chore(ci): upgrade actions to Node 24 runtimes

[geekbrother]

Why

GitHub deprecated the Node.js 20 runtime. Actions declaring runs.using: node20 are currently force-run on Node 24 and will break once that fallback is removed.

These are reusable workflows that execute inside consumer repos, so every outdated action pinned here emits the deprecation warning in those repos' workflow runs — nothing a consumer does can suppress it.

Companion PRs: WalletConnect/actions#110 (shared composite actions) and WalletConnect/infra#543 (the repo the alert was originally reported from).

Change

Each action bumped to the newest major that declares runs.using: node24, verified by reading action.yml at the target tag:

Action	Before	After	Files
actions/cache	v4	v6	ci-check-infra, ci-plan-infra, deploy-infra
actions/cache/restore, /save	v4	v6	examples/sub-validate
actions/upload-artifact	v4	v7	ci-plan-infra
aws-actions/configure-aws-credentials	v4	v6	build-publish, ci-plan-infra, deploy-app, deploy-infra, release-app
hashicorp/setup-terraform	v3	v4	ci-check-infra, ci-plan-infra, deploy-infra
terraform-linters/setup-tflint	v4	v6	ci-check-infra
docker/build-push-action	v5	v7	build-publish, release-app
docker/login-action	v3	v4	build-publish, release-app
docker/metadata-action	v5	v6	build-publish, release-app
docker/setup-buildx-action	v3	v4	build-publish, release-app

actions/checkout was already on v6, and actions/download-artifact on v8 — both node24, unchanged. examples/ is bumped too so copied templates don't reintroduce the problem.

Breaking changes reviewed

• setup-tflint@v5 made TFLint exit code 2 a failure. ci-check-infra invokes tflint --recursive --format=compact from a run: step, where bash already fails on any non-zero exit — no behaviour change.
• build-push-action@v6 added build summaries (opt-out via DOCKER_BUILD_SUMMARY); v7 removed the already-deprecated DOCKER_BUILD_NO_SUMMARY/DOCKER_BUILD_EXPORT_RETENTION_DAYS envs, neither of which is set here. The inputs used (context, push, tags, labels, cache-from, cache-to) are unchanged.
• configure-aws-credentials@v5 tightened invalid-boolean input handling; the inputs used here are strings.
• upload-artifact@v7 pairs with the download-artifact@v8 already in use — both on the same artifact v4 backend.
• login-action@v4, metadata-action@v6, setup-buildx-action@v4, setup-terraform@v4, cache@v6 are runtime-only bumps for the inputs used here.

Not fixed — no Node 24 release exists upstream

arduino/setup-protoc@v3 (used in ci-check-app.yml) — v3 is the latest release and is still node20. It will keep emitting the warning until upstream ships Node 24. Worth tracking separately.

Propagation note

11 consumer usages across the org reference these workflows/actions at @main and pick the fix up on merge. 8 usages are pinned to @0.2.26 and will need a new tag cut before they benefit.

Verification

• All 7 changed files still parse as YAML.
• No uses: ref in this repo resolves to a node12/node16/node20 action any more, except arduino/setup-protoc above.

🤖 Generated with Claude Code