CORE-5974: Bump GitHub Actions off deprecated Node 20 runtime

.github/actions/configure-aws-oidc/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to the `configure-aws-oidc` composite action are documented in this file.
 
+## 1.0.1
+
+### Changed
+
+- Pinned all internal `uses:` steps to commit SHAs with a version comment for auditability (CORE-5974).
+- Bumped `aws-actions/configure-aws-credentials` from `v6.2.3` to `v6.2.4`.
+- `OpenSesame/gha-oidc-access/get-role-arn` remains pinned to the same commit it already used (which is ahead of that repo's stale `v2` tag) — see PR notes.
+
 ## 1.0.0
 
 ### Added

.github/actions/configure-aws-oidc/action.yml

@@ -37,7 +37,7 @@ runs:
   steps:
     - name: Create AWS role session name
       id: create-role-session-name
-      uses: OpenSesame/core-github-actions/.github/actions/create-aws-role-session-name@47e33e390ee69d31c498e32ba01f7e227b6ee864
+      uses: OpenSesame/core-github-actions/.github/actions/create-aws-role-session-name@47e33e390ee69d31c498e32ba01f7e227b6ee864 # actions/create-aws-role-session-name/1.0.0
       with:
         action: ${{ inputs.action }}
         environment: ${{ inputs.environment }}
@@ -46,14 +46,14 @@ runs:
 
     - name: Resolve AWS role
       id: get-role-arn
-      uses: OpenSesame/gha-oidc-access/get-role-arn@42e851ba54935047834bc50a3e2de800cc4952b9
+      uses: OpenSesame/gha-oidc-access/get-role-arn@42e851ba54935047834bc50a3e2de800cc4952b9 # v2.0.2
       with:
         domain: ${{ inputs.domain }}
         env: ${{ inputs.environment }}
         ORG_READ_ONLY_SSH_KEY: ${{ inputs.ORG_READ_ONLY_SSH_KEY }}
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
+      uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
       with:
         role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
         aws-region: ${{ steps.get-role-arn.outputs.region }}

.github/actions/upsert-pr-comment/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to the **upsert-pr-comment** action are documented in this file.
 
+## 1.0.1
+
+### Changed
+
+- Bumped `actions/github-script` from `v7` (Node 20, deprecated runtime) to `v9.0.0` (Node 24), pinned by commit SHA with a version comment (CORE-5974).
+
 ## 1.0.0
 
 ### Added

.github/actions/upsert-pr-comment/action.yml

@@ -17,7 +17,7 @@ runs:
   using: composite
   steps:
     - name: Upsert PR summary comment
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         PR_NUMBER: ${{ inputs.pr-number }}
         COMMENT_MARKER: ${{ inputs.comment-marker }}

.github/workflows/CHANGELOGS/run_semgrep_scan.md

@@ -2,6 +2,12 @@
 
 All notable changes to the **run_semgrep_scan** callable workflow are documented in this file.
 
+## 1.0.2
+
+### Changed
+
+- Pinned `actions/checkout`, `actions/setup-node`, `actions/upload-artifact`, `reviewdog/action-setup`, and `actions/github-script` to Node 24-compatible releases by commit SHA (with version comments), addressing the GitHub Node 20 Actions runtime deprecation (CORE-5974).
+
 ## 1.0.1
 
 ### Changed

.github/workflows/deploy_thru_prod.yml

@@ -112,13 +112,13 @@ jobs:
 
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit-identifier }}
           fetch-depth: "0"
 
       - name: Create release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           tag: ${{ needs.Set-Release-Tag.outputs.release-tag }}
           commit: ${{ inputs.commit-identifier }}
@@ -133,7 +133,7 @@ jobs:
       BUILD_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
 
     steps:
-      - uses: mshick/add-pr-comment@v2
+      - uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # v3.12.0
         with:
           message: |
             # :page_with_curl: Status Report :page_with_curl:

.github/workflows/internal_on_merge_tag_versions.yml

@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 

.github/workflows/internal_on_pr_validate_component_version.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Get all labels from PR
         id: get_labels
@@ -46,7 +46,7 @@ jobs:
           echo "$all_labels" > all_labels.txt
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 

.github/workflows/internal_on_push_ci.yml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 

.github/workflows/run_semgrep_scan.yml

@@ -138,7 +138,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit_identifier }}
           # Full history only when diff/baseline is requested
@@ -152,7 +152,7 @@ jobs:
           commit-identifier: ${{ inputs.commit_identifier }}
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
@@ -184,7 +184,7 @@ jobs:
 
       - name: Upload Artifact
         if: ${{ steps.semgrep.outputs.totalFindings > 0 }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: semgrep-${{ github.run_id }}.json
           path: semgrep_results.json
@@ -193,7 +193,7 @@ jobs:
 
       - name: Set up Reviewdog
         if: ${{ steps.semgrep.outputs.totalFindings > 0 }}
-        uses: reviewdog/action-setup@v1
+        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
         with:
           reviewdog_version: v0.20.3
 
@@ -268,7 +268,7 @@ jobs:
       - name: Generate PR comment body
         if: ${{ github.event_name == 'pull_request' || steps.pr_check.outputs.pr_exists == 'true' }}
         id: generate_body
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr_check.outputs.pr_number }}
           SCAN_STATUS: ${{ steps.semgrep.outputs.scanStatus }}

.github/workflows/tf_apply.yml

@@ -78,20 +78,20 @@ jobs:
 
     steps:
       - id: get-role-arn
-        uses: OpenSesame/gha-oidc-access/get-role-arn@v2
+        uses: OpenSesame/gha-oidc-access/get-role-arn@1417c02442b956045a6930e271ce134faf8e09e6 # v2
         with:
           domain: ${{ inputs.oidc-domain }}
           env: ${{ inputs.environment }}
           ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
           role-session-name: ${{ inputs.terraform-workspace }}-${{ inputs.environment }}-Run${{ github.run_id }}
           aws-region: ${{ steps.get-role-arn.outputs.region }}
 
       - name: Checkout Actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit-identifier }}
 
@@ -106,7 +106,7 @@ jobs:
           chmod 600 ~/.ssh/id_rsa ~/.ssh/known_hosts
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: ${{ inputs.terraform-version }}
           terraform_wrapper: false # required to access terraform outputs after apply