chore: upgrade actions to Node 24 runtime (SHA-pinned)

[John C. Bland II (johncblandii)]

what

• Bump GitHub Actions references in the workflows to versions running on the Node 24 runtime,
  SHA-pinned with precise version comments:
  • actions/checkout@v4 → @3d3c42e5... # v7.0.1
  • actions/setup-go@v5 → @b7ad1dad... # v7.0.0
  • docker/login-action@v3 → @dbcb8138... # v4.6.0
  • docker/setup-buildx-action@v3 → @bb05f3f5... # v4.2.0
  • docker/setup-qemu-action@v3 → @96fe6ef7... # v4.2.0
  • goreleaser/goreleaser-action@v5 → @f06c13b6... # v7.2.3

Supersedes #136
Supersedes #135
Supersedes #134
Supersedes #132
Supersedes #130
Supersedes #128

why

• GitHub is deprecating the Node 20 runtime; affected workflows emit a deprecation warning and
  are already being force-migrated to Node 24
• SHA pinning with a verified tag comment makes the upgrade deliberate and supply-chain-safe,
  matching the org's direction in chore: upgrade actions to Node 24 runtime and enforce SHA pinning .github#261
• Every pinned SHA was verified against its upstream tag

references

• https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

still on Node 20

• docker/build-push-action@v7 — already on the Node 24 major, left as a floating tag (not
  covered by this mechanical pin pass)
• mszostok/codeowners-validator@v0.7.1 — Docker-based action, not affected by the Node runtime
  deprecation
• cloudposse/.github/.github/workflows/shared-auto-release.yml@main — reusable workflow ref,
  intentionally left on @main

[Copilot]

Pull request overview

Upgrades GitHub Actions workflow uses: references to Node 24–runtime compatible releases and pins them to verified commit SHAs (with tag comments) to reduce supply-chain risk and avoid Node 20 deprecation impacts across CI.

Changes:

• Pin actions/checkout to 3d3c42e5... (# v7.0.1) across workflows.
• Pin actions/setup-go and goreleaser/goreleaser-action to Node 24–compatible SHAs in the release/build workflow.
• Pin Docker setup/login actions (setup-qemu, setup-buildx, login-action) to Node 24–compatible SHAs in the Docker workflow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/validate-codeowners.yml	Pin actions/checkout to a verified SHA (v7.0.1).
.github/workflows/docker.yml	Pin checkout + Docker setup/login actions to verified SHAs (v7.0.1, v4.2.0, v4.6.0).
.github/workflows/build.yml	Pin checkout/setup-go/goreleaser actions to verified SHAs (v7.0.1, v7.0.0, v7.2.3).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[John C. Bland II (johncblandii)]

CI triage for this PR

Build Binaries — caused by this PR, fixed in 99d253c. Bumping goreleaser/goreleaser-action v5 → v7 changed what version: latest resolves to: v5 locked to GoReleaser ~> v1, v7 locks to ~> v2 (v2.17.1), which refuses the old version: 0 config ("only version: 2 configuration files are supported"). Migrated .goreleaser.yml to the v2 schema (version: 2, archives.formats, changelog.disable) and validated it with goreleaser check using the same v2.17.1 binary CI downloads. (Side note for a maintainer, not touched here: builds[0].binary is set to atmos, which looks like a copy-paste leftover in this repo.)

validate-codeowners — pre-existing, fixed in f29c07b. The owners check failed with Teams for organization "cloudposse" could not be queried. Requires GitHub authorization. — the dead org token issue, unrelated to any changed line; the same failure pattern exists across cloudposse repos (github-status-updater, lambda-github-action-token-rotator, build-harness) on branches that predate this PR. Replaced the workflow with the org-standard shared cloudposse/.github/.github/workflows/shared-codeowners.yml@main (triggers on pull_request, so the fix takes effect on this PR).