chore: node <= 24 deprecation warning on github actions

[ommeirelles]

Linked to task SFS-3234

Node.js 20 actions are deprecated.
The following actions are running on Node.js 20 and may not work as expected:
actions/checkout@v4
actions/setup-node@v4
chromaui/action@v13.3.5
pnpm/action-setup@v4.
Actions will be forced to run with Node.js 24 by default starting June 16th, 2026.
Node.js 20 will be removed from the runner on September 16th, 2026.
Please check if updated versions of these actions are available that support Node.js 24.
To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file.
Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true.
For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (4)

• .github/workflows/ci.yml is excluded by none and included by none
• .github/workflows/codeql-analysis.yml is excluded by none and included by none
• .github/workflows/packages-preview.yml is excluded by none and included by none
• .github/workflows/release.yml is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: beca3350-cc53-4a6e-994e-ee3ed51c9129

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/github-actions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

[sonar-workflows]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (19.60% Estimated after merge)
• No data about duplications (1.60% Estimated after merge)

Project ID: vtex_faststore_f0a862d5-9557-49f9-8d09-de40caa76622

View in SonarQube

[renatomaurovtex]

Verified all bumped action tags resolve: actions/checkout@v6 (v6.0.3), actions/setup-node@v6 (v6.4.0), pnpm/action-setup@v6 (v6.0.9), chromaui/action@v17 exists. Diff is scoped and addresses the Node 20 action-runtime deprecation correctly (the warning is about the action wrapper runtime, which these major bumps fix). Nice and tight.

---

🟡 [code quality] packages-preview.yml still pins node-version: 20

ci.yml and release.yml move the build Node to 24.13.0, but the preview workflow keeps node-version: 20. The action-runtime deprecation is handled by the setup-node@v6 bump regardless, so this isn't blocking — but leaving the preview build on Node 20 is inconsistent with the other two pipelines and means preview can build/publish on a different Node than CI/release validate against. Intentional, or should it also go to 24.13.0?

       - name: Setup Node.js environment
         uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24.13.0

---

💬 [code quality] Overlaps with open dependabot PRs

chromaui/action@v13.3.5 → v17 here directly supersedes the still-open dependabot PR #3362 (chromaui/action 13.3.5 → 17.1.0), and #3361 also touches the Chromatic CI step. Once this merges, please close #3362 to avoid a conflicting/redundant bump, and double-check #3361 doesn't get stranded.

---

💬 [code quality] pnpm version now specified twice

Root package.json already has "packageManager": "pnpm@10.28.0", and the workflows still pass version: 10.28.0 to pnpm/action-setup. They match today so nothing breaks, but in v6 you can drop the version: input and let the action read packageManager — single source of truth, so the pnpm bump only happens in one place next time.

       - name: Setup pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 10.28.0

---

Verdict: Approved with comments

Blocking (🔴/🟠):

• None.

Non-blocking (🟡/💬):

• 🟡 packages-preview.yml left on Node 20 while ci/release move to 24.13.0 — confirm intentional or align.
• 💬 Close dependabot #3362 (chromaui v17) once merged; re-check #3361.
• 💬 version input + packageManager field duplicate the pnpm version; can drop the input in v6.

Checks to confirm before merge: a green CI run on this PR (the workflows under change are exercised by the PR itself) — confirm checkout/setup-node/pnpm/chromatic steps all pass on the new majors.

(Note: already approved by @eduardoformiga — leaving these as non-blocking polish.)