chore: bump CI actions to Node.js 24 compatible versions

[davidkonigsberg]

Summary

Bumps all external GitHub Actions to their latest Node.js 24-compatible major versions to address Node.js 20 deprecation warnings. Version-only changes across 8 workflow files — no workflow logic modified.

Action	Old	New
actions/checkout	v4	v5
actions/github-script	v7	v8
actions/setup-node	v4	v5
actions/upload-artifact	v4	v6
peter-evans/create-pull-request	v7	v8
tj-actions/changed-files	v41	v47

Actions left as-is (no newer major version or already current): actions/stale@v10, errata-ai/vale-action@reviewdog, fern-api/setup-fern-cli@v1, lycheeverse/lychee-action@v2, peter-evans/enable-pull-request-automerge@v3, thollander/actions-comment-pull-request@v2.4.3

Breaking Change Audit

• actions/checkout v4→v5: Node.js 24 runtime only. Inputs used (fetch-depth, token) unchanged. v6 was intentionally skipped — it changes credential persistence behavior and can break docker actions. ✔ Safe.
• actions/github-script v7→v8: Node.js 24 runtime only. Inputs used (github-token, script) unchanged. ✔ Safe.
• actions/setup-node v4→v5: Auto-caching breaking change exists, but this repo has no packageManager field in package.json, so it does not apply. The fern-scribe.yml workflow explicitly sets cache: 'npm' which is still supported. ✔ Safe.
• actions/upload-artifact v4→v6: v5 was preliminary Node.js 24 support (still defaulted to Node.js 20); v6 is the full Node.js 24 version. Inputs used (name, path, if-no-files-found) unchanged across both versions. ✔ Safe.
• peter-evans/create-pull-request v7→v8: Node.js 24 runtime only. Inputs used (base, branch, commit-message, delete-branch, title) unchanged. ✔ Safe.
• tj-actions/changed-files v41→v47: v42 changed directory-trailing-slash matching behavior; v43 changed any_changed default when no patterns specified. Our usage only passes files with glob patterns (no trailing slashes, no reliance on any_changed defaults), so neither breaking change applies. ✔ Safe.

Review & Testing Checklist for Human

• Verify tj-actions/changed-files v41→v47 doesn't change output behavior for the vale.yml workflow — we only use the files input with glob patterns; confirm the filtered file list output format is unchanged
• Verify actions/upload-artifact v4→v6 (skipping v5) works correctly for the check-links.yml artifact uploads (urls, lychee-report, lychee-outputs)
• After merging, monitor the next scheduled runs of check-links.yml and vale.yml to confirm they work as expected

Notes

• upload-artifact was bumped directly from v4 to v6 (not v5). v5 was a preliminary Node.js 24 release that still defaulted to Node.js 20; v6 is the proper Node.js 24 version.
• This repo has no packageManager field in package.json, so the actions/setup-node@v5 auto-caching breaking change does not apply here.

Link to Devin session: https://app.devin.ai/sessions/3838526ec6224c6b9dc01df9ed56530e
Requested by: @davidkonigsberg

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[github-actions]

🌿 Preview your docs: https://fern-preview-devin-1774008317-bump-ci-actions.docs.buildwithfern.com/learn