CI: move action pins off deprecated Node 20

GitHub now forces actions that target Node.js 20 onto Node 24 and logs
a deprecation warning on every job. When Node 20 support is removed,
every PR and merge-queue leg that sets up Node or Python, or moves an
artifact, would break at the same moment.

Move the CI workflow and the two artifact retry composites to the
first release of each action that runs on Node 24. Each new pin's only
breaking change is the runtime, or an input we don't use:
- setup-node v4 -> v6.4.0 (pin already used in release.yml; no
  root package.json, so the v5+ auto-cache never turns on)
- setup-python v5 -> v6.3.0
- download-artifact v4 -> v7.0.0 (we download by pattern, not ID)
- upload-artifact v4 -> v6.0.0
- setup-uv v6.8.0 -> v7.0.0 (drops only the unused server-url)

release.yml and the disabled compatibility workflows are left alone.

Refs #1588

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

.github/actions/download-artifact/action.yml

@@ -26,7 +26,7 @@ runs:
     - name: Download (attempt 1)
       id: first
       if: ${{ !cancelled() }}
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       continue-on-error: true
       with:
         pattern: ${{ inputs.pattern }}
@@ -58,7 +58,7 @@ runs:
     - name: Download (attempt 2)
       id: second
       if: ${{ !cancelled() && (steps.first.outcome == 'failure' || steps.first-check.outcome == 'failure') }}
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       with:
         pattern: ${{ inputs.pattern }}
         merge-multiple: ${{ inputs.merge-multiple }}

.github/actions/upload-artifact/action.yml

@@ -42,7 +42,7 @@ runs:
     - name: Upload (attempt 1)
       id: first
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       continue-on-error: true
       with:
         name: ${{ inputs.name }}
@@ -61,7 +61,7 @@ runs:
     - name: Upload (attempt 2)
       id: second
       if: ${{ !cancelled() && steps.first.outcome == 'failure' }}
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       continue-on-error: true
       with:
         name: ${{ inputs.name }}-retry-${{ github.run_attempt }}-2
@@ -82,7 +82,7 @@ runs:
     - name: Upload (attempt 3)
       id: third
       if: ${{ !cancelled() && steps.second.outcome == 'failure' }}
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: ${{ inputs.name }}-retry-${{ github.run_attempt }}-3
         path: ${{ inputs.path }}

.github/workflows/ci.yml

@@ -178,7 +178,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20.20.2'
 
@@ -810,7 +810,7 @@ jobs:
       # binary we mount into the container).
 
       - name: Download base image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           pattern: docker-base-image*
           merge-multiple: true
@@ -909,7 +909,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y lcov
 
       - name: Download all coverage artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           path: coverage-artifacts
           pattern: coverage-{host*,docker-*}
@@ -967,7 +967,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20.20.2'
 
@@ -1402,7 +1402,7 @@ jobs:
 
       - name: Setup Node.js
         if: matrix.suite == 'e2e_npm' || matrix.suite == 'e2e_scan' || matrix.suite == 'e2e_safety_pnpm'
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20.20.2'
 
@@ -1417,13 +1417,13 @@ jobs:
 
       - name: Setup Node.js 24 (named pnpm legs)
         if: matrix.suite == 'e2e_redirect_pnpm_build'
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24.x'
 
       - name: Setup Python
         if: matrix.suite == 'e2e_pypi' || matrix.uv != '' || matrix.poetry != '' || matrix.pdm != '' || matrix.hatch != ''
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12.x'
 
@@ -1464,7 +1464,7 @@ jobs:
 
       - name: Setup uv (Pipenv / pip legs)
         if: matrix.pipenv != '' || matrix.pip != ''
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+        uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
 
       - name: Install the Pythons the Pipenv / pip legs run on
         if: matrix.pipenv != '' || matrix.pip != ''
@@ -1661,7 +1661,7 @@ jobs:
 
       - name: Setup Node.js 24 (vlt legs)
         if: matrix.vlt != ''
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24.21.0'
 
@@ -2151,7 +2151,7 @@ jobs:
       # images and would be flagged by zizmor's cache-poisoning audit.
 
       - name: Download base image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           pattern: docker-base-image*
           merge-multiple: true
@@ -2230,7 +2230,7 @@ jobs:
           shared-key: dev-ubuntu-latest
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24.x'
       - name: Manifest-less VEX over every real yarn classic flow
@@ -2620,7 +2620,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.gate.outputs.run == 'true'
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           # Node 24, NOT the 20.20.2 the other jobs pin. pnpm 10 imports
           # `node:sqlite` for its store index, which does not exist before
@@ -2671,7 +2671,7 @@ jobs:
 
       - name: Setup Python + uv
         if: steps.gate.outputs.run == 'true'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12.x'