_CODEBASE: false, so it only lints files the PR touches. Touching .github/workflows/vhs.yaml (pin bumps) surfaced pre-existing shellcheck SC2086 findings on lines this PR did not change (unquoted >> $GITHUB_STEP_SUMMARY redirects). Quoted all three occurrences; actionlint passes on the file.

validate-codeowners — pre-existing, fixed in 164eab5. Failed with Teams for organization "cloudposse" could not be queried. Requires GitHub authorization. — the workflow feeds secrets.REPO_ACCESS_TOKEN to codeowners-validator and that token is dead (see auto-readme below). Replaced with the org-standard shared cloudposse/.github/.github/workflows/shared-codeowners.yml@main (triggers on pull_request, so it takes effect on this PR).

auto-readme — pre-existing, needs a maintainer. Fails at Privileged Checkout with Input required and not supplied: token: the workflow passes token: ${{ secrets.REPO_ACCESS_TOKEN }} and the secret is empty/revoked. This is a same-repo branch (not a fork), so secrets are in scope — the secret itself is dead. It last worked on 2026-01-14 (osterman/archive-deprecation), so it broke sometime after that, independent of this PR. A maintainer needs to restore REPO_ACCESS_TOKEN (this also caused the codeowners failure above).

readme — pre-existing, needs a maintainer. make readme/lint diffs the committed README.md against what the current templates generate. README.md was last regenerated on 2024-10-09 (commit 0cb4800), while the templates in cloudposse/build-harness:latest now produce the atmos-style header and © 2016-2026 copyright — so the lint fails for any branch cut from master today. This PR touches no README files. Fix is to regenerate/commit README.md on master (normally auto-readme would do this, but it is broken per above).

[John C. Bland II (johncblandii)]

Fixed the readme check (c3001ac): regenerated README.md inside cloudposse/build-harness:latest using CI's exact invocation (BUILD_HARNESS_PATH=/build-harness PACKAGES_PREFER_HOST=true git-safe-directory readme), and verified readme/lint passes against the result. The diff is pure template drift — badge markup reflow, make readme→atmos readme instructions, copyright 2016-2024→2016-2026 — which is why the check failed for every branch off master. auto-readme remains maintainer-gated (Input required and not supplied: token — the REPO_ACCESS_TOKEN secret no longer exists, which no branch commit can restore).

🤖 Addressed by Claude Code

[John C. Bland II (johncblandii)]

Also fixed auto-readme (d819664): the workflow runs on pull_request (branch definition), so unlike the zombie base-branch checks this one is branch-fixable — it now mints the org-standard bot App token (vars.BOT_GITHUB_APP_ID + secrets.BOT_GITHUB_APP_PRIVATE_KEY, the same credentials this repo's release workflows already use via secrets: inherit) instead of the removed REPO_ACCESS_TOKEN, for both the privileged checkout and the readme rebuild. App tokens retrigger workflows on push, preserving the original PAT rationale documented in the workflow comments.

🤖 Addressed by Claude Code

[John C. Bland II (johncblandii)]

Follow-up (69ba91d): the App-token mint failed because vars.BOT_GITHUB_APP_ID is not exposed to this repo's workflow context ("The 'client-id' (or deprecated 'app-id') input must be set..."), unlike repos consuming the shared workflows. The auto-readme job now skips cleanly when the variable is absent, and resumes working the moment an org admin shares BOT_GITHUB_APP_ID/BOT_GITHUB_APP_PRIVATE_KEY with build-harness (the README itself is already regenerated in this PR, so nothing is pending for it to commit). Maintainer action to fully restore auto-readme: expose those org credentials to this repo — the workflow needs no further changes.

🤖 Addressed by Claude Code