bug: Node 20 deprecation warnings persist on CI despite FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 (Windows checkout@v4.2.2 + floating @v4 in two PR-required workflows)

[trek-e]

GSD Version

N/A — CI infrastructure issue

Runtime

Multiple (specify in description)

Operating System

Windows

Node.js Version

N/A — CI runner

Shell

N/A

Installation Method

npx @opengsd/get-shit-done-redux@latest (fresh run)

What happened?

GitHub Actions emits Node 20 deprecation warnings on every CI run despite PR #350 setting FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true in test.yml.

Per actions/runner source code, that env var DOES NOT silence the warning — it changes which warning fires (from "running on Node.js 20" to "target Node.js 20 but being forced to run on Node.js 24"). Both call context.Warning(). The only way to fully silence is for the action itself to declare using: node24.

Three workflow files still reference @v4 action versions whose action.yml declares using: node20:

1. .github/workflows/test.yml:83 — Windows lane pinned to actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 (= v4.2.2). Rationale from commit 925e8d953 (PR fix(ci): pin actions/checkout@v4 on Windows to bypass v6 includeIf auth bug #162) and issue bug(ci): actions/checkout@v6 fails on windows-latest with "could not read Username" #161: v6 uses includeIf.gitdir: to inject the auth token, but on Windows git 2.54 the gitdir path comparison (forward-slash key vs backslash-resolved gitdir) intermittently fails to match, leaving the fetch unauthenticated.

   Upstream confirmation: actions/checkout#2425 — the includeIf bug "was introduced in v6 with the move to credential isolation via includeIf (#2286). v5 did not use includeIf so it was never an issue."

2. .github/workflows/changeset-required.yml:19,22 — floating actions/checkout@v4 + actions/setup-node@v4 (not SHA-pinned).

3. .github/workflows/docs-required.yml:19,22 — same pattern.

FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 behavior (cited)

Per actions/runner src/Runner.Common/Util/NodeUtil.cs DetermineActionsNodeVersion:

if (forceNode24) { return (NodeMigration.Node24, null); }
return (NodeMigration.Node20, null);

Per JobExtension.cs:

if (string.Equals(finalNodeVersion, NodeMigration.Node24)) {
    UpgradedToNode24Actions?.Add(actionName);  // emits a different warning
} else if (warnOnNode20) {
    DeprecatedNode20Actions?.Add(actionName);  // emits original warning
}

Both add to a list that context.Warning() reports later. The env var changes the runtime used (Node 24 instead of Node 20) but does NOT silence the deprecation warning.

What did you expect?

All workflows use @v5.0.1 or newer of actions/checkout and actions/setup-node (both declare using: node24). No deprecation warnings emitted.

Steps to reproduce

1. Open any PR against next.
2. Observe the GitHub Actions annotations panel — Node 20 deprecation warnings appear on the test workflow Windows lane and both changeset-required / docs-required workflows.

Error output / logs

Node.js 20 actions are deprecated. Please update the following actions to use Node.js 24: actions/checkout@v4.2.2

GSD Configuration

N/A

GSD State (if relevant)

N/A

Runtime settings.json (if relevant)

N/A

How often does this happen?

Every time (100% reproducible)

Impact

Minor — Cosmetic or edge case

Workaround (if any)

FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true partially redirects the runtime but does not silence the warning.

Additional context

Fix plan:

1. test.yml line 83: change Windows checkout from v4.2.2 SHA → actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd (v5.0.1). v5 doesn't use includeIf — auth-bug-safe. See: https://raw.githubusercontent.com/actions/checkout/v5/action.yml (declares using: node24)
2. test.yml line 36: remove FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true since no v4 action remains in test.yml.
3. changeset-required.yml lines 19, 22: upgrade to SHA-pinned actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd (v5.0.1) and actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 (v5.0.0).
4. docs-required.yml lines 19, 22: same.

Citations:

• Original v4 pin rationale: bug(ci): actions/checkout@v6 fails on windows-latest with "could not read Username" #161
• PR fix(ci): pin actions/checkout@v4 on Windows to bypass v6 includeIf auth bug #162 (added the Windows v4 pin): fix(ci): pin actions/checkout@v4 on Windows to bypass v6 includeIf auth bug #162
• PR fix: opt test workflow JS actions into Node 24 #350 (added FORCE_JAVASCRIPT_ACTIONS_TO_NODE24): fix: opt test workflow JS actions into Node 24 #350
• v6 includeIf bug upstream (still open): Fix includeIf case sensitivity on Windows self-hosted runners actions/checkout#2425
• checkout v5 action.yml declares node24: https://raw.githubusercontent.com/actions/checkout/v5/action.yml
• actions/runner FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 implementation (NodeUtil.cs): https://github.com/actions/runner/blob/main/src/Runner.Common/Util/NodeUtil.cs
• actions/runner FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 implementation (JobExtension.cs): https://github.com/actions/runner/blob/main/src/Runner.Worker/JobExtension.cs

Related:

• PR fix(ci): pin actions/checkout@v4 on Windows to bypass v6 includeIf auth bug #162 (added the Windows v4 pin)
• PR fix: opt test workflow JS actions into Node 24 #350 (added FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 to test.yml — partial fix)
• Issue bug(ci): actions/checkout@v6 fails on windows-latest with "could not read Username" #161 (Windows auth flake)
• Upstream Fix includeIf case sensitivity on Windows self-hosted runners actions/checkout#2425

Privacy Checklist

• I have reviewed all pasted output for PII (usernames, paths, API keys) and redacted where necessary