From 4a6be8f87d641ad11ad749a4f1e0c62e0edc834a Mon Sep 17 00:00:00 2001
From: Nic Glazkov <82780940+nicglazkov@users.noreply.github.com>
Date: Thu, 24 Sep 2026 13:12:03 -0700
Subject: [PATCH] Pin runner images and move actions to Node 24

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TaKVWNJEhRPNGkTJNre9Fc
---
 .github/workflows/ci.yml      |  8 ++++----
 .github/workflows/pages.yml   | 10 +++++-----
 .github/workflows/release.yml | 12 ++++++------
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index daff313..4282672 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
       matrix:
         os: [macos-14, ubuntu-22.04, windows-2022]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # wry links against the system webview, so the tray binary needs these
       # headers even to compile. The engine and CLI do not, which is what keeps
@@ -62,7 +62,7 @@ jobs:
     name: CLI builds without a desktop
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --release -p gcloud-dot-cli
@@ -73,9 +73,9 @@ jobs:
   # cannot arrive unnoticed between the times somebody thinks to look.
   audit:
     name: Audit dependencies
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo install cargo-audit --locked
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 207626b..78262d8 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -20,15 +20,15 @@ concurrency:
 
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/checkout@v7
+      - uses: actions/configure-pages@v6
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1d38400..c4918e4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ jobs:
             platform: windows-x86_64
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # A tag that disagrees with the crate version ships binaries whose
       # --version, update check, and About line all report the wrong number.
@@ -177,7 +177,7 @@ jobs:
           "/c/Program Files (x86)/NSIS/makensis.exe" -DVERSION="$version" packaging/windows/installer.nsi
           mv packaging/windows/*setup.exe dist/
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.platform }}
           path: |
@@ -194,16 +194,16 @@ jobs:
   publish:
     name: Publish release
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
       # Full history and tags, because the release notes are built from the
       # commits between this tag and the one before it, and a shallow checkout
       # has neither.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: artifacts
           merge-multiple: true
@@ -227,7 +227,7 @@ jobs:
       - name: Release notes
         run: packaging/release-notes.sh "${GITHUB_REF_NAME}" > RELEASE_NOTES.md
 
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@v3
         with:
           files: artifacts/*
           body_path: RELEASE_NOTES.md