ci: bump Node 20 actions to their Node 24 majors

[mpiton]

Bumps every action still targeting Node 20, per the deprecation annotations on the v0.3.0-beta.1 release run (29684865604) and on this PR's first CI pass:

• actions/checkout v4.3.1 → v7.0.0 (release.yml, mutants.yml, codspeed.yml)
• actions/setup-node v4.4.0 → v7.0.0 (release.yml)
• actions/cache v4.3.0 → v6.1.0 (ci.yml)
• moonrepo/setup-rust v0 → v1.3.0 (codspeed.yml)
• actions/upload-artifact v4 → v7.0.1 (mutants.yml — same Node 20 runtime, would annotate scheduled runs)
• actions/labeler v5 → v6.2.0, actions/first-interaction v1 → v3.1.0, actions/stale v9 → v10.4.0 (contributor.yml — labeler was still annotating PR runs)

All pinned by commit SHA + version comment, same convention as ci.yml/plugin-ci.yml which were already on v7.0.0. SHAs resolved from the upstream release tags via the GitHub API.

Input compatibility checked against each major's release notes: cache v6 keeps path/key; setup-rust v1.3.0 keeps channel/cache-target/bins; labeler v6 and stale v10 are Node-24-only bumps. first-interaction v3 renamed its inputs to snake_case — repo_token/pr_message/issue_message updated accordingly.

The reusable-workflow pin plugin-ci.yml@f63e53f8 in plugin-release.yml already points at a checkout v7 snapshot — untouched.

Verification: first CI pass on this PR was green with a single remaining Node 20 annotation (labeler), fixed since. contributor.yml only fires on issue/PR opened and the weekly cron, so the labeler/first-interaction bump proves out on the next opened PR; the release path gets confirmed on the next tag.

Fixes MAT-138

Summary by CodeRabbit

• Chores
  • Updated CI, E2E smoke, mutation testing, benchmarking, and release workflows to newer pinned GitHub Action revisions.
  • Improved caching and artifact handling consistency across runs by pinning action versions.
  • Updated workflow tooling to use Node.js 24-based releases via pinned setup action versions.
• Documentation
  • Refreshed the changelog entry to reflect the Node.js major version bump and the new pinned workflow revisions.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub Actions references are upgraded or pinned across CI, contributor, mutation-testing, and release workflows. The changelog records the corresponding Node.js 24 action updates and commit-SHA pinning.

Changes

Workflow action updates

Layer / File(s)	Summary
CI and benchmark action revisions .github/workflows/ci.yml, .github/workflows/codspeed.yml	The cache, checkout, and Rust setup actions use newer or pinned revisions.
Mutation workflow action pinning .github/workflows/mutants.yml	Incremental and full mutation-testing jobs pin checkout and artifact-upload actions to specific commits.
Contributor workflow action updates .github/workflows/contributor.yml	Contributor automation updates labeler, first-interaction, and stale actions, including renamed first-interaction inputs.
Release workflow upgrades and changelog .github/workflows/release.yml, CHANGELOG.md	Release jobs update checkout and Node setup action commits, and the changelog documents the Node.js 24 updates and SHA pinning.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mpiton/vortex#176: Updates pinned GitHub Actions in the release workflow.

Suggested labels: dependencies, configuration

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: upgrading workflow actions from Node 20-targeting versions to Node 24 majors.

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 123-126: Remove the cache: npm setting from the actions/setup-node
steps in .github/workflows/release.yml at lines 123-126, 190-193, and 270-273,
covering the Linux, macOS, and Windows release jobs; leave the node-version
configuration unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 856fb178-51f7-40bb-ba92-7f564a60d6cb

📥 Commits

Reviewing files that changed from the base of the PR and between f43a19e and d7304b6.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .github/workflows/codspeed.yml
• .github/workflows/mutants.yml
• .github/workflows/release.yml
• CHANGELOG.md

[cubic-dev-ai]

cubic analysis

No issues found across 5 files

Linked issue analysis

Linked issue: MAT-138: Bump actions/checkout et setup-node vers des versions Node 24

Status	Acceptance criteria	Notes
✅	Bump actions/checkout to Node‑24 major and pin by commit SHA in workflows (release.yml, codspeed.yml, mutants.yml).	Diff shows checkout usages updated to v7 commit SHAs in release.yml, codspeed.yml and mutants.yml.
✅	Bump actions/setup-node to Node‑24 major and pin by commit SHA where used (release.yml jobs that install Node).	Diff updates setup-node references to a v7 commit SHA with version comment in release.yml.
✅	Bump actions/cache to v6 and pin by commit SHA in ci.yml (maintain input compatibility).	ci.yml shows actions/cache updated to a v6 commit SHA; PR claims inputs are compatible and diff shows the change.
✅	Bump actions/upload-artifact to v7 and pin by commit SHA where used (mutants.yml).	mutants.yml shows upload-artifact updated to a v7 commit SHA.
✅	Bump moonrepo/setup-rust to v1.x and pin by commit SHA (codspeed.yml).	codspeed.yml shows moonrepo/setup-rust updated to v1.3.0 commit SHA.
✅	All updated actions are pinned by commit SHA and include a version comment.	Updated lines include commit SHAs and version comments consistent with the repo's convention.
⚠️	CI run on this PR and a release run must show zero 'Node.js 20 is deprecated' annotations (acceptance).	This is a runtime verification step not observable in the diff; the PR author asserts they updated the relevant workflows but the absence of deprecation annotations requires running CI/release and inspecting annotations.

_{Re-trigger cubic}

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks

---

_{Comparing feat/mat-138-bump-actions-node24 (d381623) with main (f43a19e)}