From de48ce7289347dd179a77bf3b87071515559516c Mon Sep 17 00:00:00 2001
From: Chris Campbell <ccampbell@climateinteractive.org>
Date: Thu, 30 Jul 2026 17:16:08 -0700
Subject: [PATCH] build: update actions to use Node.js 24 + use Node.js 22 for
 building

---
 .github/dependabot.yml         | 23 +++++++++++++++++++++++
 .github/workflows/build.yaml   | 12 ++++++------
 .github/workflows/release.yaml | 14 +++++++-------
 3 files changed, 36 insertions(+), 13 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ea57d6d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,23 @@
+#
+# Keeps the GitHub Actions used in `.github/workflows` up to date.
+#
+# The actions in our workflows are pinned to specific commit hashes (with the
+# version in a trailing comment) so that a moved tag can't silently change what
+# runs CI.  Dependabot updates both the hash and the comment for us, which
+# means the pins don't go stale.
+#
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    commit-message:
+      # Match the commit message conventions used in this repo
+      prefix: build
+    groups:
+      # Open a single PR for all action updates rather than one PR per action
+      github-actions:
+        patterns:
+          - '*'
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f3aa53c..312a850 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # XXX: Fetch history for all branches; we really only need the history
           # for the base (main) branch in the `sim-slack` script, so this is
@@ -28,14 +28,14 @@ jobs:
           fetch-depth: 0
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22
 
       # The pnpm caching strategy in the following steps is based on:
       #   https://github.com/pnpm/action-setup#use-cache-to-reduce-installation-time
       - name: Install pnpm
-        uses: pnpm/action-setup@v4.1.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10
 
@@ -45,13 +45,13 @@ jobs:
           echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT
 
       - name: Enable Puppeteer cache
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .cache/puppeteer
           key: puppeteer-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
 
       - name: Enable pnpm cache
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
           key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 356ef46..3b4dfca 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Run release-please
-        uses: GoogleCloudPlatform/release-please-action@v4
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release
         with:
           # Note that we need to use a custom token here because events triggered
@@ -31,17 +31,17 @@ jobs:
           token: ${{ secrets.GH_ACCESS_TOKEN }}
 
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22
 
       # The pnpm caching strategy in the following steps is based on:
       #   https://github.com/pnpm/action-setup#use-cache-to-reduce-installation-time
       - name: Install pnpm
-        uses: pnpm/action-setup@v4.1.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10
 
@@ -51,7 +51,7 @@ jobs:
           echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT
 
       - name: Enable pnpm cache
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
           key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -59,7 +59,7 @@ jobs:
           #   pnpm-store-${{ runner.os }}-
 
       - name: Enable Puppeteer cache
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .cache/puppeteer
           key: puppeteer-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}