ci: fix APT publish failure and bump actions to latest majors

The 2.1.6 release failed in "Publish to APT": the step installed rclone
without refreshing the package index first, so apt resolved the version
baked into the runner image (1.60.1+dfsg-3ubuntu0.24.04.5), which Ubuntu
has since removed from the pool. The download 404'd and the step exited
100, which also skipped the Homebrew formula update. Add apt-get update
before the install.

Also bump the actions that were being force-migrated off Node 20:

  actions/checkout                 v4 -> v7
  actions/setup-go                 v5 -> v7
  actions/upload-artifact          v4 -> v7
  actions/create-github-app-token  v1 -> v3

checkout v6 moved persisted credentials out of .git/config into a
separate file referenced by includeIf, so the release job's
"git config --unset-all http.https://github.com/.extraheader" no longer
removes them and the GITHUB_TOKEN header would have overridden the
GitHub App token in the formula push remote URL. Check out with
persist-credentials: false instead, which leaves no header to unset.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: LauJosefsen

.github/workflows/go.yml

@@ -13,9 +13,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -27,7 +27,7 @@ jobs:
         run: go test -race -coverprofile=coverage.out ./...
 
       - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage
           path: coverage.out
@@ -38,9 +38,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -53,9 +53,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -70,9 +70,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/release.yml

@@ -13,9 +13,15 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      # persist-credentials: false keeps checkout from leaving a GITHUB_TOKEN
+      # Authorization header in the git config. The formula push below
+      # authenticates as the GitHub App via the remote URL, and a persisted
+      # header would take precedence over it.
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -79,6 +85,7 @@ jobs:
           CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         run: |
+          sudo apt-get update
           sudo apt-get install -y dpkg-dev apt-utils rclone
 
           DESCRIPTION="Developer environment orchestration tool"
@@ -126,7 +133,7 @@ jobs:
       - name: Generate app token for formula push
         if: github.ref_type == 'tag'
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -145,7 +152,6 @@ jobs:
 
           git config user.email "noc+gitte@cego.dk"
           git config user.name "CI"
-          git config --unset-all http.https://github.com/.extraheader || true
           git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/cego/gitte"
           git fetch origin main
           git checkout main