Description

GitHub Actions warns that actions/checkout@v4 and actions/setup-python@v5 target the deprecated Node.js 20 runtime and are being forced onto Node.js 24. This PR bumps those uses: refs to the current major versions, which target Node 24 natively. Nothing else changes: job structure, triggers, permissions, inputs, and the third-party validators all stay as they are.

Evidence of the current warning

From the check-run annotations on the latest runs at 2fb07f7 (CI run 37119786268, Release run 37119875054, 2026-10-03):

No job's warning names home-assistant/actions/hassfest or hacs/action.

Changes

The switch to Node 24 happened in checkout v5.0.0 ("Update actions checkout to use node 24") and setup-python v6.0.0 ("Upgrade to node 24"). runs.using reads node24 at checkout v5, v6, and v7, and at setup-python v6 and v7.

Breaking-change review

What I checked: the GitHub release notes for every major in between (checkout v5.0.0, v6.0.0, v7.0.0; setup-python v6.0.0, v7.0.0), checkout's CHANGELOG.md and README "What's new" at v7, setup-python's README at v7, and a diff of action.yml inputs between the old and new tags, compared against how these workflows actually use each action.

Runner minimum (both actions): no impact. Node 24 needs Actions Runner v2.327.1 or newer (runner release), as stated in the checkout v5.0.0 / setup-python v6.0.0 release notes and the checkout v7 README. Every job here runs on GitHub-hosted ubuntu-latest, and those runners update automatically. The current runner release is v2.338.0 (src/runnerversion). This repo has no self-hosted runners.

actions/checkout v4 → v7: none found that affect these workflows.

• Inputs: the action.yml diff between v4 and v7 changes only runs.using. The only input in use, ref: in release.yml, is unchanged.
• v6, credentials stored in a separate file under $RUNNER_TEMP instead of .git/config: release.yml only runs git ls-remote ... origin and gh with GH_TOKEN. Nothing reads the token out of .git/config, and ls-remote against this public repo still works. The v7 README notes that authenticated git from Docker container actions needs runner ≥ v2.329.0. hacs/action is a Docker action, and hassfest is a composite step that runs docker run, but neither runs authenticated git against the checkout, and hosted runners are well above v2.329.0.
• v7, refusing to check out fork-PR code under pull_request_target / workflow_run unless allow-unsafe-pr-checkout: true (#2454): release.yml is triggered by workflow_run. In the guard's source (src/unsafe-pr-checkout-helper.ts at v7), it only acts when workflow_run.event starts with pull_request and the head repo is a fork. The release job is gated on github.event.workflow_run.event == 'push', so it skips CI runs triggered by PRs before checkout ever runs, and push runs are never blocked. The same guard was also backported to the v4 tag (v4.4.0's action.yml already declares allow-unsafe-pr-checkout), so this upgrade changes nothing here.
• v7, module moved to ESM: internal only.

actions/setup-python v5 → v7: none found that affect this workflow.

• Inputs: the action.yml diff between v5 and v7 adds an optional pip-version input and changes runs.using. No inputs were removed or renamed, and no defaults changed. The inputs in use (python-version: "3.13", cache: pip, cache-dependency-path: requirements_test.txt) are all still present.
• v7, "Remove the pip-install input" (#1336): that input doesn't exist in v5's action.yml and isn't used here.
• v7, "Remove EOL Python versions" (#1333): this touches test fixtures, and 3.13 isn't EOL. 3.13 builds (latest 3.13.16) are published for Ubuntu 22.04, 24.04, and 26.04 in actions/python-versions' manifest.
• v7, cache library upgraded to @actions/cache 6.2.0 (#1337): the cache: pip behavior and inputs are unchanged. The first run after the merge may miss the pip cache. That affects speed only, not results.

Noticed but deliberately not changed

• home-assistant/actions/hassfest@master: its action.yml is using: "composite" (a bash step that runs docker run ghcr.io/home-assistant/hassfest), so it has no Node runtime and can't trigger the warning. The run annotations confirm this. Left as is.
• hacs/action@main: its action.yml is using: "docker", so it has no Node runtime and isn't named in the warning. Left as is.
• ubuntu-latest → Ubuntu 26 notice: every job also has a notice that "The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026" (runner-images#14748). That's unrelated to Node 20 and out of scope. Python 3.13 is available for 26.04 (see above), so the Tests job shouldn't be affected.
• Tag style: I kept floating major tags (@vN) to match the repo's existing style. I didn't pin to SHAs, though both actions' READMEs now recommend it.

Ambiguity

• Which Node 24 major to choose: checkout v5, v6, and v7 all target Node 24, as do setup-python v6 and v7. The ticket asks for "which current version targets Node 24", so I used the latest majors (v7 for both). If you'd rather take the smallest jump (checkout v5, setup-python v6), that's a two-line change, and the breaking-change notes above for those intermediate majors still apply.

Validation

• Both files parse with PyYAML (ci.yml jobs: tests, hassfest, hacs; release.yml jobs: release), and actionlint 1.7.12 reports no issues.
• The diff only touches the 5 uses: lines (5 insertions, 5 deletions).
• Acceptance criteria 1–2 (no Node 20 warning on this PR's CI, same green jobs) can only be confirmed once CI runs on the PR. Release.yml is only triggered by pushes to main, so it doesn't run on the PR.