[Mikola Lysenko (mikolalysenko)]

Fixes #1588.

Problem

#1588 tracks pinned actions that target the deprecated Node.js 20 runtime. Every workflow except one has since moved to Node 24 releases. release.yml still pins:

• actions/upload-artifact@ea165f8… # v4 (2 uses, build job)
• actions/download-artifact@d3f86a1… # v4 (1 use, github-release job)

GitHub forces these onto Node 24 for now. When it drops Node 20 action support, the release build and github-release jobs break at publish time. Release is the only workflow no PR or merge_group run exercises, so we'd find out mid-release (last run: 2026-10-13).

Fix

Pin the releases every other workflow already uses, at the same SHAs:

action	before	after	already used in
upload-artifact	ea165f8 v4	b7c566a v6.0.0	3 steps in ci.yml and compat workflows
download-artifact	d3f86a1 v4	37930b1 v7.0.0	19 steps

Breaking changes I checked:

• download-artifact v5+ changed the extraction path only when downloading by artifact ID. This step downloads every artifact of the run with path + merge-multiple: true, which ci.yml already does with v7.0.0 (lines 909, 2326).
• upload-artifact v6 needs a v4+ downloader. After this PR every downloader in the repo is v7.

Proof

• I checked the SHAs against the upstream tags with git ls-remote: refs/tags/v6.0.0 = b7c566a…, refs/tags/v7.0.0 = 37930b1….
• After this PR, no workflow pins ea165f8 or d3f86a1.
• The YAML parses. Pin check still passes: every uses: is a 40-char SHA.
• No tests move or are removed.

Owner note: the release dry-run path (workflow_dispatch with dry-run: true) builds and uploads artifacts, so a dry run after merge would exercise the new upload pin end to end.

https://claude.ai/code/session_011f9aeR1h6tkiHFXbvuNbrv

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 20ecb62. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at head 20ecb62fce038485b2c317cef3bf18895417aa5b.

• CI: 51/51 checks settled green (32 success, 19 skipped). No main-wide failures.
• Bugbot: reviewed this head, no findings.
• Mergeable, no conflicts; CHANGELOG.md untouched.
• Reviewer note: release.yml only runs at release time, so no PR run exercises these pins. A workflow_dispatch dry run after merge would exercise the new upload pin end to end.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. release.yml was the last workflow still pinning actions/upload-artifact v4 and actions/download-artifact v4, which run on Node 20. This PR moves those three steps to the pins every other workflow already uses: upload v6.0.0 and download v7.0.0. Fixes #1588.

Risk: low. It changes three action pins and nothing else. The new SHAs are the ones ci.yml and the compat workflows already run. The one gap: no PR or merge_group run exercises release.yml, so CI does not test these steps.

Look here

• release.yml:199 and :206: upload pins (tar.gz and zip)
• release.yml:254: download with path + merge-multiple: true. v5+ changed extraction paths only for by-ID downloads, so this pattern is unaffected. ci.yml already uses it with v7.0.0.

Verified

• git ls-remote: upload-artifact refs/tags/v6.0.0 = b7c566a…, download-artifact refs/tags/v7.0.0 = 37930b1…. Both match the PR.
• No workflow on the head still pins ea165f8 or d3f86a1. Upload v6 and download v7 are both v4+ artifact backends, so they're compatible.
• Diff is 1 file, 3 lines. CHANGELOG.md untouched. No unresolved threads.
• CI 51/51 settled (32 success, 19 path-skipped). ci-ok and clippy green. Bugbot: no findings on 20ecb62.

Changes I made: none.

Open questions: none. Optional: after merge, run the release dry run (workflow_dispatch, dry-run: true) to exercise the new upload pin end to end.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final reviewer: auto-merge request was armed and the PR approved, green and clean, but GitHub had not enqueued it. Re-armed auto-merge (disable + enable); it entered the merge queue at 20:49Z.

---

Generated by Claude Code