Bump actions/checkout to v5 across devops, devops-security and incubator

Empieza localizando los usos indicados: las líneas de .github/workflows/add-update-label-weekly.yml, terraform-apply.yaml y terraform-plan.yaml en los tres repositorios, y después lee las notas de migración de github-script v7-to-v8. Actualiza únicamente los pins de acciones especificados, verifica el plan de incubator y el push-back de terraform-docs, y usa git grep para confirmar que no quedan pins antiguos de los indicados; ten en cuenta que devops no se puede ejecutar y que devops-security necesita un PR posterior que active Terraform para la verificación.

Overview

We need to move the remaining six actions/checkout pins in devops, devops-security and incubator to @v5, and devops's actions/github-script to @v8, because all of them target Node.js 20 — GitHub has deprecated it and is force-running these on Node 24 today, so the workflows break when that fallback is withdrawn.

This is one decision and one pass across three repos, so it is one issue and three small PRs for one assignee, following the pattern of #174. The bot repo's four pins are already covered by #182 and are not part of this.

Action Items

Applies to all three repos: bump to v5, not v6 or v7, even though v7 is current. v5 is the pure Node 24 bump with no behaviour change. v6 moved the persisted git credential into a separate file, which matters wherever a workflow pushes after checkout — incubator's terraform-docs job does exactly that. v7 additionally blocks fork checkouts for pull_request_target/workflow_run. Going fully current is a real upgrade needing a real test; keep it a separate decision.

hackforla/devops — 1 PR, 2 lines in .github/workflows/add-update-label-weekly.yml:

• Line 11: actions/checkout@v4 to @v5.
• Line 12: actions/github-script@v7 to @v8. v8 is the Node 24 bump (current is v9). Read the v7 to v8 migration notes before assuming it is a version bump: this step's script does require('./github-actions/trigger-schedule/add-update-label-weekly/add-label.js'), i.e. it loads a local CommonJS module, which is the part most likely to be affected.
• Expect not to be able to verify this one, and say so in the PR. The workflow is currently disabled_inactivity — GitHub disabled it for repository inactivity, the same failure that took the bot down in #180 — and its only trigger is schedule: (Sundays 07:00 UTC), with no workflow_dispatch, so it cannot be run manually either. gh api repos/hackforla/devops/actions/workflows/add-update-label-weekly.yml/runs returns total_count: 0.
• Do not re-enable it, add a workflow_dispatch trigger, or add a keepalive as part of this ticket. That is separate work of the same shape as #180 and needs its own decision about whether this automation should still run at all. Flag it in the PR and move on.

hackforla/devops-security — 1 PR, 2 lines:

• terraform-apply.yaml:23 and terraform-plan.yaml:23: actions/checkout@v4 to @v5.
• Both workflows filter on paths: '**/*.tf', so a PR that only edits .github/workflows/*.yaml will not trigger either of them and the PR will show no checks at all. That is expected, not a failure. To exercise the plan workflow in the same PR, include a no-op change to a .tf file (a comment line); otherwise leave it and verify after merge.
• After the PR merges, confirm the next PR that touches a .tf file runs Write Terraform Plan to Pull Request successfully with no "Node.js 20 is deprecated" annotation. terraform-apply.yaml only runs on push to main and performs a real apply, so it is verified by that same merge, not by anything on a branch.

hackforla/incubator — 1 PR, 3 lines:

• terraform-apply.yaml:31 and terraform-plan.yaml:31: actions/checkout@v4 to @v5.
• terraform-plan.yaml:55: actions/checkout@v3 to @v5 — this is the terraform-docs job and it is two major versions behind, the furthest behind anything in the org.
• Unlike devops-security, incubator's path filter includes **/*.yaml, so this PR triggers Terraform plan (OIDC) on itself. Both of its jobs should run on the PR — use that.
• Watch the terraform-docs job specifically. It checks out ref: ${{ github.event.pull_request.head.ref }} and runs terraform-docs/gh-actions with git-push: "true", pushing a commit back to the PR branch. It is the only job in any of these repos that writes to git after checkout, so it is the one place a checkout change could plausibly break something. Confirm the push-back still happens.
• Confirm the terraform-plan job still assumes arn:aws:iam::035866691871:role/incubator-tf-plan via OIDC and produces a plan.

All three:

• Do not touch third-party actions in this pass, even though several are further behind: aws-actions/configure-aws-credentials is on v1 in incubator's bastion.yml:34 and v3 in its two terraform workflows against v4 in devops-security, hmarr/debug-action@v1.0.0 has not been released against in years, and terraform-docs/gh-actions is pinned at v1.4.1. Each of those is a real upgrade rather than a version bump and deserves its own ticket.
• After all three PRs merge, re-run the sweep to confirm nothing was missed: git grep -n "uses: actions/" -- .github/workflows in each repo should show no checkout@v3, no checkout@v4, and no github-script@v7.

Resources/Instructions

• Line numbers were accurate 2026-08-24 and may drift — locate each pin by its uses: line rather than by position.
• The full inventory this ticket came from, for cross-checking: devops add-update-label-weekly.yml:11,12; devops-security terraform-apply.yaml:23, terraform-plan.yaml:23; incubator terraform-apply.yaml:31, terraform-plan.yaml:31,55.
• Release notes, for the version reasoning above: checkout v5.0.0, v6.0.0, v7.0.0; github-script v8.0.0. Both v5 and v8 require runner v2.327.1 or newer, which GitHub-hosted runners are well past.
• Related: #182, the same bump for the four pins in hackforla/check-ghpages-versions. Doing that one first is not required, but it is the lowest-risk of the set.
• Related: #180, for what happens when a scheduled workflow is left disabled — the devops workflow above is in that state now.