ci: update Actions to supported Node 24 runtimes

.github/workflows/ci.yml

@@ -22,8 +22,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "26"
           cache: npm
@@ -51,8 +51,8 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "26"
           cache: npm

.github/workflows/release.yml

@@ -24,8 +24,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "26"
           cache: npm
@@ -57,7 +57,7 @@ jobs:
       # Preparing once avoids the publisher's list-miss/create race between OS jobs.
       - name: Create or reuse the tag's draft
         if: github.event_name == 'push'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const {owner, repo} = context.repo;
@@ -108,8 +108,8 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "26"
           cache: npm
@@ -170,7 +170,7 @@ jobs:
         if: github.event_name == 'workflow_dispatch' && runner.os != 'macOS'
         run: npx electron-builder ${{ matrix.builder_args }} --publish never
       - name: Save installers and update metadata
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: learnharness-${{ matrix.platform }}
           retention-days: 7
@@ -203,10 +203,10 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       # The tagged revision — verify exactly what was packaged, not a moving default.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "26"
           cache: npm

tests/desktop-platform.test.ts

@@ -114,6 +114,38 @@ describe("desktop packaging policy", () => {
 	});
 });
 
+describe("workflow action versions", () => {
+	type Step = { uses?: string; with?: Record<string, unknown> };
+	type Workflow = { jobs: Record<string, { steps: Step[] }> };
+	const yaml = require("js-yaml") as { load(source: string): Workflow };
+
+	for (const filename of ["ci.yml", "release.yml"]) {
+		it(`${filename} uses supported Action runtimes without changing the app's Node 26`, () => {
+			const workflow = yaml.load(readFileSync(new URL(`../.github/workflows/${filename}`, import.meta.url), "utf8"));
+			const expected = ["actions/checkout@v7", "actions/setup-node@v7"];
+			if (filename === "release.yml") {
+				expected.push("actions/github-script@v9", "actions/upload-artifact@v7", "maxim-lobanov/setup-xcode@v1");
+			}
+			const observed = new Set<string>();
+			for (const job of Object.values(workflow.jobs)) {
+				for (const step of job.steps) {
+					if (!step.uses) continue;
+					assert.ok(expected.includes(step.uses), `unexpected Action reference: ${step.uses}`);
+					observed.add(step.uses);
+					if (step.uses === "actions/setup-node@v7") {
+						assert.equal(step.with?.["node-version"], "26");
+						assert.equal(step.with?.cache, "npm");
+					}
+					if (step.uses === "actions/upload-artifact@v7") {
+						assert.equal(step.with?.archive ?? true, true, "multi-file installers remain zipped artifacts");
+					}
+				}
+			}
+			assert.deepEqual([...observed].sort(), expected.sort());
+		});
+	}
+});
+
 describe("desktop release workflow", () => {
 	type Step = {
 		if?: string; run?: string; uses?: string; env?: Record<string, string>;