Upgrade GitHub Actions to current majors (SHA-pinned) and tighten Actions allowlist

[NoopDog]

GitHub deprecated the Node 20 runtime for Actions, and several of this repository's workflows pin action majors that target Node 20 or older (Node 16-era pins are already being force-migrated). GitHub currently force-runs these on Node 24, so workflows still pass, but the forcing is temporary and each run emits deprecation annotations. Upgrade the actions below to their current major versions, which target Node 24 natively.

In the same change, tighten the repository's Actions allowlist: remove the actions/* wildcard and name every allowed action explicitly, pinned by commit SHA. This matches the convention already used for release-please (SHA pin in the workflow with a version comment, exact SHA entry in the allowlist).

Latest majors and SHAs verified against each action's releases and tags as of 2026-07-15.

Workflow	Action	Current	Target
deploy-analytics.yml	actions/checkout	v4	v7.0.0
deploy-analytics.yml	actions/configure-pages	v5	v6.0.0
deploy-analytics.yml	actions/upload-pages-artifact	v3	v5.0.0
deploy-analytics.yml	actions/deploy-pages	v4	v5.0.0
run-checks.yml	actions/checkout	v2	v7.0.0
run-checks.yml	actions/setup-node	v2	v7.0.0
run-playwright-tests-anvil-catalog.yml	actions/checkout	v3	v7.0.0
run-playwright-tests-anvil-catalog.yml	actions/setup-node	v3	v7.0.0
run-playwright-tests-anvil-catalog.yml	actions/upload-artifact	v4	v7.0.1
run-playwright-tests-anvil-cmg.yml	actions/checkout	v3	v7.0.0
run-playwright-tests-anvil-cmg.yml	actions/setup-node	v3	v7.0.0
run-playwright-tests-anvil-cmg.yml	actions/upload-artifact	v4	v7.0.1

Target uses: lines (SHA-pinned):

- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
- uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
- uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
- uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

Final allowlist (Settings → Actions → General, requires repo admin), replacing actions/*:

actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0,
actions/setup-node@820762786026740c76f36085b0efc47a31fe5020,
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a,
actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d,
actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9,
actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128,
googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7,

Sequencing: the allowlist can hold old and new entries at the same time, so add the SHA entries before merging the workflow PR, confirm green runs, then remove actions/*.

Definition of done

• All action references listed above are updated to the stated versions, pinned by commit SHA with a version comment.
• The Actions allowlist names each allowed action explicitly by SHA and no longer contains the actions/* wildcard.
• Workflows that run on pull requests pass on the upgrade PR itself.
• Workflows that only run on push to the default branch or on dispatch (deploys, release-please) complete a green run after merge and after the wildcard is removed, via the next natural trigger or a manual dispatch.
• No Node deprecation annotations remain in the runs.