[nicglazkov]

Prepares CI for two GitHub Actions changes before 2026-10-19: ubuntu-latest moving to a new Ubuntu image, and the Node 20 action runtime being deprecated. The goal is no behaviour change: every job keeps running on the image it runs on today, and actions move to the major that runs on Node 24.

Runner pins

Workflow	Job	Before	After	Source
ci.yml	Audit dependencies	ubuntu-latest	ubuntu-24.04	CI run 32837652332 "Set up job": Image: ubuntu-24.04
release.yml	Publish release	ubuntu-latest	ubuntu-24.04	Release run 32836815641 (v1.1.11): Image: ubuntu-24.04
pages.yml	deploy	ubuntu-latest	ubuntu-24.04	Deploy site run 32836813507: Image: ubuntu-24.04

All other jobs were already pinned (macos-14, ubuntu-22.04, ubuntu-22.04-arm, windows-2022) and are unchanged.

Action bumps (all were on node20; each new tag's action.yml checked for using: node24)

Action	Before	After	Files
actions/checkout	v4	v7	ci.yml, pages.yml, release.yml
actions/upload-artifact	v4	v7	release.yml
actions/download-artifact	v4	v8	release.yml
softprops/action-gh-release	v2	v3	release.yml
actions/configure-pages	v5	v6	pages.yml
actions/upload-pages-artifact	v3 (composite, used upload-artifact v4)	v5	pages.yml
actions/deploy-pages	v4	v5	pages.yml

Why these majors are safe here

• actions/checkout v4 to v7: Node 24 since v5. v6 stores persisted credentials under $RUNNER_TEMP instead of .git/config; v7 blocks checking out fork PRs under pull_request_target/workflow_run (not used here). No inputs used here changed.
• actions/upload-artifact v4 to v7 / actions/download-artifact v4 to v8: Node 24 since v6/v7. v7 adds opt-in unzipped single-file uploads (archive: false, not used, so uploads stay zipped). v8 skips unzipping non-zip downloads and now fails the step on a digest mismatch instead of warning. Artifact names, merge-multiple, if-no-files-found and hidden-file handling (already excluded by default since v4.4) are unchanged.
• softprops/action-gh-release v2 to v3: v3.0.0 only moves the runtime to Node 24; inputs unchanged.
• actions/configure-pages v5 to v6, actions/deploy-pages v4 to v5: runtime moves to Node 24, no input changes.
• actions/upload-pages-artifact v3 to v5: v4 stopped including dotfiles (v5 adds include-hidden-files, default false). site/ has no dotfiles, so the published artifact is the same. v5 uses upload-artifact v7 internally.
• The publish job's fetch-depth: 0 checkout feeds packaging/release-notes.sh (git describe --tags). checkout v6.0.2 changed tag handling to preserve annotations; describe --tags works either way.

Not changed: dtolnay/rust-toolchain@stable is a composite action with no JavaScript steps, and Swatinem/rust-cache@v2 already runs on node24 at the current v2 tag (v2.9.2).

What this PR's CI exercises

• ci.yml runs on this PR: checkout v7 and the audit job on ubuntu-24.04.
• release.yml only runs on a v* tag or manual dispatch, so upload-artifact v7, download-artifact v8, action-gh-release v3 and the pinned publish runner are not exercised here. Worth watching the first release after merging (artifacts collected into artifacts/, SHA256SUMS, release body).
• pages.yml runs on push to main when site/** or pages.yml changes, so merging this deploys the site once with the new actions. That deploy is the real test for the Pages bumps.

Checked with actionlint 1.7.12. No open Dependabot github-actions PRs to supersede.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TaKVWNJEhRPNGkTJNre9Fc