[maastrich]

Upgrade Node runtime from 16.16.0/node20 to Node 24 in CI workflows and the GitHub action.

• .github/workflows/npm.yml: node-version: 24 in all jobs, cache keys updated
• action.yml: using: node24
• add agents config (.agents/, .claude/, ai-lock.json)

Context

Node 16 is end-of-life and node20 action runtime is being deprecated on GitHub runners. No functional change to the linter itself.

Test plan

• CI workflows pass on Node 24
• Action runs with node24 runtime

[Copilot]

Pull request overview

Updates CI and the JavaScript action runtime to target Node 24, and introduces repo-local agent configuration (skills + security-guard hook) intended to improve safety/automation around AI-assisted workflows.

Changes:

• Bump the custom GitHub Action runtime from node20 to node24 (action.yml).
• Update the CI workflow to run jobs on Node 24 and refresh cache keys accordingly (.github/workflows/npm.yml).
• Add agent configuration and security-guard hook/scripts (.agents/, .claude/, ai-lock.json).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
ai-lock.json	Adds a lockfile for installed agent skills/hooks.
action.yml	Switches the action runtime to node24.
.github/workflows/npm.yml	Updates workflow Node versions to 24 and adjusts cache keys.
.claude/settings.json	Adds PreToolUse hook config pointing to the security-guard script.
.agents/skills/branch-commit-pr-ticket/SKILL.md	Adds a documented automation skill for branch/commit/ticket/PR workflow.
.agents/hooks/security-guard/security-guard.sh	Adds a hook script to block dangerous tool commands.
.agents/hooks/security-guard/test-security-guard.sh	Adds a bash test harness for the security-guard hook.

Suppressed comments (6)

.github/workflows/npm.yml:54

• This job still uses actions/checkout@v3 and actions/setup-node@v3, which run on Node 16 (runs.using: node16). Since this PR is addressing runner runtime deprecations, bumping these to @v4 avoids the workflow depending on a deprecated action runtime.

          node-version: 24

.github/workflows/npm.yml:62

• actions/cache@v3 runs on Node 16 (runs.using: node16). To keep the workflow aligned with the Node runtime upgrade motivation, bump to actions/cache@v4 (Node 20).

          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package.json') }}-${{ hashFiles('**/package-lock.json') }}-node-24

.github/workflows/npm.yml:78

• This job still uses actions/checkout@v3 and actions/setup-node@v3, which run on Node 16 (runs.using: node16). Upgrading these to @v4 reduces the risk of CI failures from the Node 16 action runtime being retired.

          node-version: 24

.github/workflows/npm.yml:86

• actions/cache@v3 runs on Node 16 (runs.using: node16). Consider bumping to actions/cache@v4 (Node 20) to avoid action-runtime deprecation fallout.

          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package.json') }}-${{ hashFiles('**/package-lock.json') }}-node-24

.github/workflows/npm.yml:140

• This job still uses actions/checkout@v3 and actions/setup-node@v3, which run on Node 16 (runs.using: node16). Upgrading to @v4 keeps the workflow off the deprecated Node 16 action runtime while you’re moving the job toolchain to Node 24.

          node-version: 24

.github/workflows/npm.yml:148

• actions/cache@v3 runs on Node 16 (runs.using: node16). Consider bumping to actions/cache@v4 (Node 20) to avoid CI failures when Node 16-based actions are no longer supported.

          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package.json') }}-${{ hashFiles('**/package-lock.json') }}-node-24

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.