ci: update Node.js version in safe_settings_sync.yml to resolve Node 20 deprecation

[yvonnedevlinrh]

Summary

The safe_settings_sync.yml workflow is pinned to Node.js 20, which is being deprecated on GitHub Actions runners. This generates the following warning on every workflow run:

Node 20 is being deprecated. This workflow is running with Node 24 by default. If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

This was first observed as part of the CI failures on PR #40.

Location

File: .github/workflows/safe_settings_sync.yml
Line: 103

- name: Setup Node.js
  uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
  with:
    node-version: '20'

Context

The pinned Node 20 version is driven by the safe-settings dependency. The workflow currently pins safe-settings to commit 594f3c706de6c4ddafb1a86dfa7468f19337e54f (v2.1.18, last version compatible with Probot v13). Before bumping the Node version, compatibility with the targeted safe-settings version should be confirmed.

Proposed Change

Update node-version from '20' to '22' (current LTS) after verifying that the pinned safe-settings version (594f3c7) is compatible with Node 22:

- name: Setup Node.js
  uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
  with:
    node-version: '22'

If Node 22 introduces compatibility issues with the current safe-settings pin, the short-term fallback is to set the environment variable to suppress the warning while the safe-settings version is evaluated:

env:
  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true

Acceptance Criteria

• safe_settings_sync.yml no longer produces a Node 20 deprecation warning
• Dry-run (dry-run: true) dispatch of the workflow completes successfully
• No regression in safe-settings sync behaviour

[yvonnedevlinrh]

1. Compatibility check first — since safe-settings v2.1.18 is pinned specifically because it's the last version compatible with Probot v13, it's worth running npm ci locally against Node 22 to confirm nothing breaks before merging.
2. The ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION fallback is explicitly described in the deprecation notice as a temporary measure, so it shouldn't be the permanent fix — just a safety valve if Node 22 has issues.