[rqbazan]

Summary

Moves the two Node 20 actions in CI to their Node 24 releases. Only the uses: lines change. Every pin stays a full commit SHA with a matching # vX.Y.Z comment.

 .github/workflows/ci.yml            (CI / Check)
-  actions/checkout@11d5960… # v4.4.0
+  actions/checkout@3d3c42e… # v7.0.1      persist-credentials: false
-  jdx/mise-action@c37c932…  # v2.4.4
+  jdx/mise-action@c2a8761…  # v4.3.0      install: true, cache: true
 .github/workflows/workflow-audit.yml (Workflow audit / Audit workflows)
-  actions/checkout@11d5960… # v4.4.0
+  actions/checkout@3d3c42e… # v7.0.1      persist-credentials: false

Job ids, job names and workflow names are unchanged. The Check and Audit workflows contexts that the ruleset requires still match. There are no pull_request_target or workflow_run triggers, and persist-credentials was already false.

What changes in the next release

No release: www is private, does not publish to npm and has no changesets. No changesets were added and no versions were bumped. There is no release run to change.

What changes is the next CI run:

1. In the Check and Audit workflows, actions/checkout v7.0.1 and jdx/mise-action v4.3.0 now run on node24 instead of node20, which removes the Node 20 deprecation warnings. CI keeps the same jobs and check names.
2. mise-action's default cache_key_prefix moves from mise-v0 (v2.4.4) to mise-v1 (v4.3.0). The first CI run on this PR, and the first after merge, will miss the cache and rebuild it; later runs hit it again.
3. mise-action v4 exports mise.toml [env] to the job, so node_modules/.bin is added to PATH. That is harmless because CI calls everything through pnpm.

Check names (CI / Check, Workflow audit / Audit workflows) are unchanged, so the ruleset's required checks still match. Workers Builds deploys are not affected because they don't use these workflows.

Evidence

• Before: the last CI run on main's pins (docs: give the Copy and Copied icons their geometry here #3) carries this annotation on both jobs:

  warning: Node.js 20 is deprecated. The following actions target Node.js 20 but are being
  forced to run on Node.js 24: actions/checkout@11d5960…, jdx/mise-action@c37c932…
  

  After: this PR's Check and Audit workflows runs pass with no Node 20 warning; their only annotation is the runner's ubuntu-latest notice. As expected, the Check job's mise step misses the new key once and saves it:

  cache_key_prefix: mise-v1
  mise cache not found for mise-v1-linux-x64-ubuntu24-ef8ab3d…
  Cache saved from /home/runner/.local/share/mise with key: mise-v1-linux-x64-ubuntu24-ef8ab3d…
  

  The CI steps were also run locally on this branch, rebased onto the current main:

  pnpm install --frozen-lockfile                    ok
  pnpm rr jsc                                       Checked 28 files, no fixes applied
  pnpm astro check                                  0 errors, 0 warnings, 0 hints
  pnpm astro build                                  5 page(s) built
  zizmor 1.30.1 (online audits, GH_TOKEN set)       No findings
  

  Pins checked against the tags: actions/checkout v7.0.1 -> 3d3c42e5aac5ba805825da76410c181273ba90b1, jdx/mise-action v4.3.0 -> c2a87611a18de5b3828c5652fe268e992400cb5c.

Merge Danger

Door: two-way

Reverting the commit restores the old pins.

Blast Radius: CI-only

Only the Check and Audit workflows change. The site, its build output and Workers Builds deploys are untouched. The only expected side effect is one cold mise cache per new key.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BR6x3TNrgMhtDABYaH6hx8

[changeset-bot]

⚠️ No Changeset found

Latest commit: 67564e2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		67564e2	2026-10-17T20:33:26.043Z	View logs ↗