ci: move release actions off the deprecated Node 20 runtime

Every release run logs a Node 20 deprecation warning per step, and closes with:
"The following actions target Node.js 20 but are being forced to run on Node.js
24: actions/cache@v4, actions/checkout@v4, actions/setup-node@v4,
actions/upload-artifact@v4."

Nothing is broken — GitHub is shimming them onto Node 24 — but the shim is
temporary, so pin majors that target node24 natively:

  checkout          v4 -> v7
  setup-node        v4 -> v7
  cache             v4 -> v6
  upload-artifact   v4 -> v7
  download-artifact v4 -> v8

Node 24 actions require Actions Runner >= 2.327.1; the hosted images run 2.335.1
(per the v0.9.2 build log) and self-update, so nothing to do there.

The majors were picked against how this workflow actually uses them, and each
one's breaking change was checked rather than assumed:
  · setup-node v6 limits automatic caching to npm — this workflow never sets
    setup-node's `cache:` input (npm caching is the explicit actions/cache step),
    so it's a no-op here.
  · checkout v7 blocks fork checkouts for pull_request_target / workflow_run —
    neither is a trigger (tag push + workflow_dispatch).
  · upload-artifact v7's unzipped "direct uploads" are opt-in via `archive:`;
    the default still zips, so the .app.zip round-trip is unchanged.
  · download-artifact v8 now ERRORS on a digest mismatch instead of warning.
    Kept deliberately: a corrupted app bundle must not reach a release we then
    sign and notarize. A spurious failure is recoverable by re-running the job.

Verified every input this workflow passes is still declared in the new majors
(notably download-artifact's `merge-multiple`, which the draft-release job
depends on), that all five now report `using: node24`, and that the YAML still
parses with both matrix arches and triggers intact.

Author: ndemianc

.github/workflows/release.yml

@@ -19,13 +19,24 @@ on:
 permissions:
   contents: write # create/update the draft release
 
+# Action pins run on the Node 24 runtime. GitHub deprecated Node 20 on the runners (2025-09-19) and
+# was force-running the old v4 pins on Node 24 with a warning per step; these majors target node24
+# natively, so the shim (and the warning) is gone. They need Actions Runner >= 2.327.1 — the hosted
+# images are well past that (2.335.1 as of the v0.9.2 build) and self-update, so no action needed.
+# The majors were chosen against how THIS workflow uses them, not blindly:
+#   · setup-node v6 limited automatic caching to npm — not used here; npm caching is the explicit
+#     actions/cache step below, so the change is a no-op for us.
+#   · checkout v7 blocks fork checkouts for pull_request_target/workflow_run — neither is a trigger.
+#   · upload-artifact v7 added unzipped "direct uploads" behind `archive:` — opt-in, default unchanged.
+#   · download-artifact v8 now ERRORS on a digest mismatch (was a warning). Deliberate: a corrupted
+#     app bundle must not reach a release we then sign and notarize. Recoverable by re-running the job.
 jobs:
   # Cheap gate: run the extension unit tests before spending ~1h of macOS build minutes.
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "24"
       - name: Extension unit tests
@@ -79,12 +90,12 @@ jobs:
       # the whole class of flake goes away. Same spirit as the GITHUB_TOKEN mitigation above.
       PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "24" # bootstrap.sh checks the .nvmrc major; 24.x satisfies the 1.126 pin
       - name: Cache npm downloads
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.npm
           key: npm-${{ matrix.arch }}-${{ hashFiles('scripts/bootstrap.sh') }}
@@ -98,7 +109,7 @@ jobs:
       - name: Zip the unsigned app
         run: ditto -c -k --sequesterRsrc --keepParent "VSCode-darwin-${{ matrix.arch }}/LevelCode.app" "UNSIGNED-LevelCode-${{ matrix.arch }}.app.zip"
       - name: Upload app artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: UNSIGNED-LevelCode-${{ matrix.arch }}
           path: UNSIGNED-LevelCode-${{ matrix.arch }}.app.zip
@@ -111,7 +122,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: apps
           merge-multiple: true