OIC-OPS-001 — Refresh pinned GitHub Actions for Node.js 24 runtime

[veraxis-protocol]

Classification

Non-gate repository operations follow-up. This is not a blocker for evidence PRs #13, #14, or #15.

Exact GitHub Actions warning

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-python@a26af69, actions/upload-artifact@330a01c. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

A job without artifact upload emitted the narrower form naming only actions/setup-python at the same commit.

Affected pinned actions

• actions/setup-python@a26af69
• actions/upload-artifact@330a01c

Required follow-up

Evaluate current immutable releases of the affected actions that natively target Node.js 24, review release provenance and compatibility, update pins in a separate pull request, and run the complete seven-job CI suite.

Non-goals

• Do not change action pins in PR chore: mobilize OIC Gate Closure v0.2 #13, veip: add dependency dossier preflight inventory #14, or research: compare procurement preflight corpus candidates #15.
• Do not modify semantic artifacts or gate status.
• Do not weaken branch protection.

[veraxis-protocol]

RECONCILIATION STATUS — 2026-08-17

Historical state:

• OIC-OPS-001 — Refresh pinned GitHub Actions for Node.js 24 runtime #17 recorded the runner warning that actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 and actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 target Node.js 20 and are being forced onto Node.js 24.

Successor evidence — verified upstream, not from memory:

• Each pinned SHA was checked against its own upstream action.yml at that exact commit:

action	pinned SHA on main	declared runtime
actions/checkout	fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 (v5.1.0)	node24 — already current
actions/setup-python	a26af69be951a213d495a4c3e4e4022e16d87065 (v5.6.0)	node20
actions/upload-artifact	330a01c490aca151604b8cf639adc76d48f6c5d4 (v5.0.0)	node20

• The condition is therefore still unresolved on main (29daa374b7e5cdc30ca7788310fbabb85f19912b). It is not fixed by later commits, so this issue is not closable as already-resolved.

Current status:

• OPEN — remediation prepared, awaiting owner merge.

Action taken:

• Branch ops/node24-action-pin-refresh (73b8867bbac43df1dafe7906e947d41d04a38ded) and PR ops: refresh pinned GitHub Actions for supported runtime #27, operations-only:

action	old SHA / version	new SHA / version
actions/setup-python	a26af69be951a213d495a4c3e4e4022e16d87065 v5.6.0	e797f83bcb11b83ae66e0230d6156d7c80228e7c v6.0.0
actions/upload-artifact	330a01c490aca151604b8cf639adc76d48f6c5d4 v5.0.0	b7c566a772e6b6bfb58ed0dc250532a479d7789f v6.0.0

• Each new SHA was resolved from the upstream release tag and its action.yml confirmed to declare runs.using: node24.
• v6.0.0 was chosen for both because it is the lowest release natively targeting node24, so the only intended behavioural change is the runtime. Both upstream v6.0.0 notes state the same single breaking change and the same requirement, Actions runner ≥ 2.327.1, which GitHub-hosted runners satisfy.
• actions/checkout was left untouched: it already declares node24.
• One file changed: .github/workflows/ci.yml, ten lines. No STATUS.md, TDD, schema, semantic contract, corpus, ZTL/VEIP evidence, currentness/reliance evidence, claims or RUN evidence.
• All seven required CI contexts pass on PR ops: refresh pinned GitHub Actions for supported runtime #27: bootstrap-integrity, schema-validation, lint, typecheck, test, sbom, compose-validation. The run log contains no "Node.js 20 is deprecated" line.

Remaining closure conditions:

• Owner review and merge of PR ops: refresh pinned GitHub Actions for supported runtime #27. It is deliberately left unmerged; this work order does not authorise self-merge.
• OIC-OPS-001 — Refresh pinned GitHub Actions for Node.js 24 runtime #17 closes on that merge, not before.

Claim ceiling:

• Operations only. Nothing here bears on the semantic implementation gate, institutional admission, corpus rights, or any CDC claim.