ci: bump actions/* to Node-24 majors (clear the Node 20 deprecation warnings)

GitHub deprecated Node 20 on its runners (2025-09-19), so checkout@v4 /
setup-node@v4 / setup-python@v5 / upload-artifact@v4 / download-artifact@v4 were
all being force-run on Node 24 and emitting a deprecation annotation per job (~25
warnings). Bump each to its current Node-24 major, verified via the GitHub API
(runs.using == node24 and the inputs we use still present):
  checkout         v4 -> v7
  setup-node       v4 -> v6   (composite setup action)
  setup-python     v5 -> v6
  upload-artifact  v4 -> v7
  download-artifact v4 -> v8
Applied across ci.yml, release.yml, and .github/actions/setup. The third-party
actions (dtolnay, Swatinem, taiki-e, jlumbroso, docker/*) were not flagged --
already Node-24 / non-node.

Author: Cairn Build

.github/actions/setup/action.yml

@@ -15,7 +15,7 @@ runs:
   using: composite
   steps:
     - name: Set up Node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         # Vite 8 requires Node >= 20.19; 22 LTS gives headroom.
         node-version: "22"

.github/workflows/ci.yml

@@ -43,13 +43,13 @@ jobs:
     name: build cairn (shared binary)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup   # builds ui/dist (embedded into the binary) + toolchain + cache
       - run: cargo build --bin cairn
       # Conformance asserts behaviour, not Rust-level state, so it does not need debug symbols.
       # Stripping shrinks the artifact from ~260 MB to ~25 MB — far faster to upload once + download many.
       - run: strip target/debug/cairn
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cairn-bin
           path: target/debug/cairn
@@ -62,7 +62,7 @@ jobs:
     name: fmt + clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
         with:
           components: rustfmt, clippy
@@ -80,7 +80,7 @@ jobs:
           - x86_64-unknown-linux-gnu
           - x86_64-unknown-linux-musl
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install musl tools
         if: endsWith(matrix.target, 'musl')
         run: sudo apt-get update && sudo apt-get install -y musl-tools
@@ -105,7 +105,7 @@ jobs:
     name: test (all features)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Free disk space
         uses: jlumbroso/free-disk-space@main
         with:
@@ -123,13 +123,13 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - run: pip install boto3
@@ -141,13 +141,13 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       # botocore[crt] lets boto3 emit CRC32C + CRC64NVME so the harness exercises every algorithm.
@@ -160,13 +160,13 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - run: pip install boto3
@@ -178,13 +178,13 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - run: pip install boto3
@@ -196,13 +196,13 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - run: pip install boto3
@@ -214,13 +214,13 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - run: pip install boto3
@@ -232,8 +232,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
@@ -247,8 +247,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
@@ -261,9 +261,9 @@ jobs:
     name: fast-io sendfile conformance + keep-alive engagement
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - run: pip install boto3
@@ -287,13 +287,13 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - name: Add a key, re-wrap stored secrets onto it, retire the old key (sharded); assert the fail-closed retire-gate
@@ -304,8 +304,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
@@ -318,13 +318,13 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - name: Race N clients on one key (create / CAS / last-writer); assert atomic, no corruption
@@ -334,7 +334,7 @@ jobs:
     name: crash consistency (F-4)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
       # Self-builds `cairn --features failpoints` (the durability fault seams) — a different binary
       # from the shared artifact, so this job keeps its own compile (warmed by the shared cache).
@@ -346,9 +346,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       # Self-builds `cairn --features failpoints` (see crash_multipoint.sh) — keeps its own compile.
@@ -361,13 +361,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - run: pip install boto3
@@ -380,13 +380,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - run: pip install boto3
@@ -399,8 +399,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
@@ -419,13 +419,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cairn-bin
           path: target/debug
       - run: chmod +x target/debug/cairn
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - name: Out-of-space 507 on a constrained FS, huge-object round-trip, many objects paginated
@@ -435,7 +435,7 @@ jobs:
     name: fuzz smoke (decoder, xml, policy, compress, ids)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@nightly
       # Build cargo-fuzz with the default (stable) toolchain from rust-toolchain.toml — its deps
       # (rustix) don't compile on the very latest nightly. The fuzz RUN below then uses nightly via
@@ -458,15 +458,15 @@ jobs:
     name: benchmarks compile
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
       - run: cargo bench --workspace --no-run
 
   coverage:
     name: coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Free disk space
         uses: jlumbroso/free-disk-space@main
         with:
@@ -477,7 +477,7 @@ jobs:
           components: llvm-tools-preview
       - uses: taiki-e/install-action@cargo-llvm-cov
       - run: cargo llvm-cov --workspace --lcov --output-path lcov.info
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: coverage
           path: lcov.info

.github/workflows/release.yml

@@ -50,7 +50,7 @@ jobs:
           - { arch: amd64, target: x86_64-unknown-linux-musl }
           - { arch: arm64, target: aarch64-unknown-linux-musl }
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup   # builds the real UI bundle + the Rust toolchain
         with:
           targets: ${{ matrix.target }}
@@ -64,7 +64,7 @@ jobs:
           cp "target/${{ matrix.target }}/release/cairn" "dist/cairn-linux-${{ matrix.arch }}"
           file "dist/cairn-linux-${{ matrix.arch }}" | grep -qiE "statically linked|static-pie linked" \
             || { echo "binary is not statically linked"; exit 1; }
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cairn-${{ matrix.arch }}
           path: dist/cairn-linux-${{ matrix.arch }}
@@ -74,7 +74,7 @@ jobs:
     needs: binaries
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: cairn-*
           path: artifacts
@@ -116,7 +116,7 @@ jobs:
     needs: [binaries, image]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: cairn-*
           path: artifacts