Update GitHub workflow versions

.github/actions/setup/action.yml

@@ -1,4 +1,5 @@
 name: Setup
+description: Install system deps, Foundry, Node.js, pnpm, and the workspace's dependencies.
 
 runs:
   using: composite
@@ -15,9 +16,9 @@ runs:
       shell: bash
       run: corepack enable
     - name: Install Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
-        node-version: 22
+        node-version: 24
         cache: 'pnpm'
     - name: Set up pnpm via Corepack
       shell: bash

.github/workflows/build-test.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: recursive
 
@@ -40,7 +40,7 @@ jobs:
 
       - name: Upload coverage reports
         if: steps.coverage_files.outputs.files != ''
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v6
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ${{ steps.coverage_files.outputs.files }}

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0 # Needed to get all history for comparing changes
 

.github/workflows/publish.yml

@@ -33,16 +33,11 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: recursive
       - name: Set up environment
         uses: ./.github/actions/setup
-      - name: Upgrade npm for OIDC trusted publishing
-        # pnpm publish delegates registry auth to the underlying npm CLI.
-        # OIDC trusted publishing requires npm >= 11.5.1; pinned to a known-good
-        # version for reproducibility — safe to bump as long as it stays >= 11.5.1.
-        run: npm install -g npm@11.13.0
       - name: Read package info
         id: pkg
         shell: bash

.github/workflows/require-audit-label.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: Get changed files
         id: changed
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const { data: files } = await github.rest.pulls.listFiles({

.github/workflows/verifydeployed.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           submodules: recursive
       - name: Set up environment
@@ -36,7 +36,7 @@ jobs:
           pnpm build
 
       - name: Save build artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v7
         with:
           name: contract-artifacts
           path: |
@@ -49,15 +49,15 @@ jobs:
     needs: build
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
       - name: Set up environment
         uses: ./.github/actions/setup
       - name: Build
         run: |
           pushd packages/contracts
           pnpm build || pnpm build
       - name: Get build artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v8
         with:
           name: contract-artifacts