ci: full Node-20 sweep — bump 14 remaining workflows ahead of 2026-09-16

Closes the "13 other workflows need a separate sweep" caveat from
the 892cf3f release.yml row in DECISION_LOG. Single bundled commit
bumps every Node-20-era action pin across the project so the
2026-09-16 GitHub deprecation deadline cannot strand a workflow.

Per-action bumps (all workflows except release.yml, which closed in 892cf3f):

  actions/checkout@v4         → @v6   (14 workflows)
  actions/setup-python@v5     → @v6   (5 workflows)
  actions/setup-node@v4       → @v6   (4 workflows)
  actions/upload-artifact@v4  → @v7   (10 workflows)

Plus docs.yml-only Pages bumps:

  actions/configure-pages@v5         → @v6
  actions/upload-pages-artifact@v3   → @v5
  actions/deploy-pages@v4            → @v5

Verified safe via official release-note reads:

  - checkout v5+v6: only breaking change is Node 24 runtime + runner
    v2.327.1+ requirement (GitHub-hosted satisfies). v6's $RUNNER_TEMP
    credential change only affects Docker container actions; we don't
    use them.
  - setup-python v6: sole breaking change is Node 24. Our `python-
    version:` usage unaffected.
  - setup-node v5+v6: v5 introduced package.json-driven auto-cache
    BUT moot for us — all 4 callers already set explicit
    `cache: "npm"`. v6 narrows auto-caching to npm only (also moot).
  - upload-artifact v5+v6: pure Node 24 bumps. v7 adds opt-in
    `archive: false` for unzipped uploads + internal ESM migration.
    Default zip-upload behavior preserved; all 10 callers use
    stable `name:`/`path:`/`retention-days:` patterns.
  - Pages actions: GitHub-internal Pages publishing path. Bumped to
    versions confirmed on Node 24 via repos/actions/configure-pages
    /contents/action.yml inspection.

Intentionally NOT bumped:

  - sigstore/cosign-installer@v3 (release.yml) — signing-critical,
    requires Sigstore §8 re-verification on a fresh throwaway tag.
    Carve-out documented in the 892cf3f release.yml row of
    DECISION_LOG; future bump procedure encoded inline.
  - splunk/appinspect-api-action@v3.0.5 (appinspect-api.yml) —
    external Splunk-published action with its own cadence, NOT in
    scope for the Node 20 deprecation track.
  - github/codeql-action/* (codeql.yml, scorecard.yml) — separate
    publish cadence; CodeQL ships its own runtime independent of
    actions/* Node versions.
  - ossf/scorecard-action@v2.4.0 (scorecard.yml), gitleaks/
    gitleaks-action@v2 (secret-scan.yml), zaproxy/action-baseline@
    v0.14.0 (zap-baseline.yml) — third-party actions, not part of
    actions/* org.

The historical comment at appinspect.yml:55 referencing
`actions/setup-python@v5` is intentionally preserved (it documents
a 2026-05-18 finding when v5 was current; the cache-key behavior
applies to v6 too, but the historical attribution shouldn't be
re-anchored).

All 16 workflow files parse clean as UTF-8 YAML. doc-drift OK
against build 663. DECISION_LOG entry 2026-05-20 row 2 records
the bundled-sweep tradeoff in full.

Author: RelativisticJet

.github/workflows/a11y-audit.yml

@@ -40,10 +40,10 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "npm"
@@ -87,7 +87,7 @@ jobs:
         # forms a longitudinal record. Reviewing the trend across
         # runs is more useful than just the latest run.
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: a11y-reports-${{ github.run_id }}
           path: tests/a11y/reports/
@@ -104,7 +104,7 @@ jobs:
 
       - name: Upload Splunk logs on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: a11y-splunk-logs-${{ github.run_id }}
           path: ci-logs/

.github/workflows/appinspect-api.yml

@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build .spl
         run: bash scripts/package.sh

.github/workflows/appinspect.yml

@@ -50,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # `cache: pip` was removed 2026-05-18 — actions/setup-python@v5
       # requires `requirements.txt` or `pyproject.toml` to compute the
@@ -61,7 +61,7 @@ jobs:
       # restore the cache, but with a single one-line install of a pinned
       # package the cache hit is worthless. Keep simple.
       - name: Set up Python 3.11
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
@@ -159,7 +159,7 @@ jobs:
 
       - name: Upload AppInspect JSON reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: appinspect-reports
           path: .planning/appinspect/appinspect-*-ci.json

.github/workflows/ci.yml

@@ -53,10 +53,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 
@@ -67,7 +67,7 @@ jobs:
         run: bash scripts/package.sh
 
       - name: Upload .spl artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wl_manager-spl
           path: dist/*.spl
@@ -79,7 +79,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Run doc-drift guard
         # Same script the pre-commit hook runs locally. Verifies
@@ -95,10 +95,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 
@@ -152,13 +152,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node.js
         # Node 20 LTS. Vitest 3.x requires Node ≥18; we
         # pin to the latest LTS so the toolchain matches
         # what most contributors run locally.
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
           # Cache npm dependencies keyed on package-lock.json

.github/workflows/codeql.yml

@@ -63,7 +63,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3

.github/workflows/docs.yml

@@ -52,14 +52,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # Fetch full history so future `git-revision-date-localized`
           # plugin support (if we add it) can read commit dates.
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
@@ -88,7 +88,7 @@ jobs:
         # Always upload — even on build failure we want the partial
         # site for debugging (mkdocs writes what it has).
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: site-${{ github.sha }}
           path: site/
@@ -120,12 +120,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
@@ -143,13 +143,13 @@ jobs:
         run: mkdocs build --verbose
 
       - name: Configure Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: site/
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/e2e-full.yml

@@ -50,10 +50,10 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "npm"
@@ -171,7 +171,7 @@ jobs:
 
       - name: Upload logs on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-full-logs-${{ github.run_id }}
           path: ci-logs/
@@ -182,7 +182,7 @@ jobs:
         # when a comparison fails. Uploading them lets the next morning's
         # triage check the actual visual divergence.
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: visual-diffs-${{ github.run_id }}
           path: tests/e2e/visual_diff/

.github/workflows/e2e-smoke.yml

@@ -45,10 +45,10 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "npm"
@@ -121,7 +121,7 @@ jobs:
 
       - name: Upload logs on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-smoke-logs-${{ github.run_id }}
           path: ci-logs/

.github/workflows/integration-tests.yml

@@ -44,10 +44,10 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 
@@ -163,7 +163,7 @@ jobs:
 
       - name: Upload logs on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: splunk-logs-${{ github.run_id }}
           path: ci-logs/

.github/workflows/pip-audit.yml

@@ -34,10 +34,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"