Bump the actions group across 1 directory with 6 updates

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
     steps:
       # A pull request checks out its merge into the base: the first parent is
       # the base, so the diff is what merging would change.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2
       - id: filter
@@ -64,7 +64,7 @@ jobs:
       run:
         working-directory: core
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.90
         with:
           components: clippy, rustfmt
@@ -95,13 +95,13 @@ jobs:
       run:
         working-directory: core
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.90
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: core
       # The real-process fixtures are Python scripts.
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
       # The tests that run natively on Windows, against real processes.
@@ -120,7 +120,7 @@ jobs:
     # A hung test fails the job instead of holding the runner.
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.90
         with:
           components: clippy
@@ -160,7 +160,7 @@ jobs:
       run:
         working-directory: apps/desktop
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install the webview and tray libraries
         run: >
           sudo apt-get update && sudo apt-get install -y
@@ -171,10 +171,10 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: apps/desktop/src-tauri
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: apps/desktop/package.json
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
@@ -215,8 +215,8 @@ jobs:
       run:
         working-directory: packages/cli
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
       - run: npm test

.github/workflows/log-perf.yml

@@ -64,7 +64,7 @@ jobs:
       # Before it, the measurement opened no log: it is applied to an older baseline.
       HARNESS_FIX: 0ed4d216a1b1c514ffa37a8076c254b0770dc9c3
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           path: current
           fetch-depth: 0
@@ -88,10 +88,10 @@ jobs:
           workspaces: |
             current/apps/desktop/src-tauri
             baseline/apps/desktop/src-tauri
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: current/apps/desktop/package.json
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - name: Build
@@ -135,7 +135,7 @@ jobs:
             done
           } >>"$GITHUB_STEP_SUMMARY"
           cat "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: log-perf
           path: results/

.github/workflows/packages.yml

@@ -27,7 +27,7 @@ jobs:
       # Any version: the check compares the command's to it.
       VERSION: 0.0.0
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install the webview and tray libraries, and the package tools
         run: >
           sudo apt-get update && sudo apt-get install -y
@@ -38,10 +38,10 @@ jobs:
           workspaces: |
             core
             apps/desktop/src-tauri
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: apps/desktop/package.json
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm

.github/workflows/publish-cli.yml

@@ -45,9 +45,9 @@ jobs:
         run: |
           echo "::error::Publishing runs only from main, not $GITHUB_REF. Run it on main, or with dry-run."
           exit 1
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Trusted publishing needs npm 11.5.1 or later.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
       - run: npm install -g npm@11

.github/workflows/release.yml

@@ -100,7 +100,7 @@ jobs:
       SPARKLE_VERSION: 2.10.1
       SPARKLE_SHA256: 1a856d2a9edb8e628de88121d7be04cf0e2167f8641650b78fca00b14244cf27
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.90
         with:
           targets: aarch64-apple-darwin, x86_64-apple-darwin
@@ -213,7 +213,7 @@ jobs:
           cat "$appcast"
           echo "path=$appcast" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: macos
           path: |
@@ -236,18 +236,18 @@ jobs:
       run:
         working-directory: apps/desktop
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # With the AppIndicator library installed, the bundler adds the tray,
       # webview and GTK libraries to the packages' dependencies itself.
       - name: Install the webview and tray libraries
         run: >
           sudo apt-get update && sudo apt-get install -y
           libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev libssl-dev libarchive-tools
       - uses: dtolnay/rust-toolchain@1.90
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: apps/desktop/package.json
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
@@ -311,13 +311,13 @@ jobs:
           for file in *; do sha256sum "$file" > "$file.sha256"; done
           ls -l . "$RUNNER_TEMP/signatures"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: linux
           path: ${{ runner.temp }}/linux/*
           if-no-files-found: error
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: signatures-linux
           path: ${{ runner.temp }}/signatures/*
@@ -332,7 +332,7 @@ jobs:
       run:
         working-directory: core
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.90
         with:
           targets: x86_64-unknown-linux-musl
@@ -351,7 +351,7 @@ jobs:
           ls -l "$binary"
           [[ $("$binary" --version) == "localhostd ${{ needs.version.outputs.version }}" ]]
           LOCALHOST_STORAGE_ROOT=$(mktemp -d) "$binary" --stdio < /dev/null
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: localhostd
           path: core/target/x86_64-unknown-linux-musl/release/localhostd
@@ -371,20 +371,20 @@ jobs:
         working-directory: apps/desktop
         shell: bash
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.90
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: apps/desktop/package.json
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
           cache-dependency-path: apps/desktop/pnpm-lock.yaml
       - run: pnpm install --frozen-lockfile
 
       # Installed beside localhost-app.exe, where the app looks for it (src-tauri/src/wsl.rs).
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: localhostd
           path: apps/desktop/src-tauri/wsl
@@ -473,13 +473,13 @@ jobs:
           for file in *; do sha256sum "$file" > "$file.sha256"; done
           ls -l . "$RUNNER_TEMP/signatures"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: windows
           path: ${{ runner.temp }}/windows/*
           if-no-files-found: error
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: signatures-windows
           path: ${{ runner.temp }}/signatures/*
@@ -496,11 +496,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # For scripts/updater-manifest.sh.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           sparse-checkout: scripts
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: assets
           merge-multiple: true
@@ -560,7 +560,7 @@ jobs:
           fi
 
       # For scripts/homebrew-cask.sh and its template.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           sparse-checkout: |
             scripts

.github/workflows/site.yml

@@ -35,7 +35,7 @@ jobs:
       site: ${{ steps.filter.outputs.site }}
     steps:
       # The merge into the base: its first parent is the base.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2
       - id: filter
@@ -56,11 +56,11 @@ jobs:
       run:
         working-directory: site
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
         with:
           version: 10
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: pnpm