fix: target node20 so GHES 3.16 runners can load the action

[bpmct]

GHES 3.16 runners reject using: node24 at job setup:

'using: node24' is not supported, use 'docker', 'node12', 'node16' or 'node20' instead

The action fails before it reads any input. The GHES fix from v0.3.1 never runs there.

Changes

• action.yaml now declares using: node20.
• githubURLRegex() now uses a local escape helper. RegExp.escape needs Node 24 and was the only Node 24 API in the bundle.
• Rebuilt dist. Updated stale Node 24 references.
• Added a "Node runtime" section to the README.

Why node20 is safe

Node 20 is EOL since April 2026, but that does not break this action. Since June 16, 2026, runners run node20 actions on Node 24 automatically, and GitHub removes the Node 20 binary from runners on September 23, 2026. Per the GitHub changelog:

Beginning on June 16th, 2026, runners will begin using Node24 by default.

The opt-out env var works "only until we upgrade the runner and remove Node20 on September 23rd, 2026."

The runner source confirms this applies to actions that explicitly declare node20. HandlerFactory.cs checks "if node20 was explicitly specified in the action" and replaces the declared version with the result of NodeUtil.DetermineActionsNodeVersion, which returns node24 in phase 2 ("Node 24 is the default") unless the opt-out is set, and always returns node24 in phase 3 ("Always use Node 24 regardless of environment variables"). The same file rewrites node12 and node16 actions to node20 unconditionally, so this is the established migration path. Old GHES runners still run them on Node 20. The code avoids APIs newer than Node 20, so it works on both.

Other actions do the same. actions/create-github-app-token kept v2 on node20 after node24 broke GHES (actions/create-github-app-token#274). actions/checkout@v4 and actions/github-script@v7 still declare node20. Their node24 versions are new majors that require runner v2.327.1+.

Verification

• All 208 tests pass.
• dist/index.js contains no RegExp.escape.
• The bundle runs under Node 22, which also lacks RegExp.escape.

After merge, cut v0.3.2 so GHES users can bump their pinned tag.

🤖 Created with Coder Agents on behalf of @bpmct