[Shahroz16]

Refs MBL-2397

Why

GitHub Actions removed Node 20 on 2026-09-23, so actions that still declare runs.using: node20 are forced onto Node 24 and print a warning. Dependabot's #940 moves every action referenced directly from .github/workflows/*.yml. It misses the two composite actions under .github/actions/, because Dependabot was only scanning /.

Change

Where	Action	From → To	runs.using at the pinned ref
.github/actions/setup-android	actions/setup-java	v4 → v5	node20 → node24
	android-actions/setup-android	v3.2.2 9fc6c4e → v4.0.4 be39fa8	node20 → node24
	gradle/actions/wrapper-validation	v4.3.1 af1da67 → v5.0.2 0723195	node20 → node24
	gradle/actions/setup-gradle	v4.3.1 af1da67 → v5.0.2 0723195	node20 → node24
.github/actions/update-sample-app-comment	peter-evans/find-comment	v3.1.0 → v4.0.0 b30e6a3	node20 → node24
	peter-evans/create-or-update-comment	v4.0.0 → v5.0.0 e8674b0	node20 → node24
.github/dependabot.yml	github-actions entry	directory: / → directories: [/, /.github/actions/*]	—
		ignore gradle/actions* >= 6.0.0	—
.github/workflows/test.yml (×3)	reactivecircus/android-emulator-runner	v2.34.0 324029e → v2.38.0 a421e43	node20 → node24

Runtimes were checked with gh api repos/<owner>/<repo>/contents/<path>/action.yml?ref=<sha>.

gradle/actions stays on v5 on purpose. v6.0.0 moves caching into gradle-actions-caching, a proprietary component under Gradle's Terms of Use. Upgrading means accepting those terms, which is a decision for the team, not a routine bump. The Dependabot ignore keeps it from being proposed as one.

What's still on Node 20 after this PR and #940

• levibostian/action-conventional-pr-linter v4.0.1 (pr-helper) and kenji-miyake/setup-sd v2.0.0 (deploy and sample builds): neither has a node24 release. Replacements are being chosen across the mobile repos.
• customerio/mobile-ci-tools/.../slack-notify-sample-app/v1@main uses slackapi/slack-github-action@v2.0.0 (node20). That fix is in mobile-ci-tools.

Verification

• actionlint passes, apart from one pre-existing warning at reusable_build_sample_apps.yml:110 (github.head_ref in an inline script), which is outside this diff.
• All changed YAML parses. Conflicts with chore(deps): bump the github-action-dependencies group across 1 directory with 15 updates #940 only on the three emulator-runner lines, where chore(deps): bump the github-action-dependencies group across 1 directory with 15 updates #940 moves to another node20 SHA (1dcd009); keep this PR's v2.38.0.
• This PR's CI runs every job through the updated setup-android composite.

Codex review

• Dependabot would offer gradle/actions v6 once it scans the composites. Accepted: added the ignore rule.
• Stale comment in setup-android: it described the v3 default of tools platform-tools. Accepted: rewrote it. The explicit packages: platform-tools input stays.
• setup-android v4.0.4 changes the default cmdline-tools from 16.0 to 22.0. Real, but not a break. Java 17 is installed first, which 22.0 needs, and sdkmanager usage (including in maestro-e2e.yml) is unchanged. Covered by this PR's CI.
• Wrapper-validation checksums for future Gradle 9 wrappers: speculative. v5.0.1 added Gradle 9.2+ checksums and unknown checksums are fetched dynamically. The AGP 9 / Gradle 9 readiness PR exercises a Gradle 9 wrapper through this action.
• No other findings. setup-gradle's PR cache-read-only default is unchanged, setup-java v5's Zulu 17 resolution still works, the comment actions' inputs still apply, and globbed directories still produce one grouped PR.
• Second round, on the emulator-runner bump: no regression. v2.38.0 keeps the AVD naming and reuse checks behind the avd-31 cache key, and dropping --abi doesn't change the google_apis;x86_64 image it picks. Pre-existing and not touched here: the ADB calls in .github/scripts/run-instrumentation-tests.sh have no command timeouts.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.29%. Comparing base (b5cf24d) to head (ecd3893).
⚠️ Report is 69 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #946      +/-   ##
============================================
+ Coverage     69.07%   74.29%   +5.22%     
- Complexity      838     2384    +1546     
============================================
  Files           149      282     +133     
  Lines          4601    13346    +8745     
  Branches        628     2278    +1650     
============================================
+ Hits           3178     9916    +6738     
- Misses         1189     2624    +1435     
- Partials        234      806     +572     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Build available to test
Version: ci-composite-actions-node24-SNAPSHOT
Repository: https://central.sonatype.com/repository/maven-snapshots/

[github-actions]

📏 SDK Binary Size Comparison Report

No changes detected in SDK binary size ✅