ci: 升级 Actions 到 Node 24 运行时

- 将 checkout、setup-dotnet、setup-node 和 upload-artifact 升级到支持 Node 24 的版本。
- 将 CodeQL workflow 从 v3 升级到 v4，消除 CodeQL v3 弃用风险。
- 用校验 checksum 的 gitleaks Linux CLI 执行替代 gitleaks-action，避免继续依赖 Node 20 action。
- 将 anchore/sbom-action 固定到 v0.24.0，明确使用支持 Node 24 的版本。

Author: C4AL

.github/workflows/ci.yml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: 10.0.x
 

.github/workflows/codeql.yml

@@ -29,23 +29,23 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup .NET
         if: matrix.language == 'csharp'
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: 10.0.x
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Analyze
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/security.yml

@@ -22,27 +22,42 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
-      - name: Gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Install Gitleaks
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="8.30.1"
+          asset="gitleaks_${version}_linux_x64.tar.gz"
+          base_url="https://github.com/gitleaks/gitleaks/releases/download/v${version}"
+          tmp_dir="$(mktemp -d)"
+
+          curl --fail --location --retry 3 --retry-delay 2 --output "$tmp_dir/$asset" "$base_url/$asset"
+          curl --fail --location --retry 3 --retry-delay 2 --output "$tmp_dir/checksums.txt" "$base_url/gitleaks_${version}_checksums.txt"
+
+          checksum_line="$(grep "  ${asset}$" "$tmp_dir/checksums.txt")"
+          printf '%s\n' "$checksum_line" | (cd "$tmp_dir" && sha256sum --check --strict)
+          tar -xzf "$tmp_dir/$asset" -C "$tmp_dir" gitleaks
+          echo "$tmp_dir" >> "$GITHUB_PATH"
+
+      - name: Run Gitleaks
+        run: gitleaks detect --source . --redact --no-banner --config .gitleaks.toml
 
   secrets-and-sbom:
     name: secrets-and-sbom
     runs-on: windows-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: 10.0.x
 
@@ -56,14 +71,14 @@ jobs:
         run: dotnet dotnet-CycloneDX CodexCliPlus.sln -o artifacts/sbom -fn codexcliplus.cyclonedx.xml
 
       - name: Generate Syft SBOM
-        uses: anchore/sbom-action@v0
+        uses: anchore/sbom-action@v0.24.0
         with:
           path: .
           format: cyclonedx-json
           output-file: artifacts/sbom/codexcliplus.syft.cyclonedx.json
 
       - name: Upload SBOM artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sbom
           path: artifacts/sbom

.github/workflows/tooling.yml

@@ -18,15 +18,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: 10.0.x
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: npm