From 372264473dacbaafa3eee2eeadc712eff16dfcac Mon Sep 17 00:00:00 2001
From: Avi Avni <avi.avni@gmail.com>
Date: Tue, 28 Jul 2026 13:42:12 +0300
Subject: [PATCH] Bump the GitHub Actions that were pinned to Node 20 runtimes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The verify run warned that actions/cache@v4 and actions/checkout@v4 target
Node.js 20 and were being forced onto Node 24. Bumped to current majors, and
took the two Pages actions along since they were behind as well:

  actions/checkout                v4 -> v7
  actions/cache                   v4 -> v6
  actions/upload-pages-artifact   v3 -> v5
  actions/deploy-pages            v4 -> v5

Left alone because they are already on their current major and were not in the
deprecation warning: taiki-e/install-action@v2, baptiste0928/cargo-install@v3,
and dtolnay/rust-toolchain@stable (a moving tag is that action's documented
usage).

Release notes read rather than bumped blind; two behaviour changes needed
handling, and one did not apply:

- upload-pages-artifact@v4 stopped including dotfiles. Set
  include-hidden-files: true so this bump publishes byte-identically to before
  instead of quietly changing a live site — mdbook emits .nojekyll, and src="."
  drags stray .gitignore files in. (Actions-based Pages never runs Jekyll, so
  .nojekyll is almost certainly inert; proving that is a separate change.) The
  input excludes .git and .github regardless, so it cannot over-share.
- deploy-pages has resolved artifacts by id since v4 and documents actions:read
  as required. It works without it today, but that is undocumented behaviour to
  be leaning on, so the deploy job now asks for that one read-only scope.
- checkout@v7 blocks fork-PR checkout for pull_request_target and workflow_run.
  Neither is used here; this repo's workflows trigger on pull_request.

checkout@v5+ and cache@v5+ need runner >= 2.327.1, which ubuntu-latest is well
past.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/book.yml   | 19 ++++++++++++++++---
 .github/workflows/verify.yml |  8 ++++----
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/book.yml b/.github/workflows/book.yml
index aa677a8..37d2da7 100644
--- a/.github/workflows/book.yml
+++ b/.github/workflows/book.yml
@@ -26,7 +26,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install mdbook + mdbook-mermaid
         uses: taiki-e/install-action@v2
@@ -84,10 +84,18 @@ jobs:
           fi
           exit $fail
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         if: github.event_name == 'push'
         with:
           path: book/html
+          # v4 stopped including dotfiles by default. Keeping them means this
+          # version bump publishes byte-identically to before, rather than
+          # silently changing the live site: mdbook emits .nojekyll, and the
+          # source tree's stray .gitignore files get copied in by src = ".".
+          # (Pages deployed via Actions never runs Jekyll, so .nojekyll is
+          # almost certainly inert here — but proving that is a separate change
+          # from bumping a version.)
+          include-hidden-files: true
 
   deploy:
     needs: build
@@ -96,9 +104,14 @@ jobs:
     permissions:
       pages: write
       id-token: write
+      # deploy-pages resolves the artifact by id since v4 and documents
+      # actions:read as required. It happens to work without it today, but
+      # relying on that is relying on undocumented behaviour, and a read-only
+      # scope is the cheapest possible way to stop doing so.
+      actions: read
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index ab060da..31618f6 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -31,7 +31,7 @@ jobs:
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/.ci-target
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -42,7 +42,7 @@ jobs:
       # recompiles all 45 crates from scratch. The reason the checked-in config
       # points outside the clone is mdbook, which never runs in this workflow.
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -60,12 +60,12 @@ jobs:
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/.ci-target
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
 
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry