chore(gha): bump Node.js and external actions

Bumps Node.js to build the package → 24, and external actions.

No longer specifies the version of `pnpm` to the setup action to respect
the `packageManager` prop in `package.json`.

Appends `--tag latest` to the `pnpm publish` command, because it might
fail without the option.

Author: kikuomax

.github/workflows/publish-package.yml

@@ -18,16 +18,15 @@ permissions:
   packages: write
 
 env:
-  node-version: 22
-  pnpm-version: 10
+  node-version: 24
 
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get short commit hash
         id: commit-hash
@@ -51,11 +50,10 @@ jobs:
 
       - name: Install pnpm ${{ env.pnpm-version }}
         uses: pnpm/action-setup@v4
-        with:
-          version: ${{ env.pnpm-version }}
+        # version is omitted here, because package.json specifies it
 
       - name: Setup Node.js ${{ env.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.node-version }}
           cache: pnpm
@@ -69,4 +67,4 @@ jobs:
       - name: Build and publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.npm-token }}
-        run: pnpm publish --no-git-checks
+        run: pnpm publish --no-git-checks --tag latest