From 084bb6b20a03f2380c99986dbf1559bbec99c7d0 Mon Sep 17 00:00:00 2001
From: Petr <petr@keboola.com>
Date: Mon, 24 Aug 2026 00:14:53 +0200
Subject: [PATCH] chore(ci): bump artifact + release actions off the Node 20
 runtime
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The v0.90.0 release-kbagent.yml run annotated every gate / package-linux /
homebrew job with "actions target Node.js 20 but are being forced to run on
Node.js 24". Three actions were still on a node20 runtime.

Chosen majors are the first ones that actually declare `runs.using: node24`,
verified against each tag's action.yml rather than its release notes:

- actions/upload-artifact   v4 -> v7  (v5 is still node20; v6 was the switch)
- actions/download-artifact v4 -> v8  (v5 AND v6 are still node20; v7 switched)
- softprops/action-gh-release v2 -> v3

Breaking changes reviewed against actual usage:
- download-artifact v5 changed the output path for single-artifact-by-ID
  downloads; this repo downloads by pattern or whole-run, never by ID.
- download-artifact v8 makes a digest mismatch a hard error instead of a
  warning — the right default for a pipeline that signs and ships these bytes.
- upload-artifact v7 direct (unzipped) uploads only apply with `archive: false`,
  which is not used here.
- action-gh-release v3 keeps tag_name / files / prerelease unchanged.

Every remaining action in .github/ was audited and already runs on node24
(checkout v5, setup-node v6, setup-python v6, setup-uv v7,
configure-aws-credentials v6); cpina/...-push-to-another-repository is a
docker action and pypa/gh-action-pypi-publish is composite over node24 steps.

All GitHub-hosted runners, so the node24 minimum runner version (2.327.1) is
satisfied; no self-hosted fleet to update.
---
 .github/workflows/release-kbagent.yml | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release-kbagent.yml b/.github/workflows/release-kbagent.yml
index c6b90cbd..4b59d1c5 100644
--- a/.github/workflows/release-kbagent.yml
+++ b/.github/workflows/release-kbagent.yml
@@ -151,7 +151,10 @@ jobs:
           done
           if [ "$IS_PRERELEASE" = "true" ]; then args+=(--allow-missing); fi
           uv run python scripts/gen_release_notes.py "${args[@]}"
-      - uses: actions/upload-artifact@v4
+      # v6 is the first upload-artifact major whose runtime is Node 24 (v5 only
+      # carried "preliminary" Node 24 support and still declared `using: node20`),
+      # so a v4 -> v5 bump would keep emitting the Node 20 deprecation annotation.
+      - uses: actions/upload-artifact@v7
         with:
           name: release-notes
           path: release-notes.md
@@ -257,7 +260,7 @@ jobs:
         shell: bash
         run: bash build/package/zip_binary.sh "$PKG_NAME" "$VERSION" "${{ matrix.platform }}" "${{ matrix.arch }}" "$BIN_NAME"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: bin-${{ matrix.platform }}-${{ matrix.arch }}
           path: |
@@ -279,7 +282,11 @@ jobs:
           curl -fsSL "https://github.com/goreleaser/nfpm/releases/download/v2.41.1/nfpm_2.41.1_amd64.deb" -o /tmp/nfpm.deb
           echo "0a188f8bcf4ba4ba6414a514bc1f1d59f5cc92ba86160462d7aa7dab5930d327  /tmp/nfpm.deb" | sha256sum -c -
           sudo dpkg -i /tmp/nfpm.deb
-      - uses: actions/download-artifact@v4
+      # v7 is the first download-artifact major whose runtime is Node 24 (both v5
+      # and v6 still declare `using: node20`). v8 additionally turns a download
+      # digest mismatch into a hard failure instead of a warning — the right
+      # default for a release pipeline that signs and ships these bytes.
+      - uses: actions/download-artifact@v8
         with: { pattern: bin-linux-*, path: artifacts }
       - name: Write package signing keys
         env:
@@ -295,7 +302,7 @@ jobs:
           printf '%s' "$RPM_KEY_PRIVATE" > /tmp/keys/rpm.key && chmod 600 /tmp/keys/rpm.key
       - name: Build deb/rpm for each arch
         run: bash build/package/linux/build_packages.sh "$VERSION" artifacts
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with: { name: linux-packages, path: dist/* }
 
   # ── Create the GitHub Release with every binary + package attached (directly
@@ -312,14 +319,14 @@ jobs:
     env:
       VERSION: ${{ needs.version.outputs.VERSION }}
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with: { path: artifacts }
       - name: Collect release assets
         run: |
           mkdir -p release
           find artifacts -type f \( -name '*.zip' -o -name '*.sha256' -o -name '*.deb' -o -name '*.rpm' \) -exec cp {} release/ \;
           ls -al release/
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@v3
         with:
           tag_name: v${{ env.VERSION }}
           files: release/*
@@ -404,7 +411,7 @@ jobs:
       PUBLISH_PREFIX: ${{ needs.version.outputs.PUBLISH_PREFIX }}
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with: { path: artifacts }
       - uses: aws-actions/configure-aws-credentials@v6
         with:
@@ -441,7 +448,7 @@ jobs:
       VERSION: ${{ needs.version.outputs.VERSION }}
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with: { path: artifacts }
       - name: Render formula
         run: |