[jallers]

Does it make sense to point at new versions of the actions?

Yes, and it is low-risk: the runner is already executing the v4 actions on Node 24, it just complains about it on every run. Both the last CI run and the alpha.5 publish run end with this annotation (verbatim from the job logs of run 43599081847 and run 43594916940):

##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

So moving to the majors that declare node24 themselves changes nothing about the runtime the code runs on today; it stops the warning and stops depending on the runner's forcing. The hosted runners are on 2.338.2; every bumped major needs 2.327.1 or later.

What each action's own action.yml and release notes say

action	runs.using by major	current	crossed on the way
actions/checkout	v4 node20; v5, v6, v7 node24	v7.0.1	v5.0.0: node 24, runner ≥ 2.327.1. v7.0.0: refuses to check out a fork PR under pull_request_target/workflow_run unless allow-unsafe-pr-checkout: true (also backported to v4.4.0: the current runs already log allow-unsafe-pr-checkout: false). Input list v4 → v7 is otherwise identical. CI triggers on pull_request, so nothing changes.
actions/setup-node	v4 node20; v5, v6, v7 node24	v7.1.0	v5.0.0: node 24, runner ≥ 2.327.1, automatic caching when package.json has a packageManager field (ours has none), opt out with package-manager-cache: false. v6.0.0: automatic caching limited to npm; v6.1.0 dropped the always-auth input and the always-auth= line in .npmrc (npm 11 warns about that line on every command today). v7.0.0: ESM, cache-primary-key/cache-matched-key outputs, and no more dummy NODE_AUTH_TOKEN export (PR #1558, see below). The cache: npm input is unchanged.
actions/upload-artifact	v4, v5 node20; v6, v7 node24	v7.0.2	v5.0.0 only bumped @actions/artifact; v6.0.0 moved to node 24 (its notes: v5 "was by default still running on Node.js 20"), runner ≥ 2.327.1; v7.0.0 added an archive input, default true, so name/path behave as before and the artifact is still a zip. Input list v4 → v7 differs only by archive.

Pinned by major tag, as before (the repo does not pin SHAs).

Trusted publishing after the bump

• id-token: write and environment: npm are untouched; the OIDC exchange is npm's, not the action's.
• The alpha.5 publish log shows the stage step ran with NODE_AUTH_TOKEN: empty (no NPM_TOKEN secret is set) and staged with provenance via OIDC. That step sets the variable itself, so it is unaffected by setup-node v7 no longer exporting the placeholder XXXXX-XXXXX-XXXXX-XXXXX for the other steps.
• The other steps (npm install -g, npm ci, npm run verify) will now run with the action's .npmrc (//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}) and the variable unset. Tested locally with npm 11.19.1: npm ci succeeds with it unset and with it empty (npm 11 leaves an unknown ${VAR} as-is; public reads do not need auth).
• npm floor: npm stage needs 11.15. Node 24 has shipped npm 11.16 or later since 24.18.0 (June 2026); the runner's toolcache gives 24.22.2 with npm 11.19.1. The explicit npm install -g npm@^11.15.0 stays as a guard against a lagging toolcache.
• Added package-manager-cache: false to the publish job, as setup-node's trusted-publishing guide asks (no cache restore in the job that holds the OIDC token). It is a no-op today because package.json has no packageManager field.

Node floor: recommendation, Jim decides

Recommended and done in this PR: engines.node >=22, matrix 22 / 24 / 26 on ubuntu, 24 on windows, tsup target node22 so the emitted syntax floor follows the claim, and a ### Breaking line under a new 1.0.0-alpha.6 (unreleased) CHANGELOG heading. The alpha.5 heading loses "(unreleased)": it is on npm as latest since 2026-11-14.

Why 22 rather than keeping 20 or going to 24:

• Node 18 reached end of life on 2025-04-30 and Node 20 on 2026-04-30 (nodejs/Release schedule). >=18 promises support for two lines that get no security fixes, and testing 20 keeps a dead line in the matrix.
• 22 is maintenance LTS until 2027-04-30; 24 until 2028-04-30; 26 is the active LTS since 2026-10-28, which the old matrix did not test at all.
• Consumers: the slack bot runs 24, gh-v1 requires 22, agility-rooms is a browser app. >=22 excludes nobody; >=24 would exclude gh-v1's floor for no gain.
• Alternative if you would rather not make a breaking change in this PR: revert package.json, README.md, tsup.config.ts and the alpha.6 CHANGELOG entry, and put 20 back in the matrix; the workflow bump stands on its own.

Checks

• npm run verify locally: typecheck, build, 24 files / 168 tests pass (Node 22.23.4), with the node22 target; the CommonJS test passes on its own too.
• CI run 71 on the first commit: green on 22, 24, 26 and windows 24, with the v7 actions and no Node.js 20 warning at the end of the job.
• Not reachable from this session, so not quoted: github.blog (the changelog post the warning links to) and docs.github.com.

🤖 Generated with Claude Code

https://claude.ai/code/session_016NSWj8b7T4dcswUnPdzYuv