[code-update-service] Running code-update job: actions-node20-runtime-upgrade

[code-update-service]

🤖 This PR was raised by the code-update-service! 🤖.

This code update job updates outdated GitHub Actions pins that still trigger deprecated Node.js 20 runtime warnings.
It focuses on workflow action version upgrades to align with the Node24 runtime migration.
🤖 Changes are generated by claude-code. 🤖

⚙️ Workflow run: code-update-service#33405540718

Action Runtime Upgrade Summary

Update GitHub Actions version pins to eliminate Node.js 20 runtime deprecation warnings.

Actions upgraded

File	Action	Old	New
.github/workflows/actions.yml	actions/checkout	v4 (SHA pin)	v5
.github/workflows/website.yml	actions/checkout	v4 (SHA pin)	v5
.github/workflows/docker.yml	actions/checkout	v4 (SHA pin)	v5
.github/workflows/docker.yml	docker/metadata-action	v4 (SHA pin)	v6
.github/workflows/docker.yml	docker/login-action	v2 (SHA pin)	v4
.github/workflows/docker.yml	docker/build-push-action	v4 (SHA pin)	v7
.github/workflows/ci.yml	actions/checkout	v4 (SHA pin)	v5
.github/workflows/ci.yml	actions/setup-node	@master (rolling ref)	v6
.github/workflows/ci.yml	pnpm/action-setup	v4.0.0 (SHA pin)	v6
.github/workflows/ci.yml	actions/cache	v3 (SHA pin)	v5

Files changed

• .github/workflows/actions.yml
• .github/workflows/website.yml
• .github/workflows/docker.yml
• .github/workflows/ci.yml

Files not changed

• .github/workflows/release.yml — only contains a reusable workflow call (out of scope)
• .github/workflows/pr.yml — only contains reusable workflow calls (out of scope)

Actions that could not be auto-resolved

File	Action	Reason
.github/workflows/website.yml	the-guild-org/shared-config/setup@main	No semver releases in the-guild-org/shared-config repo; only monorepo package tags exist
.github/workflows/website.yml	the-guild-org/shared-config/website-cf@main	No semver releases in the-guild-org/shared-config repo; only monorepo package tags exist

[Copilot]

Pull request overview

Changes: Build and packaging (1)

This PR updates GitHub Actions workflow uses: pins to newer major versions intended to remove Node.js 20 runtime deprecation warnings and align with the Node24 runtime migration.

Changes:

• Upgrade workflow action references (checkout/setup-node/cache/docker actions) to newer major versions.
• Replace some previously SHA-pinned uses: references with version tags (e.g. @v5, @v6).
• Update CI caching action version alongside other workflow action upgrades.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/actions.yml	Bumps actions/checkout reference.
.github/workflows/website.yml	Bumps actions/checkout reference for website workflow.
.github/workflows/docker.yml	Bumps actions/checkout and Docker-related actions (metadata/login/build-push).
.github/workflows/ci.yml	Bumps checkout/setup-node/pnpm/action-setup/cache; reviewed pnpm cache output usage.

Suppressed comments (3)

.github/workflows/actions.yml:15

• Actions are now referenced by a mutable tag (@v5). For supply-chain hardening, pin GitHub Actions to a full commit SHA (and keep the version comment) so the executed code can’t change unexpectedly.

        uses: actions/checkout@v5

.github/workflows/docker.yml:16

• Several actions in this workflow are now referenced by mutable tags (e.g. @v5, @v6, @v4, @v7). For supply-chain hardening, pin these uses: references to full commit SHAs (and keep the version comment) so the executed code can’t change unexpectedly.

        uses: actions/checkout@v5

.github/workflows/ci.yml:40

• The pnpm cache dir output isn’t being set correctly, and the cache path expression uses invalid syntax (${ env.dir }). As written, this will likely prevent caching from working.

      - name: Get pnpm cache - Set output
        id: pnpm-cache
        run: echo "{dir}={pnpm cache dir}" >> $GITHUB_OUTPUT

      - name: Cache pnpm
        uses: actions/cache@v5
        with:
          path: ${ env.dir }
          key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.