Eliminate deprecated Node action runtimes from public workflows (#258)

Author: durable-workflow-ops

.github/workflows/docs.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Build site
         run: mkdocs build --strict
 
-      - uses: actions/upload-pages-artifact@v4
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
 
@@ -48,4 +48,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/public-boundary.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

.github/workflows/publish.yml

@@ -163,7 +163,7 @@ jobs:
 
       - name: Upload docs release audit evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: docs-release-audit-evidence
           path: |

.github/workflows/release-plan-recovery.yml

@@ -98,7 +98,7 @@ jobs:
 
       - name: Retain recovery evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sdk-python-release-recovery-${{ steps.recovery.outputs.plan || github.run_id }}
           path: |

scripts/ci/component-release-recovery.py

@@ -46,7 +46,7 @@
 # CRLF line endings to LF before hashing. Exact source identity is the bounded
 # security contract because arbitrary shell execution cannot be proven safe by
 # source-pattern matching.
-SDK_RUST_RELEASE_RECOVERY_SHA256 = "8938ed8a7b029c492c08b3243c649adbed013ac3cd3dec57f9e23f396e46d079"
+SDK_RUST_RELEASE_RECOVERY_SHA256 = "d04219e3ffcc1c12a7a223efc832abee56c371b9dc60a7ef5a44a156b2ab4f64"
 
 
 @dataclass(frozen=True)

scripts/ci/sdk-rust-release-plan-recovery.fixture.yml

@@ -58,7 +58,7 @@ jobs:
 
       - name: Retain recovery evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sdk-rust-release-recovery-${{ steps.recovery.outputs.plan || github.run_id }}
           path: |
@@ -83,7 +83,7 @@ jobs:
           ssh-key: ${{ secrets.RELEASE_PLAN_DEPLOY_KEY }}
 
       - name: Restore the immutable release plan
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: sdk-rust-release-recovery-${{ needs.discover.outputs.plan }}
           path: recovery-input
@@ -155,7 +155,7 @@ jobs:
 
       - name: Retain publication evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sdk-rust-release-publication-${{ needs.discover.outputs.plan }}
           path: |

tests/test_release_docs_audit_workflow.py

@@ -83,7 +83,7 @@ def test_publish_workflow_separates_publication_authority_from_docs_freshness()
     assert "contents: write" not in docs_audit_job
     assert "if: always()" in docs_audit_job
     assert docs_audit_job.index("scripts/ci/check-docs-release-audit.sh") < docs_audit_job.index(
-        "actions/upload-artifact@v4"
+        "actions/upload-artifact@v7"
     )