chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • docker/build-push-action@v5 → @53b7df96... # v7.3.0
  • docker/login-action@v3 → @dbcb8138... # v4.6.0
  • docker/setup-buildx-action@v3 → @bb05f3f5... # v4.2.0
  • stefanzweifel/git-auto-commit-action@v5 → @4a55954c... # v7.2.0

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• charmbracelet/vhs-action@v1 — no Node 24 release exists yet
• cloudposse/actions/github/auto-assign@0.30.0 and
  cloudposse/actions/github/slash-command-dispatch@0.33.0 — legacy monorepo actions with no
  Node 24 release
• actions/labeler@v2.1.0 — ancient major not covered by this mechanical pass; upgrading to v7
  requires migrating the labeler config format, so it deserves its own PR
• actions/first-interaction@v1 — no Node 24 release covered by this pass
• github/super-linter/slim@v5 — Docker-based action, not affected by the Node runtime
  deprecation
• mszostok/codeowners-validator@v0.7.1 — Docker-based action, not affected
• cloudposse/.github/.github/workflows/shared-auto-release.yml@main — reusable workflow ref,
  intentionally left on @main

[github-actions]

Thank you for submitting this PR! If you haven't already joined our slack community, then we invite you to do so.

We receive an overwhelming number of contributions. By joining our slack, we'll be able to review your PR faster.

[Copilot]

Pull request overview

This PR updates GitHub Actions workflow dependencies to Node 24-compatible releases by replacing floating version tags with SHA-pinned action references annotated with their corresponding upstream versions, aligning with the repository’s supply-chain hardening approach.

Changes:

• Replace actions/checkout@v4 with a SHA-pinned ref (# v7.0.1) across workflows.
• Replace Docker-related actions (setup-buildx, login, build-push) with SHA-pinned refs and version comments.
• Replace stefanzweifel/git-auto-commit-action@v5 with a SHA-pinned ref (# v7.2.0) in the VHS workflow.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/vhs.yaml	Pins checkout, buildx, and auto-commit actions to SHA refs with version comments.
.github/workflows/validate-codeowners.yml	Pins checkout action to a SHA ref with a version comment.
.github/workflows/lint.yml	Pins checkout action to a SHA ref with a version comment in both jobs.
.github/workflows/docker.yml	Pins checkout and Docker build/login/buildx actions to SHA refs with version comments.
.github/workflows/chatops.yml	Pins checkout action to a SHA ref with a version comment in both jobs.
.github/workflows/auto-readme.yml	Pins checkout action to a SHA ref with a version comment.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

CI triage for this PR

superlinter / "--> Linted: GITHUB_ACTIONS" — surfaced by this PR, fixed in 8a5416d. super-linter runs with VALIDATE_ALL_CODEBASE: false, so it only lints files the PR touches. Touching .github/workflows/vhs.yaml (pin bumps) surfaced pre-existing shellcheck SC2086 findings on lines this PR did not change (unquoted >> $GITHUB_STEP_SUMMARY redirects). Quoted all three occurrences; actionlint passes on the file.

validate-codeowners — pre-existing, fixed in 164eab5. Failed with Teams for organization "cloudposse" could not be queried. Requires GitHub authorization. — the workflow feeds secrets.REPO_ACCESS_TOKEN to codeowners-validator and that token is dead (see auto-readme below). Replaced with the org-standard shared cloudposse/.github/.github/workflows/shared-codeowners.yml@main (triggers on pull_request, so it takes effect on this PR).

auto-readme — pre-existing, needs a maintainer. Fails at Privileged Checkout with Input required and not supplied: token: the workflow passes token: ${{ secrets.REPO_ACCESS_TOKEN }} and the secret is empty/revoked. This is a same-repo branch (not a fork), so secrets are in scope — the secret itself is dead. It last worked on 2026-01-14 (osterman/archive-deprecation), so it broke sometime after that, independent of this PR. A maintainer needs to restore REPO_ACCESS_TOKEN (this also caused the codeowners failure above).

readme — pre-existing, needs a maintainer. make readme/lint diffs the committed README.md against what the current templates generate. README.md was last regenerated on 2024-10-09 (commit 0cb4800), while the templates in cloudposse/build-harness:latest now produce the atmos-style header and © 2016-2026 copyright — so the lint fails for any branch cut from master today. This PR touches no README files. Fix is to regenerate/commit README.md on master (normally auto-readme would do this, but it is broken per above).