chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v4 / @692973e3... → @3d3c42e5... # v7.0.1
  • actions/create-github-app-token@v1 → @bcd2ba49... # v3.2.0
  • actions/upload-artifact@v4 / @50769540... → @043fb46d... # v7.0.1
  • actions/download-artifact@v4 → @3e5f45b2... # v8.0.1
  • github/codeql-action/upload-sarif@4dd16135... (v3.26.6) → @ff2f1c62... # v4.37.7
  • chrnorm/deployment-status@9a72af45... (v2.0.3) → @6df8d036... # v2.0.4

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• bobheadxi/deployments@648679e8... (v1) — no Node 24 release exists yet
• cloudposse/github-action-seek-deployment@0.1.1 — no Node 24 release exists yet
• ossf/scorecard-action@62b2cac7... (v2.4.0) — not in the approved upgrade set for this pass
• cloudposse/.github/... reusable workflows — managed upstream in cloudposse/.github

[Copilot]

Pull request overview

This PR updates several GitHub Actions workflow dependencies to SHA-pinned revisions that run on the Node 24 runtime, aligning the repository’s workflows with GitHub’s Node 20 deprecation and reducing supply-chain risk via immutable pins.

Changes:

• Upgraded actions/checkout, actions/upload-artifact, and actions/download-artifact references to Node 24-capable, SHA-pinned versions (with tag comments).
• Upgraded actions/create-github-app-token, github/codeql-action/upload-sarif, and chrnorm/deployment-status to newer SHA-pinned versions.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/scorecard.yml	Updates checkout/upload-artifact/upload-sarif actions to Node 24-capable SHA pins.
.github/workflows/deploy-preview.yml	Updates checkout/create-github-app-token/download-artifact actions to Node 24-capable SHA pins.
.github/workflows/delete-preview.yml	Updates deployment-status action to a newer SHA-pinned version.
.github/workflows/build-preview.yml	Updates checkout/upload-artifact actions to Node 24-capable SHA pins.

Suppressed comments (1)

.github/workflows/deploy-preview.yml:48

• actions/create-github-app-token@v3.2.0 marks the app-id input as deprecated (it prefers client-id). Keeping app-id will likely start emitting deprecation warnings in workflow logs and could become a future breaking change.

      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: github-app
        with:
          app-id: ${{ vars.BOT_GITHUB_APP_ID }}
          private-key: ${{ secrets.BOT_GITHUB_APP_PRIVATE_KEY }}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.