kandev/docs/plans/github-actions-node24/task-05-verify.md

id, title, status, wave, depends_on, plan

id	title	status	wave	depends_on	plan
05-verify	Verify no Node-20 action pins remain	done	2	01-test-workflows 02-container-workflows 03-release-workflow 04-review-misc-workflows	plan.md

Task 05: Verify no Node-20 action pins remain

• Acceptance: a full audit of every uses: pin in .github/workflows/ shows zero runs.using: node20 (all node24 or composite), the pinning lint and all workflow contract tests pass, and every changed workflow is valid YAML.
• Verification: run, and record outputs of:
  • full audit per audit.md across all 18 workflow files
  • python3 .github/scripts/lint-action-pinning.py and python3 .github/scripts/lint-action-pinning_test.py
  • python3 .github/scripts/release-workflow-contract_test.py
  • python3 .github/scripts/claude-code-review-workflow-contract_test.py
  • python3 .github/scripts/preview-env-workflow-contract_test.py
  • python3 -c "import yaml,sys; [yaml.safe_load(open(f)) for f in sys.argv[1:]]" .github/workflows/*.yml
  • git diff --check
• Files likely touched: none (verification only).
• Dependencies: tasks 01–04.
• Parallelism: sequential (verification last).

Checklist

1. Re-run step 1–2 of audit.md: every pinned SHA's action.yml reports runs.using: node24 (or composite with node24 inner actions). Confirm the final output contains no node20 line.
2. Confirm the SHA-pinning lint and its tests still pass (all refs remain 40-char SHAs).
3. Confirm the three workflow contract tests pass — the SHA-asserting ones only pin crazy-max/ghaction-import-gpg@2dc316d… and actions/setup-node@48b55a0…, both unchanged by this plan.
4. Confirm YAML parses for all workflows.
5. Record the first post-merge workflow run (e.g. backend-tests) where the Node-20 deprecation warning no longer appears.

Inputs

plan.md verification section; audit.md.

Output contract

Full audit output, all test command outputs, final status of plan.md and tasks 01–04.

Results

• Full audit (audit_final.py) over all 18 workflows: 25 distinct pinned actions, every runs.using = node24 or composite (rust-cache/checkout v6/setup-node v6/setup-go v6/pnpm v5/import-gpg v7.0.0/create-github-app-token v3.2.0 and the three composite actions dereferenced and re-checked at their commits). Zero node20.
• lint-action-pinning.py → all SHA-pinned; lint-action-pinning_test.py → 9 OK.
• Contract tests: release 24 OK, claude-code-review 9 OK, preview-env 1 OK.
• YAML parse: 18/18 OK; git diff --check clean.
• Post-merge warning check: pending — first backend-tests/e2e-tests run after merge should show no Node-20 deprecation warning.