[Shahroz16]

Refs MBL-2397

GitHub removed the Node 20 Actions runtime on 2026-09-23. Every node20 action now runs forced on Node 24 with a deprecation warning. This PR moves every action this repo pins to a release whose action.yml declares runs.using: node24. It replaces Dependabot's stale #598, which this PR doesn't touch.

Changes

Action	Before	After	Notes
actions/checkout	v4, v4.2.2 (SHA)	v7, v7.0.1 (SHA)	Pinning style kept per line
actions/setup-node	v4, v4.4.0 (SHA)	v7, v7.1.0 (SHA)	No packageManager field, so v5+ auto-caching stays off
actions/cache	v4	v6
actions/upload-artifact	v4.6.2	v7.0.2
maierj/fastlane-action	v3.1.0	v3.2.0
cycjimmy/semantic-release-action	v4.2.0	v6.0.0	semantic_version stays 25.0.9. v6 already runs on node24; v7/v8 shipped 10 releases in two weeks around an ESM rewrite. Matches customerio-ios.
slackapi/slack-github-action	v1.26.0	v4.0.0	Webhook moved from SLACK_WEBHOOK_URL/SLACK_WEBHOOK_TYPE env to the webhook + webhook-type: incoming-webhook inputs v2+ require
ataylorme/eslint-annotate-action	v3	4.0.0	repo-token → github-token; repo-token was never an input of v3 either
levibostian/action-conventional-pr-linter	v4.0.1	replaced by amannn/action-semantic-pull-request v6.1.1 + marocchino/sticky-pull-request-comment v3.0.5	No node24 release exists. Uses the shared-CI snippet adopted across the mobile repos: default types, fixed help text posted only when failure() && error_message != '', deleted once the title passes, both comment steps continue-on-error (read-only tokens on fork and Dependabot runs). Job id lint-pr-title is unchanged, so the required check name stays the same.
kenji-miyake/setup-sd	v2.0.0	replaced by local composite .github/actions/setup-sd	No node24 release exists. Downloads chmln/sd 1.1.0 (musl, x64/arm64) and checks it against the SHA-256 from the release asset metadata. 1.1.0 is the version setup-sd's latest installed.

actions/create-github-app-token, ruby/setup-ruby and the peter-evans/* actions already run on node24 and are unchanged.

Slack error handling (behaviour change, deliberate)

v1 failed the step when Slack rejected a message. v2+ only logs a warning unless errors: true is set.

• Failure alerts (both jobs): errors: true. The job is already failing, so this just makes a broken webhook visible.
• Success notices: default false. In deploy-git-tag, a failed success notice would fail the job and skip deploy-npm (needs requires success), so a Slack outage could block publishing a tag that already exists. In deploy-npm, npm already has the release by then.

Verification

• Runtime of every new ref checked at the pinned SHA/tag (gh api repos/<action>/contents/action.yml?ref=<ref> → using: node24).
• actionlint with no new findings. The only output is the same 41 shellcheck info/style notes that main produces.
• All four Slack payloads still parse as JSON, and as YAML to the same object, once ${{ }} expressions are substituted. v4 tries YAML first, then JSON.
• The sd 1.1.0 x86_64 tarball's SHA-256 matches the release digest, and its layout matches the --strip-components=1 member path.
• Not exercised before merge: deploy-sdk.yml (semantic-release v6, Slack v4, setup-sd on the release path) runs only on push to main, so it can't run from this PR. The Android sample-app build in Publish Test Sample Apps exercises setup-sd on Linux on this PR.

Expected CI notes

• Full React Native scene routing E2E runs on this PR because react-native-scene-e2e.yml changed. It will fail exactly as the nightly has since 2026-09-18 (no available 'iPhone 17 Pro' simulator on iOS 27). The fix is in a separate PR (simulator selection).

Still on node20 outside this repo (not changed here)

• customerio/customerio-android/.github/actions/setup-android@main: setup-java v4, android-actions/setup-android v3.2.2, gradle/actions v4.3.1. The customerio-android session owns it.
• customerio/mobile-ci-tools/github-actions/ios/setup-ios/v1@main: setup-xcode v1.6.0.
• customerio/mobile-ci-tools/github-actions/slack-notify-sample-app/v1@main: slack-github-action v2.0.0.

These still run, forced onto Node 24 with a warning. They need updating in their own repos.

Codex review

Codex (gpt-6.1-sol, high) did an adversarial review of this diff:

1. Slack failures now pass silently (P2): partly addressed. errors: true is on the two failure alerts. The success notices keep the default on purpose, for the reason above. Codex's other suggestion, errors: true on all four, would recreate the v1 behaviour where a Slack outage skips deploy-npm.
2. Shared composites still reference node20 actions (P2): confirmed, out of scope for this repo; listed above. Codex agrees they don't fail, since the runner forces Node 24.
3. New linter rejects feature: titles (P3): rebutted, kept the default type list. The shared-CI session reached the same conclusion for all mobile repos by replaying 1,847 historical PR titles through both parsers. .releaserc.json sets no releaseRules, and @semantic-release/commit-analyzer's defaults release on feat but not feature. A feature: title used to pass lint and then merge without cutting a release. No feature: commit exists in this repo's history.

Codex also found these fine: checkout v6+ credential persistence with the App token for semantic-release pushes, npm OIDC on setup-node v7, Slack payload/webhook contract, ! breaking marker and fork PRs on the new linter, local action resolution from nested reusable workflows and the working-directory: example default, GNU tar member stripping, and sd 1.1 regex compatibility with the existing single-line patterns.

Re-review after the sticky-comment steps, semantic-release v6 and the Slack errors split: no actionable findings.

• Codex found fine: the if: conditions (a skipped or cancelled lint is neither success nor failure()), fork/Dependabot handling, the absence of any interpolated PR-controlled text, and the Slack placement.
• Cosmetic: a cancelled in-flight run can leave a stale help comment.
• Codex couldn't read the pinned upstream source. error_message is set by setOutput('error_message', …) in dist/index.js at 48f25628, checked via gh api.

CI on this PR

Everything passes except full-scene-e2e (no available 'iPhone 17 Pro'), which #668 fixes. The Android sample-app build exercised the new setup-sd composite, and both iOS sample-app builds passed.

🤖 Generated with Claude Code