chore: bump pinned GitHub Actions off the deprecated Node 20 runtime

.github/workflows/validate.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -48,7 +48,7 @@ jobs:
         shell: pwsh
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install PSScriptAnalyzer and Pester
         run: |

CHANGELOG.md

@@ -19,6 +19,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - The `{{Guid}}` placeholder instruction in `/new-repo` is now shell-agnostic (`uuidgen`, pwsh, or
   python) instead of assuming PowerShell is available on the scaffolding host.
+- GitHub Actions pinned in this repo's CI and in the bundled workflow templates are bumped off the
+  deprecated Node 20 runtime to their latest majors: `actions/checkout@v7`,
+  `actions/setup-python@v6`, and `googleapis/release-please-action@v5` (whose only breaking change
+  is the Node 24 move — no input changes).
 
 ## [0.2.0] - 2026-07-06
 

plugins/repokit/skills/new-repo/templates/published/.github/workflows/release.yml.tmpl

@@ -17,7 +17,7 @@ jobs:
       # bumps the version, updates CHANGELOG.md, tags, and creates a GitHub release.
       # (Releases created by the default token don't trigger other workflows; if you
       # need the publish workflow to fire on release, supply a PAT via `token:`.)
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
         with:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json

plugins/repokit/skills/new-repo/templates/types/docker-compose/public/.github/workflows/ci.yml.tmpl

@@ -12,7 +12,7 @@ jobs:
     name: docker compose config
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Validate compose file
         run: |
           cp .env.example .env

plugins/repokit/skills/new-repo/templates/types/power-platform-connectors/public/.github/workflows/ci.yml.tmpl

@@ -17,7 +17,7 @@ jobs:
     name: generate + validate connector definitions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Build the pinned toolchain image
         run: docker build -t ppc-gen .

plugins/repokit/skills/new-repo/templates/types/power-platform-connectors/public/.github/workflows/sync.yml.tmpl

@@ -23,7 +23,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Fetch upstream collection and detect a change
         id: fetch

plugins/repokit/skills/new-repo/templates/types/powershell-module/public/.github/workflows/ci.yml.tmpl

@@ -15,7 +15,7 @@ jobs:
       run:
         shell: pwsh
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install PSScriptAnalyzer and Pester
         run: |

plugins/repokit/skills/new-repo/templates/types/powershell-module/published/.github/workflows/publish.yml.tmpl

@@ -19,7 +19,7 @@ jobs:
       run:
         shell: pwsh
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Publish module
         env: