ci: upgrade actions/checkout and actions/setup-node from v4 to v7

[jasonhnd]

Closes #647

Part of #635 (order 11). Base preview. Parallel-lane ruling 2026-09-24: this branch started from 43d1e3b8 (PR #658) before order 10 was merged. Order 10 then landed as #659 (95ac84d6). Merge commit 128dd5c3 keeps both doc lines. The diff against preview is still only ci.yml (two uses: lines), one CHANGELOG line, and the §11 done mark.

Edits mapped to やること

1. Branch ci/actions-v7 from origin/preview 43d1e3b8. Order 10 was not on that commit; this PR does not change package.json or bun.lock.
2. .github/workflows/ci.yml (commit 855e165f), exactly two uses: lines:
   • uses: actions/checkout@v4 → uses: actions/checkout@v7
   • uses: actions/setup-node@v4 → uses: actions/setup-node@v7
   • node-version: 24.x kept.
   • oven-sh/setup-bun@v2 with bun-version: 1.4.2 kept.
   • Major tags (@v7). No SHA pin. Triggers, permissions, concurrency, and every other step unchanged. The "Enforce preview-to-main promotion" step is untouched.
3. Local sanity below. The dry run expected actions/checkout@v7, actions/setup-node@v7, oven-sh/setup-bun@v2 and a 2-line diff. The js-yaml print matches. git diff --stat reports 4 ++-- for ci.yml because each of those two lines is one deletion plus one insertion, plus the CHANGELOG line added in the same commit.
4. PR quality on head 128dd5c3 (run 36025548316) is green. Rendered-output Playwright was not run locally (another agent holds port 4321; no bun x playwright test, no bun run test:e2e, no scripts/e2e-server.cjs). The PR quality job is the rendered-output suite.
5. Docs:
   • CHANGELOG.md ### Changed (commit 855e165f, kept in the merge): - **CI: actions/checkout and actions/setup-node v4 → v7** — clears the Node 20 deprecation warning; no behaviour change.
   • docs/TOOLCHAIN.md §2 CI column says `24.x` via `actions/setup-node` and does not name an action major (v4 / v7). Left unchanged. The Playwright row now says 1.63.0 because chore(e2e): upgrade @playwright/test 1.62.1 to 1.63.0 and dedupe playwright-core #659 updated it; this PR did not edit that cell.
   • docs/TOOLCHAIN.md §11 order 11: — done (#660) (commit c07bc1ea). Order 10's — done (#659) from preview is kept.

やらないこと

No other workflow edits. No cache: input. No packageManager field. No dependency bumps. package-manager-cache: true in the log is setup-node v7 printing its own default; this workflow does not set it, and the step did not restore or save a package-manager cache. The Found in cache line is the Node 24 toolcache, which setup-node already used at v4.

Verification

node -e (js-yaml), before commit 855e165f

[
  'actions/checkout@v7',
  'actions/setup-node@v7',
  'oven-sh/setup-bun@v2'
]
(node:14852) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
(Use `node --trace-warnings ...` to show where the warning was created)

Exit 0. Node v24.20.0. js-yaml 4.3.2 from node_modules. The NO_COLOR / FORCE_COLOR line is an environment warning, not a parse failure.

git diff --stat (working tree, before commit 855e165f)

 .github/workflows/ci.yml | 4 ++--
 CHANGELOG.md             | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

git diff -- .github/workflows/ci.yml (same tree; still the diff against preview at 128dd5c3)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index afb81601..591274fa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,10 +30,10 @@ jobs:
           exit 1

       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 24.x

Quality run

Head 128dd5c3. Run https://github.com/jasonhnd/jobs/actions/runs/36025548316. Job 107721028049. Conclusion success.

An earlier run on c07bc1ea (https://github.com/jasonhnd/jobs/actions/runs/36024610489) was the same result before #659 was merged in. Run 36024552058 (855e165f) was cancelled by the workflow concurrency group when c07bc1ea was pushed.

Set up job

Download action repository 'actions/checkout@v7' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
Download action repository 'actions/setup-node@v7' (SHA:820762786026740c76f36085b0efc47a31fe5020)
Download action repository 'oven-sh/setup-bun@v2' (SHA:0c5077e51419868618aeaa5fe8019c62421857d6)

Set up Node.js

##[group]Run actions/setup-node@v7
with:
  node-version: 24.x
  check-latest: false
  token: ***
  package-manager-cache: true
##[endgroup]
Found in cache @ /opt/hostedtoolcache/node/24.21.0/x64
##[group]Environment details
node: v24.21.0
npm: 11.19.0
yarn: 1.22.22
##[endgroup]

node: v24.21.0 is the 24.x resolution. No npm cache hit or save follows this block.

Enforce preview-to-main promotion

Job API: step conclusion skipped (base is preview). Skipped steps are omitted from the downloaded log. The step text in ci.yml is unchanged.

Later steps

Every step after setup is success, including unit tests (1725 pass / 0 fail on the earlier run; this run's step is success), typecheck, build, rendered HTML contracts, repository gates, Chromium install, rendered-output checks, and git diff --exit-code.

Rendered-output (this run, not a local Playwright process):

Running 382 tests using 2 workers
  26 skipped
  356 passed (2.2m)

No failed line. 356 + 26 = 382. That is the same 356 passed the series dry run recorded and the same count order 10's changelog states ("CI rendered-output suite unchanged: 356 passed").

Annotations

$ gh api repos/jasonhnd/jobs/check-runs/107721028049/annotations
[]

Zero annotations. The log has zero lines containing Node.js 20. The warning on run 35890700262 (checkout@v4, setup-node@v4) is absent here.

The same command on the pre-merge run 107718224968 also returned [].

Vercel

gh pr checks / the rollup: Vercel SUCCESS, Vercel Preview Comments SUCCESS.

The first bot comment (tip c07bc1ea, docs-only against its parent) said Ignored / 1 Skipped Deployment, which is scripts/vercel-ignore-build.sh treating a documentation-only diff as a skip. After 128dd5c3 the bot comment updated to Ready:

• Deployment: https://vercel.com/zkscio/jobs/GnMpijsBBKtDtBG6widGUAdyiRN7
• Preview: https://jobs-git-ci-actions-v7-zkscio.vercel.app
• Updated: 2026-09-24T16:12:17Z

The Issue does not list vercel inspect or a curl of the preview URL, so those were not run. No state-changing Vercel command was run.

Unsure

• §2's CI cell names actions/setup-node but not a major. The Issue says to update that column only if it names action versions, so it was left as-is.
• git diff --stat prints 4 ++-- for a two-line replacement. That is the dry run's "diff = 2 lines" under git's delete-plus-insert accounting. Nothing else in ci.yml changed.
• setup-node v7 prints package-manager-cache: true by default. It was not added to the workflow, and no package cache was used. Not changed further, because やらないこと forbids other workflow edits.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
jobs	Ready	Preview	Sep 24, 2026 4:12pm UTC