chore: update actions using Node.js 20 to Node.js 24

[CybotTM]

Problem

GitHub will force JavaScript actions to Node.js 24 on 2026-06-02. Two actions in our reusable workflows still use node20:

• gitleaks/gitleaks-action@v2.3.9 — using: "node20" in action.yml
• actions/dependency-review-action@v4.9.0 — using: "node20" in action.yml

Both are at their latest released versions. The upstream repos haven't released Node.js 24 versions yet.

Upstream tracking

• dependency-review-action: actions/dependency-review-action#1072
• gitleaks-action: No issue filed yet

Options

1. Wait for upstream releases (deadline: 2026-06-02)
2. Set FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable in affected workflow files to opt in early
3. Pin to newer commits if upstream pushes node24 support before a release

Affected workflows

• .github/workflows/gitleaks.yml
• .github/workflows/dependency-review.yml

[CybotTM]

Status update — 2026-05-03

Re-investigated after the warning kept showing on every skill-repo PR. Still no upstream fix shipped, but the situation has narrowed.

Current state of upstream actions

Action	Latest tag	runs.using (default branch)	Upstream node24 PR
gitleaks/gitleaks-action	v2.3.9 (ff98106e)	node20 (master also still node20)	issue #209 — only an unaffiliated fork commit (artyrian/gitleaks-action@76c8dd24), not pinnable for org-wide use
actions/dependency-review-action	v4.9.0 (2031cfc0)	node20	issue #1072, PRs #1081 / #1084 — all open, none merged

Empirical observation: only one annotation now, not two

Verified on two recent netresearch/skill-repo-skill Security workflow runs (25405171288, 25404465988):

• gitleaks / Secret Scanning job: 1 warning annotation (the Node 20 deprecation notice)
• dependency-review job: [] — zero annotations

So the dependency-review-action warning has stopped firing in practice (despite the action.yml still declaring node20). Only the gitleaks warning is visible to PR authors today.

What we can / cannot do

• The FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true env var is still in place on both workflows and is doing its job — the actions actually run on Node 24. The annotation is informational, not a runtime failure.
• We cannot silence the gitleaks annotation by bumping the SHA — there is no Node-22+ release of gitleaks/gitleaks-action.
• We will not pin to artyrian/gitleaks-action — unaffiliated fork, security-critical CI gate, hard no.

Revisit triggers (re-stated)

• gitleaks/gitleaks-action#209 gets a fix merged and tagged → bump SHA here, annotation goes away
• Switch to Betterleaks per Evaluate Betterleaks as Gitleaks replacement in reusable workflows #33 (own escape hatch) — currently parked, not warranted just for this annotation
• GitHub's 2026-06-02 deadline forces upstream to act

Until one of those happens, the gitleaks annotation is irreducible. Leaving this issue open as a tracker until upstream moves.

[CybotTM]

Verified resolved on the gitleaks side.

After PR #112 (betterleaks switchover) merged at 2026-05-05 22:42 UTC:

• Re-ran security workflow on netresearch/skill-repo-skill (run 25405171288, against main HEAD 7b39087)
• Annotation count for gitleaks / Secret Scanning: 0 (previously 1)
• Job conclusion: success

The dependency-review side was already empirically a no-fire (annotation count 0 on every recent run; only triggers under conditions that don't apply to docs-only PRs).

The remaining build Node-20 warning we sometimes see comes from the GitHub-managed pages-build-deployment workflow (actions/checkout@v4, actions/upload-artifact@v4) — that's GitHub infrastructure, not configurable here.

Suggesting this can be closed. Ping @SebastianThiel if there's anything else still tracked here.