chore(node): drop Node 20; default to 24, test 22 + 24

.changeset/drop-node-20.md

@@ -0,0 +1,13 @@
+---
+'github-actions-updater': minor
+---
+
+Drop Node 20 support; require Node 22+.
+
+Node 20 left LTS at the end of April 2026, so the project drops it from its supported runtimes. The CLI is now tested on Node 22 and Node 24, with Node 24 as the build/release default. `package.json`'s `engines.node` bumps from `>=20.0.0` to `>=22.0.0`.
+
+**What this means in practice:** the `engines` field is advisory — npm will print a warning when installing on Node 20 but will still complete the install. Configurations with `engine-strict=true` will refuse outright. The CLI itself uses no Node 22+ APIs in this release, so unaffected users on Node 20 are likely to keep working for a while — but any regression observed on Node 20 will not be treated as a bug, and CI will not catch one.
+
+**What to do if you're on Node 20:** upgrade your runner to Node 22 or Node 24. There are no source-level API changes in this release; the bump is policy-only.
+
+Why this isn't a major: the `engines` field is a soft contract, no runtime API changed, and the package is young enough that burning a 2.0.0 on a Node-support narrowing alone would make the version stream noisier than it needs to be. A loud changelog entry captures the contract change without committing the version number.

.github/copilot-instructions.md

@@ -8,7 +8,7 @@ guidance in the repo. Keep this file in sync whenever the workflow rules in
 ## What this project is
 
 A CLI (`ghau`) that scans `.github/workflows/*.{yml,yaml}` for outdated remote `uses:`
-references and optionally rewrites them. TypeScript ESM, Node 20+, pnpm. Tested with
+references and optionally rewrites them. TypeScript ESM, Node 22+, pnpm. Tested with
 Vitest, linted with ESLint strict-type-checked + unicorn, formatted with Prettier.
 
 ## Workflow rules

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm lint
@@ -36,7 +36,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm typecheck
@@ -47,7 +47,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ['20', '22']
+        node: ['22', '24']
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@v6
@@ -59,7 +59,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm test:coverage
       - name: Upload coverage
-        if: matrix.os == 'ubuntu-latest' && matrix.node == '20'
+        if: matrix.os == 'ubuntu-latest' && matrix.node == '24'
         uses: actions/upload-artifact@v7
         with:
           name: coverage
@@ -74,7 +74,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm build

.github/workflows/deploy-docs.yml

@@ -26,7 +26,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm docs:build

.github/workflows/release.yml

@@ -44,9 +44,12 @@ jobs:
       # dropping `registry-url:` costs nothing.
       - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
-      # npm 11.5+ is required for trusted-publishing OIDC. Node 20 ships with npm 10.
+      # npm 11.5+ is required for trusted-publishing OIDC. Node 24 ships with
+      # npm 11.5+ already, so this is defensive only — it keeps the release
+      # path resilient if the `node-version` above is ever downgraded to a
+      # release line that still bundles npm 10 (Node 22 does).
       - run: npm install -g npm@latest
       - run: pnpm install --frozen-lockfile
       # Inline CI gate: re-run the same checks the CI workflow does on push to

.github/workflows/self-check.yml

@@ -20,7 +20,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm build

CLAUDE.md

@@ -9,7 +9,7 @@ the same rules every session.
 - **What it is.** A CLI (`ghau`) that scans `.github/workflows/*.{yml,yaml}` for outdated
   remote `uses:` references and optionally rewrites them in place. Think `ncu`, but
   for GitHub Actions.
-- **Stack.** TypeScript ESM, Node 20+, pnpm. Vitest + `@vitest/coverage-v8`. ESLint
+- **Stack.** TypeScript ESM, Node 22+, pnpm. Vitest + `@vitest/coverage-v8`. ESLint
   (strict-type-checked + unicorn) + Prettier. VitePress for docs. Changesets for
   releases. Targets `github-actions-updater` on npm; binary is `ghau`.
 - **Architecture.** `src/core/` (scanner, parser, comparator, resolvers, auth) is the

CONTRIBUTING.md

@@ -10,7 +10,7 @@ pnpm build
 pnpm test:coverage
 ```
 
-You need Node 20+ and pnpm 9+.
+You need Node 22+ and pnpm 9+.
 
 ## Development loop
 

package.json

@@ -20,7 +20,7 @@
   },
   "type": "module",
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.0.0"
   },
   "bin": {
     "ghau": "./dist/cli.js"