ci: move the remaining workflows off the retired node20 action runtime (DEV-3113)

[demtario]

Context

GitHub retired the node20 action runtime (removal date 2026-09-23). PR #371 moves ci.yml, master.yml and e2e-o11y-local.yml to node24 actions. This PR does the same for the six remaining workflows: e2e-live, e2e-starter-matrix, examples-build, import-docs, import-starters and server-examples-build. The two PRs touch different files, so they don't conflict whichever merges first.

• Version bumps: the same first node24 majors feat(runner): self-hosted observability on Cloudflare (ADR-0041, ADR-0042) #371 uses: actions/checkout@v5, actions/setup-node@v5, actions/upload-artifact@v6, actions/download-artifact@v7, pnpm/action-setup@v5. download-artifact v5's breaking change only affects artifact-ids: downloads. These workflows download by name: or pattern:.
• package-manager-cache: false on four setup-node steps. setup-node v5 turns on package-manager caching by itself when the root package.json declares packageManager.
  • In import-starters (both jobs) pnpm only exists after corepack enable, so the step would fail with "Unable to locate executable file: pnpm".
  • In examples-build (build and the canary lane) nothing would fail. v5 would silently turn on the cache that the existing comment deliberately rules out: installs run under RUNNER_TEMP and would miss a workspace-resolved store without any signal.
  • The other setup-node steps already set cache: explicitly and are unaffected.
• peter-evans/create-pull-request v7.0.11 → v8.1.1 (not in the ticket's list). v7.0.11 is runs.using: node20, but actionlint can't resolve SHA pins, so it never flagged it. The pin stays a SHA because the job holds contents + PR write permissions. v8.x changes only the runtime, adds retries and bumps deps. All seven inputs used here (base, body, branch, commit-message, labels, reviewers, title) exist in v8.1.1's action.yml.
• Two # shellcheck disable=SC2086 directives. These fix the existing shellcheck notes on pnpm update $pkgs and npm install handsontable@latest $wrapper. Both rely on word splitting (a space-separated package list; a wrapper that is empty for vanilla), so quoting them would break the commands.

Types of changes

• New example
• Update to an existing example
• README / documentation change
• Demo runner (runner/) change
• CI / tooling change

How was this verified?

• Runtime of every action. For every remote uses: in the six files, runs.using was read from that action's own action.yml at the pinned ref through gh api. Before: checkout@v4, setup-node@v4, upload-artifact@v4, download-artifact@v4, pnpm/action-setup@v4 and create-pull-request@22a9089… were all node20. After: all six refs are node24.
• Lint, kjanat/actionlint 1.17.0. This is the build reviewdog/action-actionlint bundles. The ticket's "actionlint v1.7.10 or newer" is misleading: upstream rhysd actionlint 1.7.12 reports nothing about node20 on these files. kjanat 1.17.0 reported 29 runtime "node20" is deprecated errors plus the two SC2086 notes before this change, and exits 0 after it. rhysd 1.7.12 also exits 0.
• Cache scan. A scan for setup-node steps with neither cache: nor package-manager-cache: found the four sites above before this change. After it, the scan finds only ci.yml:52, the presence job that feat(runner): self-hosted observability on Cloudflare (ADR-0041, ADR-0042) #371 already fixes.
• CI on this PR. examples-build and server-examples-build run here because their own workflow files are in their pull_request.paths. e2e-starter-matrix, e2e-live, import-docs and import-starters aren't triggered by a PR. They either run against production or open generated-content PRs, so they get one workflow_dispatch run each (or their next scheduled run) and are ticked off on DEV-3113.

Checklist

• New/renamed example: added to runner/config/frameworks.json (see CONTRIBUTING.md); otherwise it won't appear on demos.handsontable.com
• New example: added a row to the tables in README.md
• Ran pnpm build (and pnpm dev) in the affected example/server-example locally

No example code changed, so none of the checklist items apply.

Related issue(s):

1. DEV-3113
2. feat(runner): self-hosted observability on Cloudflare (ADR-0041, ADR-0042) #371 (same bump for ci.yml, master.yml, e2e-o11y-local.yml)

---

Note

Low Risk
CI-only workflow and action version updates; behavioral changes are limited to explicit cache opt-outs and SHA-pinned PR automation still using the same inputs.

Overview
Moves six remaining GitHub workflows off the retired node20 action runtime (DEV-3113), complementing #371’s updates to ci.yml, master.yml, and e2e-o11y-local.yml.

Action bumps (aligned with #371): checkout@v5, pnpm/action-setup@v5, setup-node@v5, upload-artifact@v6, download-artifact@v7 across e2e-live, e2e-starter-matrix, examples-build, import-docs, import-starters, and server-examples-build. peter-evans/create-pull-request is pinned to v8.1.1 (node24) in the import publish jobs.

setup-node@v5 behavior: package-manager-cache: false is set where v5 would auto-enable pnpm caching from the root packageManager field—either because pnpm isn’t available yet (import-starters, before corepack enable) or because installs run under RUNNER_TEMP and a silent cache miss would defeat examples-build’s intentional no-cache design.

Minor shell fixes: # shellcheck disable=SC2086 on pnpm update $pkgs and npm install handsontable@latest $wrapper where word splitting is required.

^{Reviewed by Cursor Bugbot for commit 1ad8a8a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[qunabu]

Task linked: DEV-3113 Bump GitHub Actions off the retired node20 runtime in the remaining workflows