Upgrade actions to Node 24 releases

[cohogan]

Problem

Every workflow run warns:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, pnpm/action-setup@v4.

Change

Bump each to its current major, all of which target node24:

Action	From	To
actions/checkout	v4	v7
actions/setup-node	v4	v7
pnpm/action-setup	v4	v6

Compatibility, checked against our workflows:

• checkout v7 blocks fork-PR checkout on pull_request_target/workflow_run triggers — our review workflow uses plain pull_request, so unaffected. v6's credential-persistence change and v7's ESM migration don't touch our usage.
• setup-node v7 still supports the explicit cache: pnpm + cache-dependency-path inputs we use. The v5+ automatic-caching feature keys off a packageManager field in package.json, which we don't have — no behavior change.
• pnpm/action-setup v6 adds pnpm 11 support on top of v5's node24 move; our pinned version: 10 input is unchanged.

tauri-apps/tauri-action, dtolnay/rust-toolchain, digicert/ssm-code-signing, and anthropics/claude-code-action were not named in the warning and are left as-is.

Bumps version to 0.1.18.

The claude-review check on this PR exercises the upgraded checkout; the build workflow only runs on push to main, so the first release build after merge confirms the rest.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Claude finished @cohogan's task in 39s —— View job

---

Code Review: Upgrade actions to Node 24 releases

• Gather context and review diff
• Verify action version bumps
• Check version bump consistency
• Post review findings

---

Looks good. Clean, minimal PR that does exactly what it says.

Action bumps — All three actions (checkout@v7, setup-node@v7, pnpm/action-setup@v6) are correctly updated across both workflow files. The compatibility notes in the PR description are thorough and accurate: pull_request trigger avoids checkout v7's fork-PR restriction, the explicit cache: pnpm input sidesteps setup-node's auto-caching behavior, and version: 10 keeps pnpm pinned through the action-setup bump.

Version bump — 0.1.17 → 0.1.18 is consistent across all three required locations:

• package.json:4
• src-tauri/Cargo.toml:3
• src-tauri/tauri.conf.json:4

Cargo.lock is also updated to match.

No issues found. The unchanged actions (tauri-apps/tauri-action@v0, dtolnay/rust-toolchain@stable, digicert/ssm-code-signing@v1.1.0, anthropics/claude-code-action@v1) are correctly left alone since they weren't flagged in the deprecation warning.

---

|