ci: future-proof action versions + stop no-op .github redeploys

[cgoulart35]

Two bits of CI hygiene you asked for.

1. Future-proof action versions (Node 20 → 24)

All five CI actions are flagged for the 2026-06-16 Node 20 forced migration. Bumped to latest Node-24 majors:

action	from	to
actions/checkout	v4	v6
actions/setup-python	v5	v6
docker/setup-buildx-action	v3	v4
docker/login-action	v3	v4
docker/build-push-action	v6	v7

2. Skip redeploys for .github/-only pushes

Add ^\.github/ to the changes filter. Why it's safe (your concern): it only suppresses the build when every changed file is under .md/.claude//.github/ — all inert at runtime (baked in via COPY . . but never read by the app), exactly like the .md exclusion you already rely on. Any push that also touches real code (src, Dockerfiles, requirements, scripts, compose) still builds and deploys. No runtime-affecting change is ever suppressed.

Notes

• This PR won't redeploy on merge — it includes the new filter, which excludes its own .github/-only diff. Clean.
• Coverage: this PR's test/audit exercise the checkout/setup-python bumps directly. The docker-action bumps live in publish, which only runs on a real deploy — so they're first exercised on your next code-change merge (low risk: these majors are the official Node-24 releases). Rollback is a one-line revert.
• This PR will get a real Claude review (it doesn't touch claude-review.yml) — first non-throwaway run.

🤖 Generated with Claude Code

[claude]

Review: ci: future-proof action versions + stop no-op .github redeploys

Filter logic — correct and safe. The regex (\.md$|^\.claude/|^\.github/) anchors properly; mixed pushes (real code + .github/) still get code=true; the empty-diff edge case falls through to code=false as expected. The self-exclusion-on-merge behaviour described in the PR is accurate.

Action versions — actions/checkout@v6 is already in use in claude-review.yml in this repo, confirming it exists. The remaining bumps (setup-python@v6, docker actions) are consistent with the Node 24 migration but can't be independently verified here; per the PR notes they'll be exercised on the next real-code deploy (low blast radius, easily reverted).

Security — SHA pinning (pre-existing, good time to fix): every action uses a mutable version tag (@v4, @v6, etc.). If the tag is later moved to malicious code the next CI run is silently compromised. docker/login-action@v4 is the highest-risk instance — it receives GITHUB_TOKEN with packages: write, giving an attacker the ability to push poisoned images to GHCR and therefore the production Pi. Best practice is to pin to the full commit SHA with the version as a comment (docker/login-action@<sha> # v4). See inline comment.

Minor / pre-existing: the audit job has no needs: changes guard and runs on every push including docs-only ones. Not a regression here, but a cheap fix while the file is open.

[claude]

Review: ci: future-proof action versions + stop no-op .github redeploys

Clean CI hygiene PR. The action version bumps address the 2026-06-16 Node 20 forced migration and the .github/ filter extension is logically correct (the regex and fallback for first-push / non-push events both work). No runtime code is affected. One documentation inaccuracy flagged inline.