chore(ci): bump GitHub Actions off Node 20 runtimes

[clo-ciq]

Summary

Node 20 reached EOL on 2026-04-30. This PR bumps GitHub Actions to current stable releases, pinned by full commit SHA with the target tag in a trailing comment.

⚠️ Heads up — review these specifically

Caution

DRAFT — auto-classifier flagged a breaking-change risk in this repo's artifact-action usage. Do not merge without verifying the flagged step.

• H1 in .github/workflows/ci.yml (job test): matrix upload with literal name 'coverage-report' — collisions across matrix legs in v4+

Warning

Artifact actions changed semantics — review your upload/download steps before merging.

The breaking changes landed in upload-artifact v4 and download-artifact v4 and still apply through v7/v8. Bumps in this PR:

• actions/download-artifact: v4 -> v8.0.1
• actions/upload-artifact: v4 -> v7.0.1

Common gotchas to verify in this repo:

• Matrix uploads with a literal name: collide; v4+ no longer auto-merges. Interpolate (name: build-${{ matrix.os }}) or set overwrite: true.
• Multiple uploads in a job with no explicit name: all collide on the default artifact name.
• Hidden files (e.g. .coverage, .next/, .cache/) are excluded by default in v4+ — set include-hidden-files: true if you upload dotfiles.
• download-artifact no longer flattens by default — without a name:, it creates a subdir per artifact. Set merge-multiple: true if a downstream run: step expects a flat path.
• Cross-run downloads now require both github-token: and run-id:.

Changes

Action	Before	After
actions/checkout	v4	v6.0.2
actions/download-artifact	v4	v8.0.1
actions/upload-artifact	v4	v7.0.1

Files touched: 3 workflow file(s), 9 line change(s).

Test plan

• Existing CI runs on this PR and stays green.
• If this repo's workflows aren't PR-triggered, dispatch them manually after merge or via workflow_dispatch.

---

Part of an org-wide bulk update across ~135 ctrliq repos to escape Node 20 EOL.

[ciq-it-service-account]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

Test summary from 3.14

Click to expand

============================= test session starts ==============================
platform linux -- Python 3.14.4, pytest-9.0.3, pluggy-1.6.0
rootdir: /__w/rlc-cloud-repos/rlc-cloud-repos
configfile: setup.cfg
plugins: cov-7.1.0
collected 91 items / 1 deselected / 90 selected

tests/framework/test_azure_mirrors.py ...........                        [ 12%]
tests/providers/test_providers.py ..                                     [ 14%]
tests/test_cloud_metadata.py ..........                                  [ 25%]
tests/test_dnf_vars.py .......                                           [ 33%]
tests/test_log_utils.py .                                                [ 34%]
tests/test_main.py ...........F..                                        [ 50%]
tests/test_plugins.py ................................                   [ 85%]
tests/test_repo_config.py .............                                  [100%]

=================================== FAILURES ===================================
__________ test_configure_repos_test_no_overwrite_no_preexisting_file __________

monkeypatch = <_pytest.monkeypatch.MonkeyPatch object at 0x7f5f09f03e50>
tmp_path = PosixPath('/tmp/pytest-of-root/pytest-0/test_configure_repos_test_no_o1')
dnf_vars_dir = PosixPath('/tmp/pytest-of-root/pytest-0/test_configure_repos_test_no_o1/dnf/vars')
marker = PosixPath('/tmp/pytest-of-root/pytest-0/test_configure_repos_test_no_o1/.configured')
mirrors_file = PosixPath('/tmp/pytest-of-root/pytest-0/test_configure_repos_test_no_o1/mirrors.yaml')

    def test_configure_repos_test_no_overwrite_no_preexisting_file(
        monkeypatch, tmp_path, dnf_vars_dir, marker, mirrors_file
    ):
        """Test _configure_repos with test overwrite and no pre-existing file."""
    
        # Create a temporary file to simulate the existing file
        file1 = dnf_vars_dir / "baseurl1"
        file2 = dnf_vars_dir / "baseurl2"
    
        # Call the function with test overwrite
        _configure_repos(str(mirrors_file))
    
        # Check that the existing file was not modified
        assert file1.exists()
        assert file2.exists()
    
        # These should be the default values from the mirrors.yaml file.
        assert file1.read_text().strip() == "https://depot.eastus.prod.azure.ciq.com"
>       assert file2.read_text().strip() == "https://depot.westus2.prod.azure.ciq.com"
E       AssertionError: assert 'https://depo...azure.ciq.com' == 'https://depo...azure.ciq.com'
E         
E         - https://depot.westus2.prod.azure.ciq.com
E         ?               ^   ^ ^
E         + https://depot.southeastasia.prod.azure.ciq.com
E         ?               ^^^^^ +  ^ ^^

tests/test_main.py:188: AssertionError
----------------------------- Captured stdout call -----------------------------
[INFO] Using cloud metadata: provider=unknown, region=unknown
[INFO] Loaded mirror map from /tmp/pytest-of-root/pytest-0/test_configure_repos_test_no_o1/mirrors.yaml
[INFO] Selecting mirror for provider=unknown, region=unknown
[INFO] Provider unknown not found, using default values
[INFO] Selected mirror URL: https://depot.eastus.prod.azure.ciq.com
[INFO] Running plugins for additional DNF variable customizations
[INFO] Marker file written to /tmp/pytest-of-root/pytest-0/test_configure_repos_test_no_o1/.configured
----------------------------- Captured stderr call -----------------------------
[ERROR] Failed to get cloud metadata: The cloud-init command was not found
------------------------------ Captured log call -------------------------------
ERROR    rlc.cloud_repos.cloud_metadata:cloud_metadata.py:37 cloud-init command not found: [Errno 2] No such file or directory: 'cloud-init'
ERROR    rlc-cloud-repos:main.py:74 Failed to get cloud metadata: The cloud-init command was not found
INFO     rlc-cloud-repos:main.py:80 Using cloud metadata: provider=unknown, region=unknown
INFO     rlc-cloud-repos:main.py:84 Loaded mirror map from /tmp/pytest-of-root/pytest-0/test_configure_repos_test_no_o1/mirrors.yaml
INFO     rlc-cloud-repos:repo_config.py:61 Selecting mirror for provider=unknown, region=unknown
INFO     rlc-cloud-repos:repo_config.py:77 Provider unknown not found, using default values
INFO     rlc-cloud-repos:main.py:89 Selected mirror URL: https://depot.eastus.prod.azure.ciq.com
INFO     rlc-cloud-repos:plugins.py:279 Running plugins for additional DNF variable customizations
INFO     rlc-cloud-repos:main.py:100 Marker file written to /tmp/pytest-of-root/pytest-0/test_configure_repos_test_no_o1/.configured
================================ tests coverage ================================
_______________ coverage: platform linux, python 3.14.4-final-0 ________________

Name                                                   Stmts   Miss  Cover   Missing
------------------------------------------------------------------------------------
cloud-repos/rlc/cloud_repos/__init__.py                    0      0   100%
cloud-repos/rlc/cloud_repos/cloud_metadata.py             17      0   100%
cloud-repos/rlc/cloud_repos/dnf_vars.py                   28      0   100%
cloud-repos/rlc/cloud_repos/log_utils.py                  16      0   100%
cloud-repos/rlc/cloud_repos/main.py                       77      0   100%
cloud-repos/rlc/cloud_repos/plugins.py                   118      0   100%
cloud-repos/rlc/cloud_repos/providers/__init__.py         11      0   100%
cloud-repos/rlc/cloud_repos/providers/aws.py               6      0   100%
cloud-repos/rlc/cloud_repos/repo_config.py                33      0   100%
framework/rlc_cloud_repos_framework/__init__.py            0      0   100%
framework/rlc_cloud_repos_framework/azure_mirrors.py      61      0   100%
tests/conftest.py                                         42      0   100%
tests/framework/test_azure_mirrors.py                     94      0   100%
tests/providers/test_providers.py                         23      0   100%
tests/test_cloud_metadata.py                              40      0   100%
tests/test_dnf_vars.py                                    51      0   100%
tests/test_log_utils.py                                    6      0   100%
tests/test_main.py                                        87      0   100%
tests/test_plugins.py                                    376      0   100%
tests/test_repo_config.py                                 51      0   100%
------------------------------------------------------------------------------------
TOTAL                                                   1137      0   100%
Coverage HTML written to dir htmlcov
=========================== short test summary info ============================
FAILED tests/test_main.py::test_configure_repos_test_no_overwrite_no_preexisting_file - AssertionError: assert 'https://depo...azure.ciq.com' == 'https://depo...azure.ciq.com'
  
  - https://depot.westus2.prod.azure.ciq.com
  ?               ^   ^ ^
  + https://depot.southeastasia.prod.azure.ciq.com
  ?               ^^^^^ +  ^ ^^
================== 1 failed, 89 passed, 1 deselected in 0.85s ==================

[Copilot]

Pull request overview

Updates this repo’s GitHub Actions workflow dependencies to versions that no longer rely on Node 20 (EOL 2026-04-30), using full commit-SHA pins with the corresponding release tag noted in comments.

Changes:

• Bump actions/checkout from v4 to a SHA pin for v6.0.2 across all workflows.
• Bump artifact actions in CI: upload-artifact to a SHA pin for v7.0.1, and download-artifact to a SHA pin for v8.0.1.
• Keep artifact naming patterns matrix-safe (e.g., only the 3.14 leg uploads coverage-report, and RPM artifacts are matrix-suffixed).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release.yml	Pins actions/checkout to v6.0.2 by commit SHA for the release workflow.
.github/workflows/gitlab-mr.yml	Pins actions/checkout to v6.0.2 by commit SHA for the GitLab MR automation workflow.
.github/workflows/ci.yml	Pins actions/checkout, bumps and pins artifact upload/download actions, retaining matrix-appropriate artifact naming.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.