chore: DEVPLAT-7373 fix Node.js 20 deprecated GitHub Actions

[kristianmills]

Summary

Upgrades GitHub Actions that use the deprecated Node.js 20 runtime to Node.js 24 compatible versions.

Node.js 20 actions will be forced to run on Node.js 24 by default starting June 2nd, 2026. See the GitHub deprecation notice.

Changes made:

• cycjimmy/semantic-release-action@v4 → cycjimmy/semantic-release-action@v5

🤖 Generated with Claude Code

DEVPLAT-7373

---

Note

Medium Risk
Medium risk because it changes release automation (semantic-release) and Slack notification delivery; misconfiguration could break publishing or notifications.

Overview
Modernizes CI automation to avoid deprecated Node.js 20 GitHub Actions runtimes.

The release workflow upgrades cycjimmy/semantic-release-action to v5 and explicitly sets semantic_version: 24.

The composite job-notification action upgrades slackapi/slack-github-action to v3 and updates invocation to the new API (method: chat.postMessage, token/payload usage, and embedding channel in the payload instead of channel-id).

^{Reviewed by Cursor Bugbot for commit 66a86b6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Missing fetch-depth: 0 breaks semantic release versioning

High Severity

The checkout step is missing fetch-depth: 0. By default, actions/checkout performs a shallow clone (depth 1) without tags. Semantic-release requires full git history and tags to find previous releases, analyze commits since the last release, and determine the correct version bump. Without this, semantic-release may fail, skip releases, or compute incorrect versions. Both the official semantic-release docs and the cycjimmy/semantic-release-action README explicitly show fetch-depth: 0 as required.

 

^{Reviewed by Cursor Bugbot for commit f892ca8. Configure here.}

[kamranf]

@kristianmills I don't see this issue in other repos e.g. https://github.com/scribd/eks-deployer/blob/d3c1c8a0c37392444bab6ff358a7fc40f74216ea/.github/workflows/ci.yml#L38 can you confirm if we need to fix those as well? Or maybe if we do merge commits its fine to have shallow clones.

[kristianmills]

From looking online, it seems cursorbot got confused between the official semantic release, which does recommend, but not require, it, and cycjimmy/semantic-release-action. None of the documentation for cycjimmy/semantic-release-action sets. fetch depth, and I have never had any errors or issues when I have tested them in the past (also we've never used fetch-depth 0 on this or any of the other repos before when using cycjimmy/semantic-release-action.

[terranisu]

LGTM

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 66a86b6. Configure here.}

[cursor]

Unnecessary persist-credentials: false added by AI tool

Low Severity

The persist-credentials: false option was added to the checkout step but isn't required for this workflow. As confirmed in the PR discussion, this was introduced by the AI tool (Claude Code) based on a misconception about cycjimmy/semantic-release-action needing it — the official semantic-release docs recommend it, but the cycjimmy wrapper does not, and this repo has never used it. It's harmless but unnecessary, adding noise that may confuse future maintainers about its purpose.

 

^{Reviewed by Cursor Bugbot for commit 66a86b6. Configure here.}