chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump the last node20-era action pin to Node 24, SHA-pinned per this repo's convention:
  • golangci/golangci-lint-action@4afd733a # v8.0.0 → @ba0d7d2e... # v9.3.0 — safe here since
    the workflow uses install-mode: none with a custom-built golangci-lint from a Nov-2025 (v2-era)
    commit, which v9 supports
• Re-pin the cloudposse/.github shared-workflow refs (shared-go-auto-release.yml,
  shared-release-branches.yml) from 8244c7c9 # main to current main 49ac8cd5 # main — the old
  pin predates chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261, so release workflows were still running node20 action
  versions from the stale snapshot

why

• GitHub is deprecating the Node 20 runtime; these were the remaining refs in this repo resolving
  to runs.using: node20
• Verified: every changed SHA matches its upstream tag / branch head, this repo's own
  verify-sha-pinning test suite passes (28/28) over the modified tree, and actionlint is clean

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• bobheadxi/deployments@648679e8 # v1 — latest release is still node20; no node24 version to pin
  https://github.com/bobheadxi/deployments
• cloudposse/github-action-seek-deployment@9c18326d # 0.1.1 — node20; runtime bump tracked in
  Upgrade action runtime to Node 24 github-action-seek-deployment#29 (needs a maintainer with push access)

Summary by CodeRabbit

• Chores

  • Updated automated build, test, release, and nightly workflows to use newer shared workflow revisions.
  • Upgraded the static analysis workflow’s linting action for improved maintenance and compatibility.
  • Updated workflow verification references to use newer pinned revisions.

• Release Configuration

  • Updated the release packaging configuration to the newer configuration format while preserving binary archives.

[atmos-pro]

Tip

Atmos Pro  

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/test.yml

Package	Version	License	Issue Type
cloudposse/.github/.github/workflows/shared-go-auto-release.yml	49ac8cd5c4cf74abdbf24a80027cd3bde811133a	Null	Unknown License

Allowed Licenses:

MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-2-Clause-Views, BSD-3-Clause, ISC, MPL-2.0, 0BSD, Unlicense, CC0-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-3.0, Python-2.0, OFL-1.1, LicenseRef-scancode-generic-cla, LicenseRef-scancode-unknown-license-reference, LicenseRef-scancode-unicode, LicenseRef-scancode-google-patent-license-golang

Excluded from license check:

pkg:golang/github.com/antlr4-go/antlr/v4, pkg:golang/github.com/google/cel-go, pkg:golang/golang.org/x/image, pkg:golang/modernc.org/libc, pkg:golang/github.com/opencontainers/go-digest, pkg:npm/pako, pkg:npm/sax

Scanned Files

• .github/workflows/test.yml

[mergify]

Important

Cloud Posse Engineering Team Review Required

This pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes.

To expedite this process, reach out to us on Slack in the #pr-reviews channel.

[Copilot]

Pull request overview

This PR updates GitHub Actions workflow references to eliminate remaining Node 20–runtime action usage by bumping SHA-pinned reusable workflow refs from cloudposse/.github and upgrading golangci/golangci-lint-action to a Node 24–compatible release, aligning with the repository’s SHA-pinning convention.

Changes:

• Re-pin cloudposse/.github reusable workflow calls to a newer main commit SHA across release-related workflows.
• Upgrade golangci/golangci-lint-action from v8.0.0 to v9.3.0 (SHA-pinned) in the CodeQL workflow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/test.yml	Updates reusable workflow pin for push-triggered release job.
.github/workflows/nightlybuilds.yml	Updates reusable workflow pin for nightly release job.
.github/workflows/feature-release.yml	Updates reusable workflow pin for label-triggered feature release job.
.github/workflows/codeql.yml	Upgrades golangci-lint action to a newer SHA-pinned version.
.github/workflows/build.yml	Updates reusable workflow pin for release-branches workflow call.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2c020d81-fb2a-4bbe-af8f-1b1278703d37

📥 Commits

Reviewing files that changed from the base of the PR and between a11fb63 and e1ca674.

📒 Files selected for processing (1)

• .goreleaser.yml

---

📝 Walkthrough

Walkthrough

The pull request updates shared release workflow pins, the CodeQL lint action version, and the GoReleaser configuration.

Changes

Release and workflow updates

Layer / File(s)	Summary
Release workflow revisions .github/workflows/build.yml, .github/workflows/feature-release.yml, .github/workflows/nightlybuilds.yml, .github/workflows/test.yml, .github/actions/verify-sha-pinning/README.md	Release jobs and documentation now reference the shared Go auto-release workflow at commit 49ac8cd5c4cf74abdbf24a80027cd3bde811133a.
GoReleaser configuration .goreleaser.yml	The configuration declares version 2 and uses formats: [binary] for archives.
CodeQL lint action update .github/workflows/codeql.yml	The workflow now uses golangci/golangci-lint-action version v9.3.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Mergeability Score: ⚪ Minimal · up to e1ca6

This PR updates GitHub Actions and shared workflow pins to Node 24-compatible revisions without an actionable merge-blocking risk remaining after normal checks and review.

Possibly related PRs

• cloudposse/atmos#2717: Updates GitHub Actions workflow references with different revisions.

Suggested reviewers: aknysh, osterman

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary changes to GitHub Actions runtime versions and SHA pinning.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/node24-runtime-upgrade

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[John C. Bland II (johncblandii)]

Follow-up (e1ca674): migrated .goreleaser.yml to the GoReleaser v2 schema (version: 2, archives[].formats) and validated with goreleaser check v2.17.1. Context: shared-go-auto-release.yml (via cloudposse/.github#261) now installs GoReleaser v2 through goreleaser-action v7's version: latest, and v2 rejects configs without a version: 2 key — this would have failed the next atmos release. The org fallback config gets the same migration in cloudposse/.github#267.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.98%. Comparing base (6c44717) to head (e1ca674).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2934      +/-   ##
==========================================
- Coverage   82.98%   82.98%   -0.01%     
==========================================
  Files        1881     1881              
  Lines      183067   183067              
==========================================
- Hits       151925   151910      -15     
- Misses      23317    23332      +15     
  Partials     7825     7825              

Flag	Coverage Δ
unittests	82.98% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 9 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.