ci: bump GitHub Actions to Node.js 24 and fix brew warnings

[dugyen]

Summary

• Bump all GitHub Actions to their latest Node.js 24-compatible major versions: checkout v4→v6, cache v4→v5, upload-artifact v4→v7, github-script v7→v9, labeler v5→v6, action-semantic-pull-request v5→v6
• Replace ilammy/msvc-dev-cmd@v1 (no Node 24 release exists) with an inline PowerShell step that runs vcvarsall.bat and exports the env diff to $GITHUB_ENV
• Fix macOS brew "already installed" warnings for openssl/pkgconf by checking brew list before install

Node.js 20 will be removed from GitHub Actions runners on 2026-09-16. These changes eliminate all deprecation annotations from CI runs.

Test plan

• Linux build & test passes
• macOS build & test passes — no "already installed" annotations
• Windows build & test passes — MSVC env set up correctly via inline vcvarsall
• Code Style check passes
• Conventional Commits check passes
• PR Build Artifacts job posts comment
• 0 Node.js deprecation annotations across all jobs

🤖 Generated with Claude Code

[github-actions]

Build Artifacts

Platform	Download
Linux (x86_64)	Traktor-linux-x86_64
macOS (Apple Silicon)	Traktor-macOS
Windows (x64)	Traktor-windows-x64

Built from 2a62c87. Artifacts expire after 90 days.

[greptile-apps]

Greptile Summary

This PR updates CI workflows for newer GitHub Actions runtimes. The main changes are:

• Bumped checkout, cache, artifact, script, labeler, and release actions.
• Added a local MSVC setup composite action for Windows jobs.
• Replaced the macOS package install warning path with a preinstall check.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Files Needing Attention: No files need attention.

T-Rex Logs

What T-Rex did

• T-Rex produced a proof for a posted P2 finding and referenced the review comment describing the finding.
• T-Rex performed general contract validation, collecting and inspecting the CI and release workflow evidence that shows a brew-guard failure, with Node-24 compatibility checks passing and the MSVC inline environment behavior verified across workflows.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/actions/setup-msvc/action.yml	Adds a local composite action that runs vcvarsall.bat and exports the MSVC environment for later Windows build steps.
.github/workflows/ci.yml	Updates CI action versions, uses the local MSVC setup action, and checks for pkgconf before installing the macOS dependency.
.github/workflows/release.yml	Updates release workflow action versions and switches the Windows release build to the local MSVC setup action.
.github/workflows/label.yml	Updates the labeler action version.
.github/workflows/release-please.yml	Updates the release-please action version.

Comments Outside Diff (1)

1. General comment

   Release macOS dependency step still lacks the Homebrew installed guard

   • Bug
     • The PR objective says the workflows avoid Homebrew already-installed warnings, and the CI workflow now uses brew list pkgconf &>/dev/null || brew install pkg-config. However, the release workflow's macOS build still runs brew install pkg-config directly at .github/workflows/release.yml:42. On GitHub macOS runners where pkgconf/pkg-config is already present, release builds can still produce the warning/noise this PR intends to eliminate.
   • Cause
     • The Homebrew guard was applied to .github/workflows/ci.yml but not mirrored in .github/workflows/release.yml, even though both workflows install the same macOS build dependency.
   • Fix
     • Update .github/workflows/release.yml line 42 to use the same guarded install pattern as CI, e.g. brew list pkgconf &>/dev/null || brew install pkg-config, and consider keeping the explanatory comment consistent between CI and release workflows.

   _{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "ci: extend Node 24 migration to release ..." | Re-trigger Greptile}

[dugyen]

@developeritsme Requested your review on this one. Since you rebased the branch and added c341e41 (extending the Node 24 migration to release.yml / release-please.yml), you've got the best context on it.

Current state:

• All checks green — Build & Test on Linux/Windows/macOS, Code Style, Conventional Commits, Greptile, artifacts, label.
• MERGEABLE, no conflicts.

Could you give it a formal review/approve when you have a moment? Thanks 🙏

[developeritsme]

Heads up @dugyen: I rebased this onto master and extended the scope, so the branch now has commits you did not write. Your original head is preserved locally as backup/node24-prerebase at 6d7e37d if you want anything back.

Why the scope grew

The branch covered ci.yml and label.yml, which left release.yml and release-please.yml on Node 20 actions. That is the worse half to miss: CI keeps working while the release pipeline breaks unattended, with signing and notarization in the loop. You would find out mid-release rather than on a PR you can retry for free.

Runtime audit

I checked each action's declared runtime rather than inferring from version numbers, and the picture was different from what the description assumed. Most of what this PR bumped was already Node 24 at the old pin. What was actually still on node20:

Action	Where	Action taken
actions/download-artifact@v4	release.yml, 3 uses	bumped to v8
googleapis/release-please-action@v4	release-please.yml	bumped to v5
ilammy/msvc-dev-cmd@v1	release.yml	no node24 release exists, replaced
sslcom/esigner-codesign	release.yml, 2 uses	no node24 release at any tag

jurplel/install-qt-action and cpp-linter/cpp-linter-action are composite actions, so they are not affected by the runtime removal directly.

Changes

Rebase conflict was the brew step. Resolved toward master, since #57 replaced OpenSSL with vendored tiny-AES-c and the openssl guard no longer applies.

MSVC setup moved to a local composite action (.github/actions/setup-msvc) rather than copying the inline PowerShell into a second workflow, so the two cannot drift.

I also hardened the script. The original had a silent-failure path worth calling out: if vswhere were missing or vcvarsall.bat failed, && short-circuits so set never runs, stderr was already sent to nul, and the loop iterated over an empty pipeline. Nothing got written to GITHUB_ENV and the step still exited green, surfacing much later as a confusing "cl.exe not found". It now validates vswhere, the VS install and vcvarsall.bat, checks $LASTEXITCODE, refuses multi-line values that would corrupt GITHUB_ENV, and fails when zero variables are exported. Confirmed working on this run: Exported 48 environment variables from vcvarsall.bat x64.

One subtlety worth preserving: the step has to stay on shell: pwsh. Windows PowerShell 5.1 writes UTF-16LE, which would corrupt GITHUB_ENV. There is a comment on it now.

Version choices. I kept the majors you already picked (checkout v6, cache v5) instead of jumping to the newest available (v7, v6). Both are Node 24, so moving further adds breaking-change review for no benefit against the actual goal. The one place I did go to latest is the artifact pair: upload-artifact@v7 adds direct uploads and download-artifact@v8 is the release that understands them, so they have to move together.

Not fixed

sslcom/esigner-codesign declares node20 at every published tag including the latest v1.3.2, and it has no node24 release. I first read that as a hard break at the removal date. Checking the actual runs shows otherwise, so correcting it here.

Since 2026-06-16 GitHub already runs node20-declaring actions on Node 24 by default, and the v1.11.3 release on 2026-06-30 signed both Traktor.exe and the installer successfully under that default, with the runner logging "Node 20 is being deprecated. This workflow is running with Node 24 by default." So the signing path already executes on Node 24 and works.

What is left is a stale declaration rather than a breakage. The 2026-09-16 removal takes away the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out, which we do not use, so it should be a no-op for us. Worth watching rather than fixing: this is not a good reason to swap a working signing path for a direct CodeSignTool invocation that can only be validated by cutting a real signed release.

What CI cannot tell us here

release.yml never runs on a pull request, so the download-artifact@v8 bump, the upload-artifact@v7 pairing and release-please-action@v5 are unexercised by these green checks. The MSVC composite action is shared between both workflows, so that part is genuinely covered by the Windows job, but the artifact round-trip is not. Cutting the 1.12.0 release soon after this merges is the cheapest way to surface a problem while the change is still fresh.