chore: bump GitHub Actions to Node.js 24-compatible versions

- actions/checkout v4 → v6
- actions/upload-artifact v4 → v7
- actions/download-artifact v4 → v8
- docker/build-push-action v6 → v7
- docker/setup-buildx-action v3 → v4
- docker/login-action v3 → v4
- sigstore/cosign-installer v3 → v4
- dprint/check v2.2 → v2.3

Node.js 20 will be deprecated June 2nd, 2026.
mozilla-actions/sccache-action v0.0.9 has no newer release yet.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: mikkeldamsgaard

.github/workflows/auto-tag.yml

@@ -16,7 +16,7 @@ jobs:
             echo "::error::RELEASE_TOKEN secret is not configured. Tags pushed with the default GITHUB_TOKEN cannot trigger the Release workflow."
             exit 1
           fi
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_TOKEN }}

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
@@ -20,12 +20,12 @@ jobs:
   dprint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dprint/check@v2.2
+      - uses: actions/checkout@v6
+      - uses: dprint/check@v2.3
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --all
@@ -40,7 +40,7 @@ jobs:
           - target: aarch64-unknown-linux-musl
             arch: arm64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
@@ -52,14 +52,14 @@ jobs:
         env:
           SCCACHE_GHA_ENABLED: "true"
           RUSTC_WRAPPER: sccache
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: initium-${{ matrix.arch }}
           path: target/${{ matrix.target }}/release/initium
   helm-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: azure/setup-helm@v4
       - run: helm plugin install --verify=false https://github.com/helm-unittest/helm-unittest.git --version v0.5.1
       - run: helm lint charts/initium

.github/workflows/integration.yml

@@ -48,7 +48,7 @@ jobs:
           --health-timeout 5s
           --health-retries 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Run integration tests

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --all
@@ -33,7 +33,7 @@ jobs:
           - target: aarch64-unknown-linux-musl
             arch: arm64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
@@ -45,21 +45,21 @@ jobs:
         env:
           SCCACHE_GHA_ENABLED: "true"
           RUSTC_WRAPPER: sccache
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: initium-${{ matrix.arch }}
           path: target/${{ matrix.target }}/release/initium
   docker:
     runs-on: ubuntu-latest
     needs: [test, build]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v8
         with:
           name: initium-amd64
           path: bin/
       - run: mv bin/initium bin/initium-amd64 && chmod +x bin/initium-amd64
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: initium-arm64
           path: bin/
@@ -69,10 +69,10 @@ jobs:
           file bin/initium-amd64 bin/initium-arm64
           echo "amd64 size: $(du -h bin/initium-amd64 | cut -f1)"
           echo "arm64 size: $(du -h bin/initium-arm64 | cut -f1)"
-      - uses: sigstore/cosign-installer@v3
+      - uses: sigstore/cosign-installer@v4
         if: env.DRY_RUN == 'false'
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         if: env.DRY_RUN == 'false'
         with:
           registry: ghcr.io
@@ -87,7 +87,7 @@ jobs:
             echo "VERSION=dry-run-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
           fi
       - name: Build initium image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         id: build-main
         with:
           context: .
@@ -108,7 +108,7 @@ jobs:
             --predicate <(docker buildx imagetools inspect ghcr.io/kitstream/initium@${{ steps.build-main.outputs.digest }} --format '{{json (index .SBOM "linux/amd64").SPDX}}') \
             ghcr.io/kitstream/initium@${{ steps.build-main.outputs.digest }}
       - name: Build initium-jyq image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         id: build-jyq
         with:
           context: .
@@ -134,7 +134,7 @@ jobs:
     needs: [docker]
     if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry-run == true) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
       - name: Publish to crates.io
         run: |