chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v3 → @3d3c42e5... # v7.0.1
  • actions/github-script@v6|v7 → @3a2844b7... # v9.0.0
  • nick-fields/assert-action@v1 → @0efd6166... # v4.0.1

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

Supersedes #50
Supersedes #49
Supersedes #47

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[Copilot]

Pull request overview

This PR upgrades selected GitHub Action dependencies to Node 24–based releases and switches them to SHA-pinned references with tag/version comments, improving runtime compatibility and supply-chain safety.

Changes:

• Update actions/github-script usage to a SHA pinned to v9.0.0 in both the composite action and the test workflow.
• Update actions/checkout usage to a SHA pinned to v7.0.1 in the test workflow.
• Update nick-fields/assert-action usage to a SHA pinned to v4.0.1 in the test workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
action.yml	Pins actions/github-script to v9.0.0 SHA within the composite action.
.github/workflows/test-positive.yml	Pins actions/github-script, actions/checkout, and nick-fields/assert-action to specific SHAs with version comments.

Suppressed comments (1)

action.yml:37

• pr_number is treated as a string and there’s no fallback to the event context when it’s not provided, even though the input description says it will default to extracting from the workflow event. This can lead to removeLabel being called with an empty/invalid issue_number, and also logs a misleading “No label to remove” when label exists but pr_number is missing.

          const label = '${{ steps.label.outputs.output }}';
          const prNumber = '${{ inputs.pr_number }}';
          
          if (label) {
            try {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

Follow-up (889abfa): also bumped cloudposse/github-action-jq@0.4.0 → @aff18a1f... # v0.4.1 in action.yml — 0.4.0 runs node20 (0.3.0 was node16), while the v0.4.1 release is node24. SHA verified against the tag.