chore(ci): bump Node 20 actions to v5+/v6+/v7+ before 2026-06-02 deadline

[laradji]

Parent: none
Depends on: none — all upstream bumps already published as of 2026-04-17

Decision (locked 2026-04-17)

Bump three GitHub-provided and third-party actions from their Node 20 runtime to their Node 24 runtime by pinning newer major versions. All upstream bumps already exist; breaking changes for our usage shape are zero or near-zero. Defer to the opt-in FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true env flag as a fallback only if an upstream bump is delayed past 2026-05-15.

Why

GitHub deprecated Node 20 on Actions runners. 2026-06-02 Node 24 becomes default; 2026-09-16 Node 20 is removed from runners, breaking any action still pinned to it. Three actions in this repo emit the warning today.

Matrix of pins to bump

Action	Current pin	Bump to	Breaking changes relevant to our usage
actions/upload-artifact	@v4	@v7	v5 preliminary Node 24 support (non-breaking), v6 Node 24 default + requires runner ≥ 2.327.1 (GHA-hosted are fine), v7 ESM internals + opt-in archive: false direct uploads (we use vanilla, no impact)
actions/download-artifact	@v4	@v8	v5 fixes path behavior for download-by-ID (we download by name/pattern, no impact); v7 Node 24 default; v8 hash mismatch now errors by default (correctness improvement, welcome) + ESM internals
jdx/mise-action	@v2	@v4	v4.0.0 titled "Node.js 24 Runtime"; upstream labels it "seamless upgrade for vast majority of users". No config changes needed beyond the version string

Acceptance criteria

• .github/workflows/scrape-pack.yml L172 — actions/upload-artifact@v4 → @v7
• .github/workflows/scrape-pack.yml L223 — actions/download-artifact@v4 → @v8
• .github/workflows/release.yml L110, L252 — actions/upload-artifact@v4 → @v7 (2 sites)
• .github/workflows/release.yml L151, L217, L270 — actions/download-artifact@v4 → @v8 (3 sites)
• .github/workflows/release.yml L58 — jdx/mise-action@v2 → @v4
• After bump, re-dispatch one scrape-pack run and confirm the three Node 20 deprecation warnings are gone from the job annotations
• After bump, re-run one release.yml dispatch (no tag push — workflow_dispatch path) and confirm the job annotations are clean
• No README or CLAUDE.md changes — these are ambient CI bumps, not user-facing

Concrete file pointers

Files to modify (6 pin sites across 2 files):

• .github/workflows/scrape-pack.yml — L172 (upload), L223 (download)
• .github/workflows/release.yml — L58 (mise-action), L110 (upload), L151 (download), L217 (download), L252 (upload), L270 (download)

Files to read as reference — do NOT change:

• .github/workflows/cache-keepalive.yml when feat(ci): cache-keepalive workflow to prevent 7-day artifact-cache eviction #128 lands — same-day pin review applies, same rules
• .github/workflows/update-package-channels.yml — uses actions/checkout@v5, already Node 24 runtime, unaffected
• .github/workflows/ci.yml — all actions/checkout@v6 + actions/setup-go@v6 + actions/cache@v5, all on Node 24 or pure-GHE already, unaffected

Test commands (literal, for agent self-check)

• Search for stale pins after bump: grep -rE "upload-artifact@v4|download-artifact@v4|mise-action@v2" .github/ should return zero lines
• After pushing the bump: gh workflow run scrape-pack.yml --ref <branch> -f lib=/modelcontextprotocol/go-sdk → gh run view <id> --json jobs --jq '.jobs[].annotations' should not contain "Node.js 20 actions are deprecated"

Out of scope (fenced)

• No revert to FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 env flag — only the version pin bump. The env flag is a fallback, not the plan
• No bumps to checkout, setup-go, cache — those are on Node 24 already at their current pins
• No refactor of workflow file structure — only the version strings change
• No simultaneous bump of runner versions — runner minimums are already met by GHA-hosted runners
• No PR-template or release-note updates — ambient CI change

Timeline

• 2026-04-17 (today) — upstream bumps verified available, issue filed
• 2026-05-15 (soft deadline) — bump merged, gives 2+ weeks of cushion before 2026-06-02 default flip
• 2026-06-02 (default flip) — Node 24 becomes the runner default
• 2026-09-16 (hard deadline) — Node 20 removed; any unpinned v4 action starts failing

Related

• feat(ci): cache-keepalive workflow to prevent 7-day artifact-cache eviction #128 — cache-keepalive workflow (filed same day, will add a fourth pin site to review when it lands)
• Closed Research: Batch scrape pipeline via GitHub Actions matrix #53 / feat: .github/workflows/scrape-pack.yml — matrix scrape + cache + consolidate producing deadzone.db #126 / feat(ci): add scrape-pack workflow for batch registry scrapes #127 discussion first surfaced these warnings