ci: migrate GitHub Actions to Node 24 (SC-22079)

[IchordeDionysos]

Summary

• Replace the Node 20-based auto-approve action with actions/github-script@v8.
• Upgrade checkout, changed-files, Git diff, and GitHub Script actions to Node 24-compatible releases.
• Preserve the existing Renovate and release-please approval behavior.

Related issue

SC-22079

Test plan

• actionlint passes for auto-approve.yml.
• The reusable workflow parses as valid YAML.
• Every upgraded JavaScript action declares the node24 runtime.

[coderabbitai]

📝 Walkthrough

Walkthrough

The auto-approval workflow now uses actions/github-script@v8 and github.rest.pulls.createReview for Renovate and Release-Please pull requests. Release-Please retains its existing file and dependency checks.

Changes

Workflow approval API migration

Layer / File(s)	Summary
Replace approval actions in workflow .github/workflows/auto-approve.yml	Renovate and Release-Please jobs now create APPROVE reviews through the GitHub API. Release-Please keeps its existing approval conditions and updates supporting action versions.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: migrating GitHub Actions to Node 24.
Description check	✅ Passed	The description directly explains the Node 24 migration, action upgrades, preserved behavior, and validation steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/SC-22079-migrate-github-actions-to-node24

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/auto-approve.yml:
- Line 40: Replace the mutable v47 reference in the changed-files action step
with the required immutable commit SHA 24d32ffd492484c1d75e0c0b894501ddb9d30d62,
preserving the existing action configuration and permissions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 723a38ef-0d93-4df5-8f04-0578048b3d71

📥 Commits

Reviewing files that changed from the base of the PR and between 342720c and aaff057.

📒 Files selected for processing (1)

• .github/workflows/auto-approve.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Record the current upstream commit for the intended major tag.
git ls-remote https://github.com/tj-actions/changed-files.git refs/tags/v47

Repository: simpleclub/.github

Length of output: 211

---

🏁 Script executed:

set -euo pipefail

printf '%s\n' '--- workflow context ---'
sed -n '1,70p' .github/workflows/auto-approve.yml

printf '%s\n' '--- tag reference ---'
git ls-remote --refs https://github.com/tj-actions/changed-files.git refs/tags/v47

printf '%s\n' '--- commit existence ---'
sha="$(git ls-remote --refs https://github.com/tj-actions/changed-files.git refs/tags/v47 | awk '{print $1}')"
git ls-remote https://github.com/tj-actions/changed-files.git "$sha"

Repository: simpleclub/.github

Length of output: 3141

---

🏁 Script executed:

set -euo pipefail

sha='24d32ffd492484c1d75e0c0b894501ddb9d30d62'
curl --fail --silent --show-error \
  -H 'Accept: application/vnd.github+json' \
  "https://api.github.com/repos/tj-actions/changed-files/commits/${sha}" |
  jq '{sha: .sha, message: .commit.message}'

Repository: simpleclub/.github

Length of output: 207

---

🏁 Script executed:

set -euo pipefail

git ls-remote https://github.com/tj-actions/changed-files.git \
  refs/tags/v47 'refs/tags/v47^{}'

Repository: simpleclub/.github

Length of output: 211

---

Security Misconfiguration (CWE-829): Inclusion of Functionality from Untrusted Control Sphere

Reachability: Internal · Exploitability: Difficult

Pin tj-actions/changed-files to commit SHA 24d32ffd492484c1d75e0c0b894501ddb9d30d62.

The v47 tag is mutable. A full SHA prevents changed action code from running with pull-requests: write permission.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/auto-approve.yml at line 40, Replace the mutable v47
reference in the changed-files action step with the required immutable commit
SHA 24d32ffd492484c1d75e0c0b894501ddb9d30d62, preserving the existing action
configuration and permissions.