chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/setup-node@v4 → @82076278... # v7.0.0
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • docker/metadata-action@v5 → @dc802804... # v6.2.0
  • aws-actions/configure-aws-credentials@v4 → @e6de0542... # v6.2.3

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• mszostok/codeowners-validator@v0.5.0 — Docker-based action, not affected by the Node runtime deprecation; no Node 24 release exists
• cloudposse/github-action-auto-release@v1 — composite action not in the upgrade matrix; left as-is

[Copilot]

Pull request overview

Updates GitHub Actions workflow dependencies to SHA-pinned revisions that run on the Node 24 action runtime, reducing Node 20 deprecation warnings and improving supply-chain integrity via immutable pins.

Changes:

• Replaced floating uses: ...@v* references with commit-SHA pins plus tag-version comments for actions/checkout, actions/setup-node, docker/metadata-action, and aws-actions/configure-aws-credentials.
• Applied the same actions/checkout SHA pin to the CODEOWNERS validation workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/validate-codeowners.yml	Pins actions/checkout to a specific commit SHA with an upstream tag comment.
.github/workflows/lambda.yml	Pins multiple actions (setup-node, checkout, metadata-action, configure-aws-credentials) to specific SHAs with tag comments.

Suppressed comments (1)

.github/workflows/lambda.yml:105

• role-session-name references ${{ env.IAM_ROLE_SESSION_NAME }}, but the workflow-level env: defines IAM_ROLE_SEESION_NAME (typo). As written, this expression will resolve to an empty string and can cause STS to use a default session name, making audit trails and debugging harder. Align the reference (or rename the env key) so the intended session name is actually used.

        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        with:
          aws-region: us-east-2
          role-to-assume: ${{ env.IAM_ROLE_ARN_S3 }}
          role-session-name: ${{ env.IAM_ROLE_SESSION_NAME }}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

Also fixed the pre-existing IAM_ROLE_SEESION_NAME env typo flagged in review — role-session-name was resolving to an empty string.

[John C. Bland II (johncblandii)]

Same follow-up as ses-lambda-forwarder: the un-typo'd session name cloudposse/token-rotator/ci violates AWS's [\w+=,.@-]* pattern (no slashes) — the typo had been masking it via empty-string fallback. Now cloudposse-token-rotator-ci (413501d).

[John C. Bland II (johncblandii)]

CI triage summary for build-test-distribute: the pin bumps are clean — after the session-name fix, Configure AWS Credentials passes and the failure is in Test Affected Projects, where the lambda's test suite calls the GitHub API and gets "Integration not found" — the GitHub App the test credentials reference no longer exists (or the secret is stale). This is pre-existing: the same workflow fails identically on every Renovate branch (e.g. renovate/node-20.x-lockfile, renovate/aws-sdk-js-v3-monorepo on Aug 12, before this PR). Needs a maintainer to rotate the App credentials/secrets; nothing in this PR can fix it.

[John C. Bland II (johncblandii)]

CI triage for this PR

build-test-distribute — pre-existing, needs a maintainer. The failing test is lambdas › token-rotator › completes without error in apps/token-rotator/src/main.spec.ts, which calls the live GitHub API and fails with HttpError: Integration not found — the GitHub App the test credentials point at no longer exists (or the App ID/private key secrets are stale). The identical failure occurs on renovate branches that predate this PR: renovate/node-20.x-lockfile (run 31643223460, 2026-08-12) and renovate/aws-sdk-js-v3-monorepo (failing since at least 2026-07-31). Nothing in this PR touches app code or test credentials. A maintainer needs to restore/replace the GitHub App credentials, or mock this integration test.

validate-codeowners — pre-existing, fixed in c39ef08. The owners check failed with Teams for organization "cloudposse" could not be queried. Requires GitHub authorization. — the dead org token issue; it fails the same way on all recent renovate branches. Replaced the workflow with the org-standard shared cloudposse/.github/.github/workflows/shared-codeowners.yml@main (this workflow triggers on pull_request, so the fix takes effect on this PR).