CI: Upgrade GitHub Actions to support Node.js 24

[mukesh27]

Per the official ​GitHub Changelog announcement, Node.js 20 has reached End-of-Life (EOL), and GitHub is actively phasing out support for it on Actions runners in favour of Node.js 24.

The enforcement schedule introduces key milestones that directly impact our workflows:

• June 2026: GitHub is switching the default runner execution behavior to Node.js 24. Actions explicitly targeting or running on Node.js 20 are actively triggering deprecation warning logs.
• Fall 2026: Node.js 20 will be fully removed from GitHub-hosted runners, which will cause any un-updated actions relying on it to fail.

To ensure our CI/CD pipelines remain stable, clear of warning noise, and future-proof, we need to audit and update the GitHub Actions versions used in .github/workflows/.

Proposed Changes

1. Audit Workflow Files: Check all YAML files in .github/workflows/ for third-party or official GitHub actions targeting Node.js 20.
2. Upgrade Action Versions: Bump outdated GitHub Actions to versions that natively target the node24 runtime. Major dependencies to look for typically include:

• actions/checkout (Ensure it is at least v4/v5+)
• actions/setup-node
• actions/cache
• actions/upload-artifact / actions/download-artifact
• WordPress-specific custom actions or third-party community actions.

## Summary

• wow-actions/welcome@v1.3.1 was the only GitHub Action still running on the deprecated Node.js 20 runtime, and no Node.js 24 release exists for it.
• All other actions already resolve to the node24 runtime (or are composite / docker actions), so this was the last source of node20 deprecation warnings in CI.
• Reimplements the first-time-contributor welcome comment as an actions/github-script step, matching the other jobs in the same workflow. Removes the final node20 dependency and a third-party action while keeping the welcome behavior intact.

## Audit results
Every action in .github/workflows/ was checked against its runs.using runtime. After this change, none run on node20:

Action	Pinned version	Runtime
actions/checkout	v6.0.2	✅ node24
actions/setup-node	v6.4.0	✅ node24
actions/cache	v5.0.5	✅ node24
actions/upload-artifact	v7.0.1	✅ node24
actions/download-artifact	v8.0.1	✅ node24
actions/github-script	v8.0.0	✅ node24
shivammathur/setup-php	2.37.1	✅ node24
slackapi/slack-github-action	v3.0.3	✅ node24
astral-sh/setup-uv	v7.6.0	✅ node24
github/codeql-action/upload-sarif	v4.35.4	✅ node24
WordPress/props-bot-action	@trunk	✅ node24
ramsey/composer-install	4.0.0	✅ composite
codecov/codecov-action	v5.5.3	✅ composite
docker://rhysd/actionlint	v1.7.11	✅ docker
wow-actions/welcome	v1.3.1	❌ node20 → removed in this PR

Result: wow-actions/welcome@v1.3.1 was the sole node20 holdout (no node24 release exists). Replacing it with an actions/github-script step eliminates the last source of node20 deprecation warnings in CI.

Trac ticket: https://core.trac.wordpress.org/ticket/65432

## Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Opus 4.8
Used for: Code analysis, test implementation, and workflow management.

Seems like side effect of AI changes 🤔

@mukeshpanchal27 — you're right, the first pass was over-built. I've reverted it.

The only actual node20 holdout in .github/workflows/ is wow-actions/welcome, which is unmaintained and has no node24 release (even its default branch still targets node20). So rather than a version bump, I've swapped it for GitHub's official actions/first-interaction@v3.1.0 (node24), SHA-pinned per our convention. The welcome message itself is unchanged.

Two minor behavioral notes with the official action:

• It posts a static message (no templating), so the greeting drops the @author mention → Hi there!.
• It has no reaction feature, so the 🎉 reaction is gone.

If preserving the @mention/reaction is preferred, I'm happy to go with a small actions/github-script step instead — just let me know which you'd rather have in core.

[desrosj]

In 62486:

Build/Test Tools: Replace abandoned third party action.

The wow-actions/welcome action has not been updated for over 2 years and is currently configured to run on Node20. With GitHub now actively removing support for Node.js 20.x within the GitHub Actions environment, any action explicitly using Node20 will break.

This replaces wow-actions/welcome with the actions/first-interaction action, which is an action officially maintained by GitHub and offers the same functionality.

Props khokansardar, mukesh27, desrosj.
Fixes #65432.

[desrosj]

In 62490:

Build/Test Tools: Include required input for actions/first-interaction.

While not documented as required, both issue_message and pr_message are required inputs for this action.

Follow up to [62486].

Fixes #65432.

[wildworks]

It seems that welcome comments are now being posted on all submitted PRs, even for contributors who are not first-time contributors.

​https://github.com/WordPress/wordpress-develop/pull/12197#issuecomment-4726870608

According to AI investigation, r62486 is the cause, and this appears to be an upstream bug.

The first-interaction action checks if this is the user's first contribution ​here. However, this check might not be functioning correctly because the issue feature is disabled in the wordpress-develop repository.

[wildworks]

Replying to wildworks:

It seems that welcome comments are now being posted on all submitted PRs, even for contributors who are not first-time contributors.

​https://github.com/WordPress/wordpress-develop/pull/12197#issuecomment-4726870608

According to AI investigation, r62486 is the cause, and this appears to be an upstream bug.

The first-interaction action checks if this is the user's first contribution ​here. However, this check might not be functioning correctly because the issue feature is disabled in the wordpress-develop repository.

I have submitted a PR to upstream for this issue. ​https://github.com/actions/first-interaction/pull/410

[wildworks]

I have submitted a PR to upstream for this issue. ​https://github.com/actions/first-interaction/pull/410

Unfortunately, there has been no activity upstream, but since this ticket is unrelated to a WordPress release, I will leave it as is.

[desrosj]

Let's punt this to 7.2 as it's not urgent at this time.