chore(ci): upgrade actions to Node 24 runtimes

[geekbrother]

Why

GitHub deprecated the Node.js 20 runtime. Actions declaring runs.using: node20 (or node16) are currently force-run on Node 24 and will break once that fallback is removed.

This repo matters more than a normal consumer: these composite actions are used across the WalletConnect org, so every outdated action pinned in here emits the deprecation warning in every consumer repo's workflow runs, and no consumer-side change can fix it.

Companion PR for the reusable workflows: WalletConnect/ci_workflows (see linked PR). WalletConnect/infra#543 fixes the repo the alert was originally reported from.

Change

Each action bumped to the newest major that declares runs.using: node24, verified by reading action.yml at the target tag rather than assuming:

Action	Before	After
actions/checkout	v4 / SHA 93cb6efe (v5)	v7 / SHA 3d3c42e5
actions/cache	v4	v6
actions/setup-node	v4	v7
actions/setup-python	v5	v7
actions/upload-artifact	v4 / SHA ea165f8d (v4)	v7 / SHA 043fb46d
actions/download-artifact	SHA d3f86a10 (v4)	SHA 3e5f45b2 (v8)
actions/github-script	v7	v9
aws-actions/configure-aws-credentials	v4	v6
hashicorp/setup-terraform	v3	v4
dorny/paths-filter	v3	v4
pnpm/action-setup	v4	v6
softprops/action-gh-release	v1 (node16)	v3
stefanzweifel/git-auto-commit-action	v5	v7
webfactory/ssh-agent	v0.9.0	v0.10.0

SHA-pinned entries keep their pinning style, with the trailing # vN comment updated to match.

Breaking changes reviewed

• github-script@v9 — require('@actions/github') no longer works (that package is now ESM-only), and getOctokit is an injected parameter that scripts must not redeclare with const/let. Both scripts in this repo were checked: github/latest_release uses only context/process.env, and terraform/plan uses require('fs') (a Node builtin, still supported) plus github.rest.issues.createComment. Neither is affected.
• git-auto-commit-action — v6 dropped skip_fetch/skip_checkout/create_branch; v7 restored them. Going v5 → v7 avoids that gap.
• action-gh-release@v2 was a runtime-only bump (node16 → node20); v3 is node20 → node24. No input changes across either.
• pnpm/action-setup@v5 was runtime-only; v6 adds pnpm v11 support. Inputs unchanged.
• checkout@v7 refuses to check out fork PR code under pull_request_target/workflow_run. No workflow here uses either trigger with a fork ref.
• ssh-agent@v0.10.0, paths-filter@v4, setup-terraform@v4, configure-aws-credentials@v6 are runtime-only bumps for the inputs used here.

Not fixed — no Node 24 release exists upstream

Action	Used in	Status
contributor-assistant/github-action@v2.6.1	github/cta-assistant	latest release is node20
pozetroninc/github-action-get-latest-release@v0.7.0	github/latest_release	latest (v0.8.0) is still node20
WalletConnect/actions-rs/toolchain@2.0.0	github/update-rust-version	org-owned fork of the archived actions-rs; node20, needs a fix in that fork

These three will keep emitting the warning until upstream ships Node 24 (or, for the fork, until we update it ourselves). Worth tracking separately.

Follow-up needed after merge

Consumers pin this repo by tag (WalletConnect/actions/...@2.5.4, @2.5.5, @2.5.6). A new release tag has to be cut for the fix to reach them — repos pinned to @master pick it up immediately, but tag-pinned consumers will not.

Verification

• All 16 changed files still parse as YAML.
• No uses: ref in this repo resolves to a node12/node16/node20 action any more, except the three listed above.

🤖 Generated with Claude Code