From 9fbaaf5ba6080ce839267122a29cabf4c9954984 Mon Sep 17 00:00:00 2001
From: Jay Welshofer <welshofer@gmail.com>
Date: Mon, 17 Aug 2026 15:22:56 -0700
Subject: [PATCH] Move CI off the Node 20 runtime before GitHub removes it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every run was annotating: `actions/checkout@v4` targets Node 20, which the
runners already force onto Node 24. `actions/deploy-pages@v4` is the same —
unflagged only because Docs runs on main alone. Both are one release away
from failing instead of warning.

checkout goes to v7 rather than the minimum v5 that clears the warning,
since all three call sites are bare `uses:` with no inputs and v7's one
behavioural change — blocking fork checkouts under `pull_request_target`
and `workflow_run` — applies to triggers this repo does not use.

upload-pages-artifact deliberately stays at v3, with a comment saying so.
It is a composite wrapping upload-artifact@v4, so it has no Node 20 problem
to solve, and its v4 stopped including dotfiles in the artifact. `site` is
produced by `docc process-archive transform-for-static-hosting`, so its
contents are not ours to vouch for — that is a silent breakage waiting on a
docs deploy nobody watches. Not worth taking for a bump we do not need.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/ci.yml   | 4 ++--
 .github/workflows/docs.yml | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 15c29f6b..571e5ad0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
     container:
       image: swift:${{ matrix.swift }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Oracle tests shell out to these; the pure-Swift suite passes without them.
       # fonts-dejavu-core feeds the real-font sanity oracle in FontMetricsTests.
       - name: Install oracle tools
@@ -80,7 +80,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: macos-26
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Swift version
         run: swift --version
       - name: Test Rostrum (Darwin XML branch)
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 7cd4737b..a5d1fb48 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -23,7 +23,7 @@ jobs:
   build:
     runs-on: macos-26
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Build DocC archive
         run: |
           xcodebuild docbuild -scheme Rostrum \
@@ -34,6 +34,11 @@ jobs:
           ARCHIVE=$(find .docc-build -name 'Rostrum.doccarchive' -print -quit)
           "$(xcrun --find docc)" process-archive transform-for-static-hosting \
             "$ARCHIVE" --output-path site --hosting-base-path rostrum
+      # Deliberately still v3. It is a composite action wrapping
+      # actions/upload-artifact@v4, so unlike checkout and deploy-pages it
+      # carries no Node 20 deprecation. v4 dropped dotfiles from the artifact
+      # — a silent change for a directory we do not fully control, since
+      # `transform-for-static-hosting` decides what lands in `site`.
       - uses: actions/upload-pages-artifact@v3
         with:
           path: site
@@ -45,4 +50,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5