fix: update diverse actions

[hupling]

Pull Request

Changes

• ...
• ...

Reference

Relates to #XXX

Testing

URL to pull request or branch for testing your changes in sps-repo : ...

Checklist

Note: If some checklist items are not relevant for your PR, just remove them.

General

• Met all acceptance criteria of the issue
• Added meaningful PR title and list of changes in the description
• Documented changes in documentation files (docs/action.md, docs/workflows.md and/or docs/deployment.md)
• Tested changes with sample project https://github.com/it-at-m/sps

Code

• Wrote code and comments in English
• Coming soon: Added unit tests

Summary by CodeRabbit

• Chores
  • Updated continuous integration and deployment pipeline tooling, including GitHub Actions and build automation dependencies, to current versions across all project workflows and action templates.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates pinned commit SHAs for GitHub Actions marketplace actions across all CI/CD workflows and composite action templates. Core actions like actions/checkout, actions/setup-node, and artifact handling actions are bumped to newer versions. No workflow logic, step configuration, or action inputs are changed; only the pinned SHAs are updated.

Changes

Unified GitHub Actions version pinning update

Layer / File(s)	Summary
Core checkout and repository setup actions .github/workflows/action-reviewdog.yml, .github/workflows/action-superlint.yml, .github/workflows/dependency_review.yaml, .github/workflows/test-action-npm-build.yml, .github/workflows/test-action-npm-release.yml, action-templates/actions/action-actionlint/action.yml, action-templates/actions/action-checkout/action.yml, action-templates/actions/action-codeql/action.yml, action-templates/actions/action-pr-labeler/action.yml, action-templates/actions/action-trivy/action.yml, action-templates/actions/action-npm-release/action.yml, action-templates/actions/action-maven-build/action.yml, action-templates/actions/action-maven-release/action.yml, action-templates/actions/action-dockercompose-healthcheck/action.yml	actions/checkout is updated from v5.0.1 to v6.0.2 across 14 workflow and action template files that perform repository checkout operations.
Build tooling and artifact management actions .github/workflows/release-actions.yml, action-templates/actions/action-build-docs/action.yml, action-templates/actions/action-npm-build/action.yml, action-templates/actions/action-maven-build/action.yml, action-templates/actions/action-maven-release/action.yml, action-templates/actions/action-create-github-release/action.yml, action-templates/actions/action-deploy-docs/action.yml, action-templates/actions/action-trivy/action.yml	actions/setup-node (v5.0.0 → v6.4.0), actions/upload-artifact (various → v7.0.1), actions/download-artifact (v5.0.0 → v8.0.1), actions/configure-pages, actions/upload-pages-artifact, and actions/deploy-pages (v4.0.5 → v5.0.0) are updated across build, release, and pages deployment templates.
Code analysis and automated commit actions action-templates/actions/action-codeql/action.yml, action-templates/actions/action-dependency-review/action.yml, .github/workflows/dependency_review.yaml, .github/workflows/action-superlint.yml	github/codeql-action (v3.35.4 → v4.35.4), actions/dependency-review-action (v4.9.0 → v5.0.0), and stefanzweifel/git-auto-commit-action (v6.0.1 → v7.1.0) are updated in security scanning and linting workflows.
Container, release, and filtering actions action-templates/actions/action-build-image/action.yml, action-templates/actions/action-filter/action.yml, action-templates/actions/action-npm-release/action.yml	Docker actions (docker/login-action v3.7.0 → v4.1.0, docker/metadata-action v5.10.0 → v6.0.0, docker/build-push-action v6.19.2 → v7.1.0), peter-evans/create-pull-request (v7.0.11 → v8.1.1), and dorny/paths-filter (v3.0.3 → v4.0.1) are updated in container build and release automation.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 A rabbit hops through actions old,
Pinning SHAs, brave and bold,
From v5 to v6, the checkouts flow,
Artifacts dance in versions aglow,
No logic changed, just safer ground,
Where newer builds are safely found! 🚀

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description uses the template structure but fails to populate required sections. The 'Changes' section contains only placeholder dashes, 'Reference' has a placeholder issue number, testing URL is placeholder text, and no concrete information about the 27+ files modified is provided.	Replace placeholder content with actual changes: list all updated actions and versions in the Changes section, provide the actual related issue number(s), include a real testing URL or remove if not applicable, and check relevant checklist items.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix: update diverse actions' directly addresses the main change: updating GitHub Actions to newer versions across multiple workflows and action templates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

action-templates/actions/action-trivy/action.yml (1)

50-50: 🧹 Nitpick | 🔵 Trivial | 💤 Low value

Consider pinning the CodeQL action to a specific SHA for consistency.

This file pins other actions to commit SHAs (lines 18, 23, 41) for security, but line 50 uses only a tag reference (@v4). While not blocking for this PR, consider pinning to a SHA in a follow-up to maintain consistency with the repo's security practices.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@action-templates/actions/action-trivy/action.yml` at line 50, The GitHub
Action reference "github/codeql-action/upload-sarif@v4" should be pinned to a
specific commit SHA for consistency with other actions; replace the tag "@v4"
with the corresponding commit SHA for the upload-sarif action (the same pattern
used for other actions in this file) and verify the SHA matches the intended
release; update the uses entry for "github/codeql-action/upload-sarif" so it
references the exact commit SHA rather than the floating tag.

action-templates/actions/action-npm-build/action.yml (1)

1-1: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix SHA mismatch in github/codeql-action and address breaking changes from major version updates.

Critical: The pinned SHA for github/codeql-action v4.35.4 is incorrect:

• Pinned: 68bde559dea0fdcac2102bfdf6230c5f70eb485e
• Actual v4.35.4 tag: 3ce22a6e336a7fcc318bc58ae1986395bdc83ba7

Update this to the correct SHA immediately.

All other action SHAs are correctly pinned. However, the major version updates introduce breaking changes that may require workflow adjustments:

• actions/upload-artifact v7: ESM runtime upgrade, Node 24 required; note the new archive parameter behavior for direct uploads
• peter-evans/create-pull-request v8: Node.js 24 runtime requires self-hosted runners to upgrade to v2.327.1+
• github/codeql-action v4: Node.js 24 runtime (v3 used Node 20)
• actions/checkout v6: Credential storage location changed; Docker container actions require runner v2.329.0+
• actions/setup-node v6: Automatic caching limited to npm only (v5 cached for all managers); always-auth input removed
• actions/dependency-review-action v5: Verify compatibility with current usage
• stefanzweifel/git-auto-commit-action v7.1: Verify compatibility with current usage

Ensure runner versions on self-hosted infrastructure meet minimum requirements before merging.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@action-templates/actions/action-npm-build/action.yml` at line 1, Update the
incorrect pinned SHA for github/codeql-action v4.35.4 from
68bde559dea0fdcac2102bfdf6230c5f70eb485e to the correct SHA
3ce22a6e336a7fcc318bc58ae1986395bdc83ba7 in the action YAML (refer to the name:
"Npm build" and the github/codeql-action v4.35.4 reference), and then review and
adjust workflows for breaking changes introduced by the major version upgrades
listed (actions/upload-artifact v7, peter-evans/create-pull-request v8,
github/codeql-action v4, actions/checkout v6, actions/setup-node v6,
actions/dependency-review-action v5, stefanzweifel/git-auto-commit-action v7.1)
ensuring self-hosted runners meet the minimum runner versions and any changed
inputs/behaviors (archive param, Node 24 runtime, credential storage,
caching/always-auth) are handled before merging.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@action-templates/actions/action-build-image/action.yml`:
- Line 39: The updated action pins (actions/checkout@v6.0.2,
actions/download-artifact@v8.0.1, docker/login-action@v4.1.0,
docker/metadata-action@v6.0.0, docker/build-push-action@v7.1.0) require GitHub
Actions Runner v2.327.1+ (Node 24); update documentation and deployment checks
to require that runner version before merging. Add a clear note to the action's
metadata/README and your release/PR checklist stating "Requires runner v2.327.1
or later", and update any self-hosted runner upgrade instructions or CI workflow
configuration to use GitHub-hosted runners that meet v2.327.1+ (or
verify/upgrade self-hosted runners) so the new uses entries (actions/checkout,
actions/download-artifact, docker/* actions) will run correctly.

---

Outside diff comments:
In `@action-templates/actions/action-npm-build/action.yml`:
- Line 1: Update the incorrect pinned SHA for github/codeql-action v4.35.4 from
68bde559dea0fdcac2102bfdf6230c5f70eb485e to the correct SHA
3ce22a6e336a7fcc318bc58ae1986395bdc83ba7 in the action YAML (refer to the name:
"Npm build" and the github/codeql-action v4.35.4 reference), and then review and
adjust workflows for breaking changes introduced by the major version upgrades
listed (actions/upload-artifact v7, peter-evans/create-pull-request v8,
github/codeql-action v4, actions/checkout v6, actions/setup-node v6,
actions/dependency-review-action v5, stefanzweifel/git-auto-commit-action v7.1)
ensuring self-hosted runners meet the minimum runner versions and any changed
inputs/behaviors (archive param, Node 24 runtime, credential storage,
caching/always-auth) are handled before merging.

In `@action-templates/actions/action-trivy/action.yml`:
- Line 50: The GitHub Action reference "github/codeql-action/upload-sarif@v4"
should be pinned to a specific commit SHA for consistency with other actions;
replace the tag "@v4" with the corresponding commit SHA for the upload-sarif
action (the same pattern used for other actions in this file) and verify the SHA
matches the intended release; update the uses entry for
"github/codeql-action/upload-sarif" so it references the exact commit SHA rather
than the floating tag.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: ad6f8f22-d932-4b94-accd-2b9398399f0e

📥 Commits

Reviewing files that changed from the base of the PR and between cc7c47f and a6110e5.

📒 Files selected for processing (22)

• .github/workflows/action-reviewdog.yml
• .github/workflows/action-superlint.yml
• .github/workflows/dependency_review.yaml
• .github/workflows/release-actions.yml
• .github/workflows/test-action-npm-build.yml
• .github/workflows/test-action-npm-release.yml
• action-templates/actions/action-actionlint/action.yml
• action-templates/actions/action-build-docs/action.yml
• action-templates/actions/action-build-image/action.yml
• action-templates/actions/action-checkout/action.yml
• action-templates/actions/action-codeql/action.yml
• action-templates/actions/action-create-github-release/action.yml
• action-templates/actions/action-dependency-review/action.yml
• action-templates/actions/action-deploy-docs/action.yml
• action-templates/actions/action-dockercompose-healthcheck/action.yml
• action-templates/actions/action-filter/action.yml
• action-templates/actions/action-maven-build/action.yml
• action-templates/actions/action-maven-release/action.yml
• action-templates/actions/action-npm-build/action.yml
• action-templates/actions/action-npm-release/action.yml
• action-templates/actions/action-pr-labeler/action.yml
• action-templates/actions/action-trivy/action.yml

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚖️ Poor tradeoff

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify that each pinned SHA corresponds to the claimed version tag

echo "Checking actions/checkout v6.0.2 → de0fac2e4500dabe0009e67214ff5f5447ce83dd"
gh api repos/actions/checkout/git/ref/tags/v6.0.2 --jq '.object.sha' | grep -q 'de0fac2e4500dabe0009e67214ff5f5447ce83dd' && echo "✓ actions/checkout SHA verified" || echo "✗ actions/checkout SHA mismatch"

echo "Checking actions/download-artifact v8.0.1 → 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
gh api repos/actions/download-artifact/git/ref/tags/v8.0.1 --jq '.object.sha' | grep -q '3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' && echo "✓ actions/download-artifact SHA verified" || echo "✗ actions/download-artifact SHA mismatch"

echo "Checking docker/login-action v4.1.0 → 4907a6ddec9925e35a0a9e82d7399ccc52663121"
gh api repos/docker/login-action/git/ref/tags/v4.1.0 --jq '.object.sha' | grep -q '4907a6ddec9925e35a0a9e82d7399ccc52663121' && echo "✓ docker/login-action SHA verified" || echo "✗ docker/login-action SHA mismatch"

echo "Checking docker/metadata-action v6.0.0 → 030e881283bb7a6894de51c315a6bfe6a94e05cf"
gh api repos/docker/metadata-action/git/ref/tags/v6.0.0 --jq '.object.sha' | grep -q '030e881283bb7a6894de51c315a6bfe6a94e05cf' && echo "✓ docker/metadata-action SHA verified" || echo "✗ docker/metadata-action SHA mismatch"

echo "Checking docker/build-push-action v7.1.0 → bcafcacb16a39f128d818304e6c9c0c18556b85f"
gh api repos/docker/build-push-action/git/ref/tags/v7.1.0 --jq '.object.sha' | grep -q 'bcafcacb16a39f128d818304e6c9c0c18556b85f' && echo "✓ docker/build-push-action SHA verified" || echo "✗ docker/build-push-action SHA mismatch"

Repository: it-at-m/lhm_actions

Length of output: 655

---

🌐 Web query:

actions/checkout v6 breaking changes

💡 Result:

actions/checkout v6 breaking-change summary (from official repo docs/changelog): 1) persist-credentials storage location change (behavioral breaking for some environments) - In v6.0.0, persist-credentials was changed to store the credentials in a separate file under $RUNNER_TEMP instead of writing them directly into the local .git/config [1][2]. - Because the credentials are no longer read from .git/config, authenticated git commands from Docker container actions require a minimum Actions Runner version of v2.329.0 (or later) so the container can access the persisted credentials in their new location [1][2]. - For most workflows, this is not expected to require workflow changes: the v6 “What’s new” text states that no workflow changes are required and that git fetch, git push, etc. continue to work automatically [2]. 2) Version/runtime-related notes included with v6 - The v6.0.0 release notes also mention updating the README for Node.js 24 support requirements/details [1]. 3) Related v6 follow-up fixes (not “breaking” but notable) - v6.0.2 includes a fix for tag handling (preserve annotations and explicit fetch-tags) [3][4]. Practical guidance when upgrading from v5 to v6 - If you use persist-credentials: true and especially if you run authenticated git commands inside Docker container actions, ensure your Actions Runner is at least v2.329.0 [2]. - Otherwise, the official docs indicate you should not need to change your workflow steps for typical git fetch/push usage [2].

Citations:

• 1: https://github.com/actions/checkout/blob/v6.0.1/CHANGELOG.md
• 2: https://github.com/actions/checkout
• 3: actions/checkout@v6.0.0...v6.0.2
• 4: https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md

---

🌐 Web query:

docker/login-action v4 breaking changes

💡 Result:

Main docker/login-action v4 breaking-change: the action now runs on Node.js 24 by default, not Node.js 20. What changed from v3 → v4 (and why it can break CI) 1) Runtime requirement: Node 24 default runtime - v4.0.0 states “Node 24 as default runtime (requires Actions Runner v2.327.1 or later)”[1]. - The PR implementing this changed action.yml from using: 'node20' to using: 'node24'[2]. Impact: if your GitHub Actions runner is older than the stated minimum, or you rely on Node 20-specific behavior, upgrading docker/login-action@v3 to @v4 can fail or behave differently. 2) Module system / build change: switch to ESM - v4.0.0 also notes “Switch to ESM and update config/test wiring”[1]. Impact: this is usually internal to the action, but it’s still a fundamental implementation change that’s worth treating as “breaking” for any unusual wrapper/consumption patterns. Other v4.x updates (not clearly “breaking”) - v4.1.0 is listed as a set of fixes and dependency bumps (e.g., “Fix scoped Docker Hub cleanup path when registry is omitted”)[3], but the release notes provided do not describe additional breaking interface changes beyond what’s already in v4.0.0. Practical migration guidance - Ensure your GitHub-hosted runner or self-hosted runner meets “Actions Runner v2.327.1 or later” before using docker/login-action@v4[1]. - If you have pinned or customized runner/container images that depend on Node 20, update them for Node 24 compatibility. - Otherwise, the typical workflow-level change is just updating uses: docker/login-action@v3 → uses: docker/login-action@v4[4].

Citations:

• 1: https://github.com/docker/login-action/releases/tag/v4.0.0
• 2: docker/login-action@176cb9c
• 3: https://github.com/docker/login-action/releases/tag/v4.1.0
• 4: docker/login-action@v3...v4

---

🌐 Web query:

docker/metadata-action v6 breaking changes

💡 Result:

docker/metadata-action v6 breaking changes (v6.0.0 released 2026-03-05) 1) Node.js runtime default: Node 24 v6.0.0 makes Node 24 the default runtime and requires GitHub Actions Runner v2.327.1 or later [1][2]. Impact: if your org/pipeline pins or assumes Node 20 behavior, you may need to update affected runner/action configuration so the workflow runs under the newer runtime. 2) ESM migration v6.0.0 includes a switch to ESM (“Switch to ESM and update config/test wiring”) [1][2]. Related notes also indicate ESM-only behavior for @actions/github (CommonJS consumers must use dynamic import) [3]. Impact: this is mainly internal for end users of the GitHub Action; it matters if you embed/require the action’s JS as a library in custom Node code. 3) Parsing behavior change for “list inputs” containing # v6.0.0 changes list input parsing to preserve # inside values while still supporting full-line # comments [1][2]. Impact: if you previously used # in a way that depended on it being treated as comment delimiters even when inside values, your tags/labels rules can change. Other changes in v6.0.0 (mostly dependency bumps) The release notes also list several dependency bumps (lodash, @actions/core, @actions/github, @docker/actions-toolkit, semver, etc.) [1][2].

Citations:

• 1: https://github.com/docker/metadata-action/releases/tag/v6.0.0
• 2: https://github.com/docker/metadata-action/releases
• 3: chore(deps): Bump @actions/github from 6.0.1 to 9.0.0 docker/metadata-action#597

---

🌐 Web query:

docker/build-push-action v7 breaking changes

💡 Result:

The docker/build-push-action v7.0.0 (released 2026-03-05) introduces several changes that could be breaking depending on usage[1][2][3]. Key breaking changes include: - Node 24 as the default runtime, requiring GitHub Actions Runner version v2.327.1 or later[1][2]. - Removal of deprecated environment variables DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS[1][3]. - Complete removal of legacy export-build tool support for build summary (previously controllable via DOCKER_BUILD_EXPORT_LEGACY, now removed from docs)[1][3][4]. - Switch to ESM (ECMAScript Modules) and internal config/test updates[1]. - Major dependency bumps: @actions/core to 3.0.0 (potential API changes), @docker/actions-toolkit to 0.79.0[1]. No explicit migration guide found in official docs, but full changelog available at docker/build-push-action@v6.19.2...v7.0.0[1][3]. Workflows using removed env vars or old runners will fail. Later patch v7.1.0 (2026-04-10) adds no further breaking changes[5].

Citations:

• 1: https://github.com/docker/build-push-action/releases/tag/v7.0.0
• 2: https://github.com/docker/build-push-action/releases
• 3: docker/build-push-action@v6.19.2...v7.0.0
• 4: remove legacy export-build tool support docker/build-push-action#1474
• 5: https://github.com/docker/build-push-action/releases/tag/v7.1.0

---

🏁 Script executed:

cat -n action-templates/actions/action-build-image/action.yml

Repository: it-at-m/lhm_actions

Length of output: 2852

---

Update requires GitHub Actions Runner version v2.327.1 or later.

All five updated actions (actions/checkout v6.0.2, actions/download-artifact v8.0.1, docker/login-action v4.1.0, docker/metadata-action v6.0.0, docker/build-push-action v7.1.0) mandate Node 24 as the default runtime and require GitHub Actions Runner v2.327.1 or later to function. The pinned SHAs are correct and verified against their respective version tags. Ensure your GitHub-hosted and self-hosted runners meet this minimum version requirement before deploying these updates.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@action-templates/actions/action-build-image/action.yml` at line 39, The
updated action pins (actions/checkout@v6.0.2, actions/download-artifact@v8.0.1,
docker/login-action@v4.1.0, docker/metadata-action@v6.0.0,
docker/build-push-action@v7.1.0) require GitHub Actions Runner v2.327.1+ (Node
24); update documentation and deployment checks to require that runner version
before merging. Add a clear note to the action's metadata/README and your
release/PR checklist stating "Requires runner v2.327.1 or later", and update any
self-hosted runner upgrade instructions or CI workflow configuration to use
GitHub-hosted runners that meet v2.327.1+ (or verify/upgrade self-hosted
runners) so the new uses entries (actions/checkout, actions/download-artifact,
docker/* actions) will run correctly.

[hupling]

• actionlint: https://github.com/it-at-m/sps/actions/runs/25715418357
• build: https://github.com/it-at-m/sps/actions/runs/25715418368
• codeql: https://github.com/it-at-m/sps/actions/runs/25715418351
• dependency-review: https://github.com/it-at-m/sps/actions/runs/25715428361 > Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.
• deploy-docs https://github.com/it-at-m/sps/actions/runs/25715418408
• docker-healthcheck: https://github.com/it-at-m/sps/actions/runs/25715418369
  Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/setup-node@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
• pr-labeler: https://github.com/it-at-m/sps/actions/runs/25715427700
• release-maven: https://github.com/it-at-m/sps/actions/runs/25715959480
• release-npm: https://github.com/it-at-m/sps/actions/runs/25716137560
• trivy: https://github.com/it-at-m/sps/actions/runs/25715418363
  Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@0400d5f. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/