Update pinned GitHub Actions off the deprecated Node.js 20 runtime

[comfuture]

Summary

Every CI and release run emits a deprecation warning because pnpm/action-setup@v4 still targets the Node.js 20 runtime:

warning: Node.js 20 is deprecated. The following actions target Node.js 20 but are
being forced to run on Node.js 24: pnpm/action-setup@v4.

The runner already forces these actions onto Node.js 24, so nothing is broken today. The warning is a notice that the forced fallback will not last. Moving the pinned actions to their current majors removes it and keeps both workflows on supported runtimes.

Current implementation facts

Both workflows pin three actions. Runtimes were read from each action's action.yml at the pinned ref:

Action	Pinned	Runtime at pinned ref	Latest release	Runtime at latest
pnpm/action-setup	v4	node20	v6.0.9	node24
actions/checkout	v5	node24	v7.0.1	node24
actions/setup-node	v5	node24	v7.0.0	node24

• Only pnpm/action-setup@v4 is named in the warning. actions/checkout@v5 and actions/setup-node@v5 already run on node24, so they are not the cause; they are simply behind.
• Both files use the same three steps: .github/workflows/ci.yml:23,26,29 and .github/workflows/publish-release.yml:23,28,31.
• The annotation is attached to the validate check run of every CI run, for example run 30795781008. All ten steps of that job reported success, so this is warning-only.
• publish-release.yml runs lint, typecheck, test, and build before pnpm release:publish, so a broken action bump there would block an npm release, not just a PR check.

Relevant configuration that constrains the upgrade:

• Root package.json sets "packageManager": "pnpm@10.33.2". pnpm/action-setup reads that field (its package_json_file input defaults to package.json), so the installed pnpm version comes from the repository, not from the action major.
• Neither workflow passes a version input to pnpm/action-setup, and neither uses its run_install or cache inputs.
• Both workflows call actions/setup-node with cache: pnpm.
• packages/cli/package.json declares "engines": { "node": ">=22" }, and both workflows use node-version: 22.
• There is no .github/dependabot.yml, so action pins do not update on their own.

Problem statement

Every push, pull request, and release publish carries a deprecation annotation that has nothing to do with the change being validated. It adds noise to check output and, more importantly, the Node.js 20 forced-fallback is temporary. When the runner stops forcing node24, pnpm/action-setup@v4 breaks the first step of both workflows, including the release publish path.

Goal

Move the three pinned actions in both workflows to their current majors so no action targets a deprecated runtime, without changing what CI actually installs, caches, or validates.

Scope

• pnpm/action-setup@v4 -> v6 in .github/workflows/ci.yml and .github/workflows/publish-release.yml.
• actions/checkout@v5 -> v7 in both workflows.
• actions/setup-node@v5 -> v7 in both workflows.
• Confirm on a real run that the deprecation annotation is gone and every step still passes.

Non-goals

• Do not change node-version: 22. It matches the declared engines.node floor, and moving the tested runtime is a separate decision.
• Do not change packageManager or the pnpm version CI installs. The local toolchain is ahead of the pinned pnpm@10.33.2, but reconciling that is unrelated to a deprecated action runtime.
• Do not restructure the workflows, add jobs, or change the validation sequence.
• Do not add Dependabot or action auto-updates in this issue. Worth a separate follow-up so pins do not drift again.
• Do not switch to commit-SHA pinning here.

Suggested direction

This is a pin-only edit in two files. Use floating majors (v6, v7) to match the existing style rather than introducing exact patch pins for three actions.

Breaking changes reviewed for each major crossed:

• actions/setup-node v6 limits automatic caching to npm and disables it by default for pnpm and yarn (#1374). Both workflows pass cache: pnpm explicitly, which is still supported: v7.0.0's action.yml documents cache as "Supported values: npm, yarn, pnpm", and src/cache-utils.ts still resolves the pnpm store via pnpm store path --silent. No change needed, but this is the one item worth verifying on a real run rather than assuming.
• actions/setup-node v7 migrates to ESM and adds cache-primary-key/cache-matched-key outputs. No input used here changed.
• actions/checkout v6 persists credentials to a separate file.
• actions/checkout v7 blocks checking out fork PRs for pull_request_target and workflow_run. Neither workflow uses those triggers: ci.yml is pull_request plus push to main, and publish-release.yml is release: published.
• pnpm/action-setup v5 moved the action to Node.js 24. v6 added pnpm v11 support. Because the version comes from packageManager, CI keeps installing pnpm@10.33.2.

One ordering detail to preserve: Setup pnpm must stay before Setup Node.js, because cache: pnpm shells out to pnpm store path and needs pnpm already on PATH.

Acceptance criteria

• No uses: line in .github/workflows/ references pnpm/action-setup@v4, actions/checkout@v5, or actions/setup-node@v5.
• A CI run on the updated workflows reports no Node.js 20 is deprecated annotation. Verify with gh api repos/comfuture/codori/check-runs/<id>/annotations, not just a green check mark.
• Every validate step still succeeds: checkout, Setup pnpm, Setup Node.js, install, Prepare Nuxt types, lint, typecheck, test, build.
• pnpm install --frozen-lockfile still succeeds, proving the installed pnpm still matches pnpm-lock.yaml (lockfileVersion: 9.0).
• The Setup Node.js step still restores or saves a pnpm cache, confirming cache: pnpm survived the setup-node v6 caching change.
• publish-release.yml is updated identically, so the release path does not stay on a deprecated runtime.
• node-version: 22 and packageManager: pnpm@10.33.2 are unchanged.

Suggested smoke test

1. Push the workflow change and let CI run.
2. Fetch the validate check-run annotations and confirm the Node.js 20 warning is absent.
3. Confirm from the step log that pnpm resolves to 10.33.2 and that the cache step reports a hit or a save rather than an error.

Documentation follow-up

None expected. The workflows are not user-facing and no README documents these pins.