Move the workflows off the deprecated Node 20 actions

.github/workflows/ci.yml

@@ -20,10 +20,10 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '10.0.x'
 
@@ -60,7 +60,7 @@ jobs:
     name: MCP server in a container
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # MCP directories run automated safety and quality checks against a container, and a server
       # that fails them is listed but never appears in search results. Building the image here
@@ -77,10 +77,10 @@ jobs:
     name: Verify packaging
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '10.0.x'
 

.github/workflows/codeql.yml

@@ -23,15 +23,15 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '10.0.x'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: csharp
           queries: security-and-quality
@@ -44,6 +44,6 @@ jobs:
           dotnet build src/XafLogicExplainer.DescriptionAnnotator/XafLogicExplainer.DescriptionAnnotator.csproj -c Release
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: '/language:csharp'

.github/workflows/mcp-registry.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # This job and the NuGet one both start from `release: published`, so they run in parallel —
       # and the registry rejects a server whose package it cannot download yet. NuGet's indexes

.github/workflows/nuget.yml

@@ -31,10 +31,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 

.github/workflows/pages.yml

@@ -29,7 +29,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Configure Pages
         uses: actions/configure-pages@v5

docs/RELEASING.md

@@ -64,6 +64,19 @@ The job then runs the tests, packs, and refuses to push if anything disagrees:
   ```
   A package that packs cleanly and fails to install is a real outcome; the pack job cannot catch it.
 
+  Install to a temporary directory when the machine is your own, so a verification cannot leave you
+  on a version you did not choose to run:
+  ```bash
+  dotnet tool install --tool-path /tmp/verify XafLogicExplainer.Cli
+  /tmp/verify/xaflogic --version   # stamps the commit, so the binary ties back to the merge
+  ```
+
+  **Do not trust one read of the feed.** `api.nuget.org/v3-flatcontainer/<id>/index.json` is cached
+  per CDN edge, and during the 0.13.0 verification two requests seconds apart returned `0.12.1` and
+  `0.13.0` for the same package. A single read can report the previous version and look exactly
+  like a push that failed. Check each package twice, and treat a successful install from the feed
+  as the proof rather than the index.
+
 ## Version policy
 
 `0.x` while the extractor is still meeting codebases we did not write. Extraction behaviour changed