ci: add the v1 release workflow, move to Node 24, refresh dependencies

Three things the v1 line needs before it can ship.

**The v1 release workflow.** `changeset publish` tags `latest` by default,
even when publishing a lower version number — so once v2 is out, releasing
v1 through the existing workflow would silently move `latest` backwards and
every fresh `npm install @headstartwp/core` would resolve to v1. Adds
release-v1.yml, triggered by pushes to the `v1` branch, publishing via a new
`publish:v1` script that passes `--tag latest-v1`. Consumers pin the line
with `@headstartwp/core@latest-v1`.

It deliberately has no plugin-release job: the WordPress plugin is published
from trunk and develop, and pushing it from here would race those branches
for the same destination repository.

**Node 24 baseline.** .nvmrc and the root `engines` move to 24, and every
workflow moves to it — unit-tests was still running a [16.x, 18.x, 20.x]
matrix, which is two EOL releases and one about to be. Note this is the
monorepo root, which governs contributors and CI; it is not a published
package, so it does not change what consumers must run. The v1 packages
deliberately keep no `engines` field, because raising the floor in a minor
would strand exactly the pages-router users this line exists to support.

**Dependency refresh.** No minor has shipped in about four months, so
`npm update` was four months stale: 33 in-range updates applied, now down to
2. Deliberately in-range only — the 37 major-version jumps behind (storybook
8 -> 10, commitlint 13 -> 21, the @wordpress/* line, jest 29 -> 30) are a
separate modernisation effort and would put the "still supports the pages
router" guarantee at risk in a release whose whole point is stability.

One blocker had to be cleared first: `npm update` failed with ERESOLVE
because block-primitives pinned @testing-library/react ^14 while core and
next were on ^16. Aligned to ^16.3.0, which is the same split PR #951 fixed
on the v2 line.

Verified: core 46/46 suites / 247 tests, next 28/28 / 113 tests,
block-primitives 2/2, core and next build and lint clean.

Author: pdavies88

.github/workflows/build-test.yml

@@ -13,12 +13,12 @@ jobs:
       max-parallel: 1
       matrix:
         os: [ubuntu-latest, windows-latest]
-        node-version: [18, 20, 22]
+        node-version: [24]
         exclude:
           - os: windows-latest
-            node-version: 18
+            node-version: 24
           - os: windows-latest
-            node-version: 20   
+            node-version: 24   
 
     steps:
       - name: Configure Git line endings

.github/workflows/deploy-docs.yml

@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
       - name: Install dependencies
         run: npm install

.github/workflows/eslint.yml

@@ -11,7 +11,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [20.x]
+        node-version: [24.x]
 
     steps:
       - name: Checkout

.github/workflows/nextjs_bundle_analysis-app-router.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Set up node
         uses: actions/setup-node@v3
         with:
-          node-version: '20.x'
+          node-version: '24.x'
 
       - name: Install dependencies
         run: (cd ../../ && npm ci)

.github/workflows/nextjs_bundle_analysis.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Set up node
         uses: actions/setup-node@v3
         with:
-          node-version: '20.x'
+          node-version: '24.x'
 
       - name: Install dependencies
         uses: bahmutov/npm-install@v1

.github/workflows/npm-release-next-version.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v3
         with:
-          node-version: 20.x
+          node-version: 24.x
 
       - name: Install Dependencies
         run: npm ci

.github/workflows/release-latest-version.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v3
         with:
-          node-version: 20.x
+          node-version: 24.x
 
       - name: Install Dependencies
         run: npm ci

.github/workflows/release-v1.yml

@@ -0,0 +1,62 @@
+name: Release @latest-v1
+
+# Releases the maintenance line for consumers who are staying on the Next.js pages router.
+#
+# The reason this workflow exists at all: `changeset publish` tags `latest` by default, even when
+# publishing a *lower* version number. Once v2 is out, a v1 release from the default workflow would
+# silently move the `latest` dist-tag backwards, and every fresh `npm install @headstartwp/core`
+# would resolve to v1. This publishes under `latest-v1` instead, so the two lines coexist.
+#
+# Consumers pin the v1 line with:
+#   npm install @headstartwp/core@latest-v1
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  push:
+    branches:
+      - v1
+  workflow_dispatch:
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  packages:
+    name: Release
+    runs-on: ubuntu-latest
+    # Belt and braces: the trigger already restricts this, but a mis-fired workflow_dispatch on
+    # another ref must not publish from it.
+    if: github.ref == 'refs/heads/v1'
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          # changesets needs the full history to work out what to release.
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.x
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Create Release Pull Request or Publish to npm
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          # `publish:v1` differs from `publish` only in passing `--tag latest-v1`.
+          publish: npm run publish:v1
+          version: npm run version
+          title: 'Release v1 (@latest-v1)'
+          commit: 'chore: version packages (v1)'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+# Deliberately no `plugin-release` job. The WordPress plugin is published from trunk and develop
+# only; the v1 line ships npm packages, and pushing the plugin from here would race those branches
+# for the same target repository.

.github/workflows/unit-tests.yml

@@ -11,7 +11,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [16.x, 18.x, 20.x]
+        node-version: [24.x]
 
     steps:
       - name: Checkout

.nvmrc

@@ -1 +1 @@
-20
+24