ci: Node.js 24 majors for this repo's own workflow actions

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
       roku: ${{ steps.filter.outputs.roku }}
       desktop: ${{ steps.filter.outputs.desktop }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # The diff below needs both ends of the range in this checkout, and
           # the default shallow clone has neither.
@@ -102,7 +102,7 @@ jobs:
     name: one version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: node scripts/version.mjs check
 
   # Also unconditional, and for the same reason as `version`: the numbers it
@@ -112,7 +112,7 @@ jobs:
     name: repo scripts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Unit tests for scripts/
         run: node --test scripts/*.test.mjs
       - name: Documented counts match the code
@@ -132,7 +132,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # The tags and the whole of develop's history since the last one.
           fetch-depth: 0

.github/workflows/collector.yml

@@ -49,9 +49,9 @@ jobs:
             node: "24"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: npm

.github/workflows/desktop.yml

@@ -12,10 +12,11 @@ jobs:
     name: cargo check
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "22.13"
+          package-manager-cache: false
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
@@ -40,10 +41,11 @@ jobs:
     name: launch smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "22.13"
+          package-manager-cache: false
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
@@ -85,7 +87,7 @@ jobs:
             echo "== $f"; tail -80 "$f"
           done
       - if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: desktop-launch-smoke
           path: ${{ runner.temp }}/desktop-smoke

.github/workflows/docs.yml

@@ -29,9 +29,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -83,9 +83,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
+          include-hidden-files: true
 
   deploy:
     # Only main publishes; a pull request builds and link-checks without
@@ -101,4 +102,4 @@ jobs:
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
       - id: deploy
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/fleet.yml

@@ -25,9 +25,9 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "22.13"
           cache: npm
@@ -105,8 +105,8 @@ jobs:
           - runner: ubuntu-24.04-arm
             suffix: " (arm64)"
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "22.13"
           cache: npm
@@ -151,8 +151,8 @@ jobs:
     name: systemd smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "22.13"
           cache: npm
@@ -197,8 +197,8 @@ jobs:
     name: launchd smoke
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "22.13"
           cache: npm
@@ -272,8 +272,8 @@ jobs:
     name: windows task smoke
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "22.13"
           cache: npm

.github/workflows/release.yml

@@ -59,7 +59,7 @@ jobs:
       version: ${{ steps.check.outputs.version }}
       prerelease: ${{ steps.check.outputs.prerelease }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - id: check
         name: The tag, VERSION and every component agree
@@ -101,9 +101,9 @@ jobs:
     needs: gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           # The floor the collector needs, not the newest available: building on
           # the oldest supported runtime is what stops a release quietly
@@ -205,7 +205,7 @@ jobs:
           (cd out && sha256sum fleet-* > SHASUMS256.txt)
           cat out/SHASUMS256.txt
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-archives
           path: out/
@@ -221,7 +221,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # QEMU so one x86 runner can produce the arm64 image as well. It is slow
       # in general and cheap here: the Dockerfile compiles nothing, so the only
@@ -232,12 +232,12 @@ jobs:
       # faster and is what to reach for if this ever becomes slow enough to
       # notice. It is not done, because it is three more jobs to get right for a
       # build that has never run once.
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
 
       # GITHUB_TOKEN, with the `packages: write` granted above. No invented
       # secret: this token exists in every workflow run.
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -277,7 +277,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           # The repository root, because the build stage copies collector/,
           # runner-machine/ and fleet/ -- the bundle is all three.
@@ -301,9 +301,9 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: release-archives
           path: out

.github/workflows/runner-android.yml

@@ -17,14 +17,14 @@ jobs:
       # Deliberately without submodules. -Pfleet.skipNative drops the native
       # build, so llama.cpp is never compiled here and cloning it would cost
       # more than the tests do.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
 
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@v5
         with:
           build-root-directory: runner-android
 

.github/workflows/runner-ios.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: macos-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - run: brew install xcodegen
 

.github/workflows/runner-machine.yml

@@ -47,9 +47,9 @@ jobs:
             node: "24"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: npm

.github/workflows/runner-roku.yml

@@ -15,10 +15,11 @@ jobs:
       run:
         working-directory: runner-roku
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "22.13"
+          package-manager-cache: false
       # Pinned, so a new compiler release that adds a diagnostic is a change
       # somebody makes on purpose rather than a red build on an unrelated PR.
       - run: >