Update and validate GitHub Actions for Node 24 runner migration

[parsakhaz]

Intent

GitHub is forcing JavaScript actions that currently run on Node 20 to run on Node 24 by default starting June 16, 2026. Pane's active CI, preview deploy, nightly/canary, release, and website notification workflows currently use multiple Node 20 actions. This is high priority because these workflows cover quality checks, packaging, release publishing, preview deploys, and downstream website release notifications.

Source: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Scope

Audit and update Pane's GitHub Actions workflows to use Node 24-compatible action versions, then validate that all important workflow paths still pass.

Include these active workflows from the June 12, 2026 audit:

• Code Quality
• Deploy Remote PWA Preview
• Nightly / Canary Release
• Build & Release
• Notify website on release

GitHub traffic → PostHog was also active, but it does not currently use third-party JavaScript actions, so it is not exposed to this specific Node 20 action-runtime migration.

Starting Points

Non-exhaustive action inventory from the audit:

• actions/checkout@v4
• actions/setup-python@v5
• pnpm/action-setup@v4
• actions/setup-node@v4
• actions/cache@v4
• actions/upload-artifact@v4
• actions/download-artifact@v4
• google-github-actions/auth@v2
• google-github-actions/setup-gcloud@v2
• peter-evans/repository-dispatch@v3

Likely Node 24-compatible majors to evaluate include actions/checkout@v5+, actions/setup-python@v6, pnpm/action-setup@v5, actions/setup-node@v5, actions/cache@v5, actions/upload-artifact@v6, google-github-actions/auth@v3, google-github-actions/setup-gcloud@v3, and peter-evans/repository-dispatch@v4. Verify current upstream recommendations before changing versions.

This list is not exhaustive. Treat it as a starting point and investigate further before implementation.

Acceptance Criteria

• All Pane workflows using JavaScript actions are upgraded to maintained Node 24-compatible action versions where available.
• Code Quality passes on pull request and push paths.
• Deploy Remote PWA Preview is validated, including Google Cloud auth/setup and Cloud Run deployment behavior.
• Nightly / Canary Release is validated for artifact creation/download/publish behavior.
• Build & Release is validated across Linux, macOS, and Windows packaging paths before relying on it for a release.
• Notify website on release is validated so downstream website dispatch still fires.
• The fix does not change the app's own runtime Node version unless required by workflow tooling.
• No workflow relies on ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true as the long-term solution.

Inputs Needed

• Confirmation of which release and preview deploy workflows can be safely run manually during validation.
• Any release timing constraints if this is done close to a tagged release.

Notes

Current GitHub runner warnings say Node 20 will be removed from runners on September 16, 2026. ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true can be used only as an emergency temporary opt-out after June 16, not as the durable fix.