From eb48a7cdde2d1a3bd691d1d6ba3ba43cf4915663 Mon Sep 17 00:00:00 2001
From: Juan Francisco Lebrero <101231690+frizynn@users.noreply.github.com>
Date: Mon, 23 Mar 2026 12:48:01 -0300
Subject: [PATCH] fix(ci): standardize GitHub Actions and Node.js versions
 (#2169)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update pr-risk.yml and ai-triage.yml to match the versions used by all
other CI workflows:
- actions/checkout@v4 → @v6
- actions/setup-node@v4 → @v6
- node-version: '20' → '24'

Also fix unquoted $GITHUB_OUTPUT references in pr-risk.yml shell blocks
to prevent word-splitting issues.
---
 .github/workflows/ai-triage.yml |  2 +-
 .github/workflows/pr-risk.yml   | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ai-triage.yml b/.github/workflows/ai-triage.yml
index b07fc8c46..f1e3e1abe 100644
--- a/.github/workflows/ai-triage.yml
+++ b/.github/workflows/ai-triage.yml
@@ -14,7 +14,7 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             VISION.md
diff --git a/.github/workflows/pr-risk.yml b/.github/workflows/pr-risk.yml
index bde087b7a..298d64851 100644
--- a/.github/workflows/pr-risk.yml
+++ b/.github/workflows/pr-risk.yml
@@ -19,14 +19,14 @@ jobs:
     steps:
       # Checkout the BASE branch — our trusted script and map, not fork code.
       - name: Checkout base
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.base_ref }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
 
       # Use the GitHub API to get changed files — no fork code is executed.
       - name: Get changed files
@@ -44,14 +44,14 @@ jobs:
         id: risk
         run: |
           REPORT=$(cat /tmp/changed-files.txt | node scripts/pr-risk-check.mjs --github || true)
-          echo "report<<EOF" >> $GITHUB_OUTPUT
-          echo "$REPORT" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
+          echo "report<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$REPORT" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
 
           RISK_LEVEL=$(cat /tmp/changed-files.txt | node scripts/pr-risk-check.mjs --json 2>/dev/null \
             | node -e "let d=''; process.stdin.on('data',c=>d+=c); process.stdin.on('end',()=>{ try { console.log(JSON.parse(d).risk) } catch { console.log('low') } })" \
             || echo "low")
-          echo "level=$RISK_LEVEL" >> $GITHUB_OUTPUT
+          echo "level=$RISK_LEVEL" >> "$GITHUB_OUTPUT"
 
       - name: Write step summary
         run: echo "${{ steps.risk.outputs.report }}" >> $GITHUB_STEP_SUMMARY