Migrate GitHub Actions workflows off deprecated Node 20 runtimes

[arnabnandy7]

GitHub Actions workflows reference actions that declare the deprecated Node.js 20 runtime, including a nested dependency in Codecov v5. Update these dependencies to Node 24-compatible releases while preserving the existing Java 21 build, workflow triggers, permissions, and runner images.

GitHub currently schedules Node 20 removal from Actions runners for September 23, 2026: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Changes prepared locally

These changes are prepared in a local working tree; they have not been submitted as a pull request or merged.

File	Change
.github/workflows/maven-ci.yml	Upgrade checkout v4 → v5, setup-java v4 → v5, Sonar cache v4 → v5, and Codecov v5 → v7. Remove the redundant Maven cache step; setup-java already manages Maven caching.
.github/workflows/maven-pr-builder.yml	Upgrade checkout v4 → v5, setup-java v4 → v5, and Codecov v5 → v7. Remove the redundant Maven cache step.
.github/workflows/stale.yml	Upgrade stale v9 → v10.
.github/dependabot.yml	Add weekly github-actions updates alongside the existing weekly Maven updates.

The GitHub-maintained action upgrades use the smallest major-version changes that introduce Node 24. Codecov v7 incorporates the Node 24-compatible github-script dependency introduced in v6 and the updated uploader verification-key source introduced in v7.

Release references:

• https://github.com/actions/checkout/releases/tag/v5.0.0
• https://github.com/actions/setup-java/releases/tag/v5.0.0
• https://github.com/actions/cache/releases/tag/v5.0.0
• https://github.com/actions/stale/releases/tag/v10.0.0
• https://github.com/codecov/codecov-action/releases/tag/v6.0.0
• https://github.com/codecov/codecov-action/releases/tag/v7.0.0

Remaining dependency: Presubmit

.github/workflows/presubmit.yml uses presubmit/ai-reviewer@latest. Both that reference and the newest published release checked, v0.2.5, still declare runs.using: node20:
https://github.com/presubmit/ai-reviewer/blob/v0.2.5/action.yml

The prepared changes leave this workflow unchanged. An upstream Node 24-compatible release, or a separately tested replacement, is still needed to remove this remaining deprecated runtime declaration. Forcing a runtime override alone would not establish compatibility.

Validation performed

• actionlint 1.7.12 passed with external ShellCheck and Pyflakes integration disabled. The local ShellCheck shim was unavailable.
• YAML parsing and Dependabot configuration checks passed.
• Confirmed that updated action references resolve, their configured inputs are supported, and their declared runtimes—including Codecov's nested github-script action—use Node 24.
• Confirmed that workflow triggers, permissions, runner images, and shell commands match the original workflows.
• Confirmed that each Maven workflow retains setup-java's Maven cache.
• git diff --check passed.

GitHub-hosted workflow execution has not yet been tested. The Node 24 actions require Actions runner v2.327.1 or newer; the workflows use GitHub-hosted Ubuntu runners.

Completion criteria

• Submit and review the prepared workflow and Dependabot changes.
• Confirm the Java PR build and coverage upload on GitHub-hosted runners.
• Confirm the master build, Sonar analysis, coverage upload, and scheduled stale workflow after merge.
• Resolve Presubmit's remaining Node 20 runtime declaration with a verified compatible release or replacement.