From 504563fd4a9d404a2ffab4b8999f2ff008011fd8 Mon Sep 17 00:00:00 2001
From: HarryR <303926+HarryR@users.noreply.github.com>
Date: Sun, 21 Jun 2026 20:43:13 +0000
Subject: [PATCH] ci: move all pinned actions off the deprecated Node 20
 runtime

GitHub force-runs Node 20 actions on Node 24 and warns. Bump every pinned
action to its latest Node 24 release, still SHA-pinned with accurate version
comments. node24 was not backported to the prior majors of the docker/* and
gh-release actions, so those are major bumps; the inputs this workflow uses
were verified to still exist in the new majors.

- actions/upload-artifact     v5.0.0  -> v7.0.1
- actions/download-artifact   v5.0.0  -> v8.0.1
- softprops/action-gh-release v2.4.2  -> v3.0.1
- docker/setup-buildx-action  v3.7.1  -> v4.1.0
- docker/login-action         v3.3.0  -> v4.2.0
- docker/metadata-action      v5.5.1  -> v6.1.0
- docker/build-push-action    v6.18.0 -> v7.2.0

checkout (v5.0.0) and attest-build-provenance (v3.0.0, composite) were already
node24. The docker/* and gh-release bumps run only in the tag-gated release
jobs, so they get exercised on the next stage0-v*/uki-v* tag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build.yml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 350e7f1..d570e4b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ jobs:
       # UKI (stage1) track: the netboot payload + its sha256 pin + the _stage1
       # snippet, plus busybox/stage1 for the stage1 runtime image.
       - name: Upload UKI artifacts for ${{ matrix.arch }}
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: uki-${{ matrix.arch }}
           path: |
@@ -47,7 +47,7 @@ jobs:
       # stage0 track: the firmware-admitted root + the public Secure Boot material
       # (efi-vars for enrollment, *.cer/*.guid) needed to deploy a cloud image.
       - name: Upload stage0 artifacts for ${{ matrix.arch }}
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: stage0-${{ matrix.arch }}
           path: |
@@ -87,7 +87,7 @@ jobs:
             stage0-aarch64.zip
 
       - name: Create stage0 release
-        uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2.4.2
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           tag_name: ${{ github.ref_name }}
           files: |
@@ -127,7 +127,7 @@ jobs:
             uki-aarch64.zip
 
       - name: Create UKI release
-        uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2.4.2
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           tag_name: ${{ github.ref_name }}
           files: |
@@ -155,22 +155,22 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Download x86_64 UKI artifacts
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: uki-x86_64
           path: tools/build-uki/x86_64
 
       - name: Download aarch64 UKI artifacts
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: uki-aarch64
           path: tools/build-uki/aarch64
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -178,7 +178,7 @@ jobs:
 
       - name: Extract metadata for Docker
         id: meta
-        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -188,7 +188,7 @@ jobs:
 
       - name: Build and push multi-arch Docker image
         id: push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile.runtime