chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows (and action.yml) to versions running on the
  Node 24 runtime, SHA-pinned with precise version comments:
  • actions/checkout@v6 → @3d3c42e5... # v7.0.1
  • nick-fields/assert-action@v2 → @0efd6166... # v4.0.1
  • cloudposse/github-action-yaml-config-query@v1 → @8178e0c0... # v1.0.1

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Supersedes #46
Supersedes #45
Supersedes #44

[Copilot]

Pull request overview

Updates this repository’s composite action and CI workflows to use SHA-pinned GitHub Actions that are compatible with GitHub’s Node 24 runtime migration, aligning with the stated supply-chain pinning approach.

Changes:

• Pin actions/checkout in all test workflows to a specific SHA (v7.0.1).
• Pin nick-fields/assert-action in test workflows to a specific SHA (v4.0.1).
• Pin cloudposse/github-action-yaml-config-query in action.yml to a specific SHA (v1.0.1).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
action.yml	Pins cloudposse/github-action-yaml-config-query by SHA within the composite action steps.
.github/workflows/test-to-no-metadata.yml	Pins actions/checkout and nick-fields/assert-action by SHA.
.github/workflows/test-positive.yml	Pins actions/checkout and nick-fields/assert-action by SHA.
.github/workflows/test-negative.yml	Pins actions/checkout and nick-fields/assert-action by SHA.
.github/workflows/test-auto-to.yml	Pins actions/checkout and nick-fields/assert-action by SHA.
.github/workflows/test-auto-to-no-metadata.yml	Pins actions/checkout and nick-fields/assert-action by SHA.
.github/workflows/test-auto-from.yml	Pins actions/checkout and nick-fields/assert-action by SHA.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Erik Osterman (Cloud Posse) (osterman)]

Approving. All three SHAs verified against upstream tag refs, diff matches the description, no permissions/secrets/Dockerfile/release-config changes.

The only consumer-facing change is yaml-config-query@v1 → v1.0.1 inside action.yml — same major, low blast radius. The two test jobs reporting failure are the intentional negative paths (test-negative.yml, test-auto-to-no-metadata.yml); their asserts pass and the umbrella checks are green.