ci: update action runtimes

Author: actions-user

.github/workflows/ci.yml

@@ -13,13 +13,13 @@ jobs:
       matrix:
         node-version: [22, 24]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
           version: 10.28.1
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm

.github/workflows/publish.yml

@@ -12,15 +12,15 @@ jobs:
   publish-npm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
           version: 10.28.1
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org

CHANGELOG.md

@@ -29,6 +29,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   scan arguments and link to focused guides.
 - Contributor setup follows the generated-file, test, preflight, and package
   checks used in CI.
+- CI and publish actions run on their maintained Node 24 action runtimes.
 
 ### Fixed
 

scripts/tests/skills-packaging.test.cjs

@@ -37,6 +37,9 @@ test('CI uses supported Node releases and installs the locked toolchain', () =>
   );
   assert.match(workflow, /node-version: \[22, 24\]/);
   assert.match(workflow, /pnpm install --frozen-lockfile/);
+  assert.match(workflow, /actions\/checkout@v7/);
+  assert.match(workflow, /pnpm\/action-setup@v6/);
+  assert.match(workflow, /actions\/setup-node@v7/);
   assert.doesNotMatch(workflow, /node-version: \[(?:18|20)/);
 });
 
@@ -49,8 +52,9 @@ test('publish workflow is release-only and uses npm trusted publishing', () => {
   assert.match(workflow, /node scripts\/prepublish-guard\.cjs/);
   assert.match(workflow, /npm publish --access public/);
   assert.match(workflow, /id-token: write/);
-  assert.match(workflow, /actions\/checkout@v6/);
-  assert.match(workflow, /actions\/setup-node@v6/);
+  assert.match(workflow, /actions\/checkout@v7/);
+  assert.match(workflow, /pnpm\/action-setup@v6/);
+  assert.match(workflow, /actions\/setup-node@v7/);
   assert.match(workflow, /refs\/remotes\/origin\/main/);
   assert.doesNotMatch(workflow, /NODE_AUTH_TOKEN/);
 });