Bump actions/checkout to v5 across devops, devops-security and incubator

首先定位列出的使用位置：三个仓库中 .github/workflows/add-update-label-weekly.yml、terraform-apply.yaml 和 terraform-plan.yaml 里的相关行，然后阅读 github-script v7-to-v8 迁移说明。只更新指定的 action pin，验证 incubator 的 plan 和 terraform-docs 的 push-back，并使用 git grep 确认不再存在目标旧 pin；注意，devops 无法运行，而 devops-security 需要之后一个触发 Terraform 的 PR 才能进行验证。

Overview

We need to move the remaining six actions/checkout pins in devops, devops-security and incubator to @v5, and devops's actions/github-script to @v8, because all of them target Node.js 20 — GitHub has deprecated it and is force-running these on Node 24 today, so the workflows break when that fallback is withdrawn.

This is one decision and one pass across three repos, so it is one issue and three small PRs for one assignee, following the pattern of #174. The bot repo's four pins are already covered by #182 and are not part of this.

Action Items

Applies to all three repos: bump to v5, not v6 or v7, even though v7 is current. v5 is the pure Node 24 bump with no behaviour change. v6 moved the persisted git credential into a separate file, which matters wherever a workflow pushes after checkout — incubator's terraform-docs job does exactly that. v7 additionally blocks fork checkouts for pull_request_target/workflow_run. Going fully current is a real upgrade needing a real test; keep it a separate decision.

hackforla/devops — 1 PR, 2 lines in .github/workflows/add-update-label-weekly.yml:

• Line 11: actions/checkout@v4 to @v5.
• Line 12: actions/github-script@v7 to @v8. v8 is the Node 24 bump (current is v9). Read the v7 to v8 migration notes before assuming it is a version bump: this step's script does require('./github-actions/trigger-schedule/add-update-label-weekly/add-label.js'), i.e. it loads a local CommonJS module, which is the part most likely to be affected.
• Expect not to be able to verify this one, and say so in the PR. The workflow is currently disabled_inactivity — GitHub disabled it for repository inactivity, the same failure that took the bot down in #180 — and its only trigger is schedule: (Sundays 07:00 UTC), with no workflow_dispatch, so it cannot be run manually either. gh api repos/hackforla/devops/actions/workflows/add-update-label-weekly.yml/runs returns total_count: 0.
• Do not re-enable it, add a workflow_dispatch trigger, or add a keepalive as part of this ticket. That is separate work of the same shape as #180 and needs its own decision about whether this automation should still run at all. Flag it in the PR and move on.

hackforla/devops-security — 1 PR, 2 lines:

• terraform-apply.yaml:23 and terraform-plan.yaml:23: actions/checkout@v4 to @v5.
• Both workflows filter on paths: '**/*.tf', so a PR that only edits .github/workflows/*.yaml will not trigger either of them and the PR will show no checks at all. That is expected, not a failure. To exercise the plan workflow in the same PR, include a no-op change to a .tf file (a comment line); otherwise leave it and verify after merge.
• After the PR merges, confirm the next PR that touches a .tf file runs Write Terraform Plan to Pull Request successfully with no "Node.js 20 is deprecated" annotation. terraform-apply.yaml only runs on push to main and performs a real apply, so it is verified by that same merge, not by anything on a branch.

hackforla/incubator — 1 PR, 3 lines:

• terraform-apply.yaml:31 and terraform-plan.yaml:31: actions/checkout@v4 to @v5.
• terraform-plan.yaml:55: actions/checkout@v3 to @v5 — this is the terraform-docs job and it is two major versions behind, the furthest behind anything in the org.
• Unlike devops-security, incubator's path filter includes **/*.yaml, so this PR triggers Terraform plan (OIDC) on itself. Both of its jobs should run on the PR — use that.
• Watch the terraform-docs job specifically. It checks out ref: ${{ github.event.pull_request.head.ref }} and runs terraform-docs/gh-actions with git-push: "true", pushing a commit back to the PR branch. It is the only job in any of these repos that writes to git after checkout, so it is the one place a checkout change could plausibly break something. Confirm the push-back still happens.
• Confirm the terraform-plan job still assumes arn:aws:iam::035866691871:role/incubator-tf-plan via OIDC and produces a plan.

All three:

• Do not touch third-party actions in this pass, even though several are further behind: aws-actions/configure-aws-credentials is on v1 in incubator's bastion.yml:34 and v3 in its two terraform workflows against v4 in devops-security, hmarr/debug-action@v1.0.0 has not been released against in years, and terraform-docs/gh-actions is pinned at v1.4.1. Each of those is a real upgrade rather than a version bump and deserves its own ticket.
• After all three PRs merge, re-run the sweep to confirm nothing was missed: git grep -n "uses: actions/" -- .github/workflows in each repo should show no checkout@v3, no checkout@v4, and no github-script@v7.

Resources/Instructions

• Line numbers were accurate 2026-08-24 and may drift — locate each pin by its uses: line rather than by position.
• The full inventory this ticket came from, for cross-checking: devops add-update-label-weekly.yml:11,12; devops-security terraform-apply.yaml:23, terraform-plan.yaml:23; incubator terraform-apply.yaml:31, terraform-plan.yaml:31,55.
• Release notes, for the version reasoning above: checkout v5.0.0, v6.0.0, v7.0.0; github-script v8.0.0. Both v5 and v8 require runner v2.327.1 or newer, which GitHub-hosted runners are well past.
• Related: #182, the same bump for the four pins in hackforla/check-ghpages-versions. Doing that one first is not required, but it is the lowest-risk of the set.
• Related: #180, for what happens when a scheduled workflow is left disabled — the devops workflow above is in that state now.