ci: bump actions to node24 to clear deprecation warnings

[alandtse]

Summary

Clears the GitHub Actions node20 deprecation warnings in .github/actions/setup-build-environment/action.yaml. node20 actions will be force-migrated to node24 on 2026-06-02 and node20 will be removed from the runner on 2026-09-16.

Action	Before	After	Reason
ilammy/msvc-dev-cmd	@v1 (node20)	TheMrMilchmann/setup-msvc-dev@v4.0.0 (node24)	Original action has no node24 release; switch maintained fork
lukka/run-vcpkg	@v11.5 (node20)	@v11.6 (node24)	Latest in the v11 series
actions/cache	@v4 (node20)	@v5 (node20→node24)	Major bump

Notes on the MSVC swap

TheMrMilchmann/setup-msvc-dev@v4.0.0 is API-compatible with the way we use ilammy/msvc-dev-cmd except for one input: it has no vsversion. We were passing vsversion: \"18.0\". That's safe to drop because the preceding step (Install Visual Studio Build Tools) installs only VS Build Tools 2026, so the action's default detection selects it.

arch: x64 is preserved.

Test plan

• CI runs on this PR exercise setup-build-environment (cpp-build job in _shared-build.yaml); confirm:
  • No node20 deprecation warnings
  • MSVC cl.exe is on PATH (the Get MSVC version step depends on it)
  • vcpkg restore + cache restore succeed
  • Build succeeds end-to-end

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions versions and build environment configuration to optimize CI/CD pipeline performance.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates GitHub Actions versions in the CI build environment setup: replaces the MSVC development environment action from ilammy/msvc-dev-cmd@v1 to TheMrMilchmann/setup-msvc-dev@v4.0.0 (removing explicit VS version specification), and bumps vcpkg runner and cache action versions.

Changes

Build Environment CI Dependencies

Layer / File(s)	Summary
MSVC Setup Migration .github/actions/setup-build-environment/action.yaml	MSVC dev environment setup action replaced from ilammy/msvc-dev-cmd@v1 to TheMrMilchmann/setup-msvc-dev@v4.0.0; explicit vsversion: "18.0" input removed, relying on default detection with arch: x64 only.
Dependency Version Bumps .github/actions/setup-build-environment/action.yaml	vcpkg runner upgraded from lukka/run-vcpkg@v11.5 to v11.6; build output cache action upgraded from actions/cache@v4 to v5.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• ci: remove vs2022 from PR checks #2269: Modifies the same setup-build-environment action with changes to Visual Studio toolchain setup.
• build: update to VS 2026 #1990: Modifies the same composite action file with overlapping MSVC setup and caching step edits.
• ci: cache with msvc key #1172: Updates MSVC setup and caching behavior in CI workflows.

Suggested reviewers

• doodlum

Poem

🐰 A workflow so spry, with actions that fly,
New MSVC dawns, no version to sigh,
vcpkg leaps higher, cache runs anew,
GitHub Actions dance—the setup shines through! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main purpose of the PR: bumping GitHub Actions to node24 to address deprecation warnings, which is confirmed by the PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 YAMLlint (1.38.0)

.github/actions/setup-build-environment/action.yaml

[Errno 2] No such file or directory: '.github/actions/setup-build-environment/action.yaml'

🔧 Checkov (3.2.525)

.github/actions/setup-build-environment/action.yaml

2026-05-03 09:09:50,582 [MainThread ] [ERROR] Template file not found: .github/actions/setup-build-environment/action.yaml
2026-05-03 09:09:50,587 [MainThread ] [ERROR] Template file not found: .github/actions/setup-build-environment/action.yaml
2026-05-03 09:09:50,628 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with .github/actions/setup-build-environment/action.yaml
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/pytho

... [truncated 9329 characters] ...

/setup-build-environment/action.yaml
2026-05-03 09:09:50,671 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: '.github/actions/setup-build-environment/action.yaml'

---

_{Review rate limit: 9/10 reviews remaining, refill in 6 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

No actionable suggestions for changed features.

[coderabbitai]

🧹 Nitpick comments (2)

.github/actions/setup-build-environment/action.yaml (2)

53-53: Pin these action refs to immutable commit SHAs instead of tags.

Tags like v4.0.0, v11.6, and v5 are mutable and can be reassigned. Using the resolved commit SHAs provides stronger supply-chain integrity:

• Line 53: TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c
• Line 91: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2
• Line 96: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/actions/setup-build-environment/action.yaml at line 53, Replace
mutable action tags with the provided immutable commit SHAs: change
TheMrMilchmann/setup-msvc-dev@v4.0.0 to
TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c, change
lukka/run-vcpkg@v11.6 (or whatever tag is used) to
lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2, and change
actions/cache@v5 (or current tag) to
actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae; update the three `uses:`
entries accordingly so they reference the exact SHA for supply-chain integrity.

---

49-53: Add explicit validation that VS2026 was selected, not just captured.

The TheMrMilchmann/setup-msvc-dev@v4.0.0 action (line 53) defaults to the latest Visual Studio instance when no vs-path input is provided. Although the prior step installs VS Build Tools 2026, GitHub runners typically have multiple pre-installed VS versions. The subsequent "Get MSVC version" step (lines 57–88) only extracts the version number; it does not validate that the expected version was selected. Add a fail-fast check after the MSVC setup to confirm VS2026 was activated, or alternatively, use the vs-path input if the installer outputs a known installation directory.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/actions/setup-build-environment/action.yaml around lines 49 - 53,
The workflow currently calls TheMrMilchmann/setup-msvc-dev@v4.0.0 but doesn't
verify that VS2026 was actually selected; update the job to perform a fail-fast
validation immediately after the setup step (the step labeled similar to "Get
MSVC version") by either passing an explicit vs-path input to
TheMrMilchmann/setup-msvc-dev@v4.0.0 (pointing to the known VS2026 install
directory) or by adding a validation step that queries the active cl.exe or
vswhere output (e.g., run "cl.exe /Bv" or use vswhere to get
installationVersion) and assert the returned version string contains "17.6" or
the known VS2026 identifier, and fail the job if it does not, so the workflow
cannot continue with the wrong Visual Studio selection.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/actions/setup-build-environment/action.yaml:
- Line 53: Replace mutable action tags with the provided immutable commit SHAs:
change TheMrMilchmann/setup-msvc-dev@v4.0.0 to
TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c, change
lukka/run-vcpkg@v11.6 (or whatever tag is used) to
lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2, and change
actions/cache@v5 (or current tag) to
actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae; update the three `uses:`
entries accordingly so they reference the exact SHA for supply-chain integrity.
- Around line 49-53: The workflow currently calls
TheMrMilchmann/setup-msvc-dev@v4.0.0 but doesn't verify that VS2026 was actually
selected; update the job to perform a fail-fast validation immediately after the
setup step (the step labeled similar to "Get MSVC version") by either passing an
explicit vs-path input to TheMrMilchmann/setup-msvc-dev@v4.0.0 (pointing to the
known VS2026 install directory) or by adding a validation step that queries the
active cl.exe or vswhere output (e.g., run "cl.exe /Bv" or use vswhere to get
installationVersion) and assert the returned version string contains "17.6" or
the known VS2026 identifier, and fail the job if it does not, so the workflow
cannot continue with the wrong Visual Studio selection.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a04d95e-ec91-43b2-aab1-3de852ad98e0

📥 Commits

Reviewing files that changed from the base of the PR and between ddbd630 and f2d5623.

📒 Files selected for processing (1)

• .github/actions/setup-build-environment/action.yaml

[github-actions]

✅ A pre-release build is available for this PR:
Download