CI: off Node 20, and pin the link checker's own binary

[mmcky]

Every run on both workflows currently carries Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24. This clears it, and pins one more thing that was quietly floating.

The bumps

Action		Why
actions/checkout	v4 → v7	node20
actions/setup-node	v4 → v7	node20
actions/setup-python	v5 → v7	node20; the only removal across v6/v7 is the pip install input, unused here
actions/deploy-pages	v4 → v5	node20
actions/upload-pages-artifact	v3 → v5	see below

The one non-obvious point, recorded so nobody re-derives it: the deprecation annotation names actions/upload-artifact@v4 — the inner action — not upload-pages-artifact. That makes bumping the outer one to v4 look like the fix when it is not: v4 still pins upload-artifact 4.6.2, which is node20. Only v5 moves to a node24 build.

checkout v7 keeps fetch-depth: 0 behaving identically, which matters here because scripts/check-version-bump.py needs refs/remotes/origin/main to exist and exits 2 rather than passing blind when it does not. The comment explaining that is preserved verbatim.

And a pin the repo was missing

lycheeverse/lychee-action is pinned at @v2, but the checker binary it downloads is a separate thing that moves underneath that tag — the default was v0.16.1 when v2.0.0 shipped and is v0.24.2 today. That is exactly the exposure the mystmd@1.10.1 pin two lines above already closes, and the repo states that reasoning three times while leaving this one to an upstream default. Now set to v0.24.2, which is the current default, so it changes nothing today and only stops the next silent bump reddening an unrelated PR.

Risk

Three majors in one hop invites the question. There is no dependabot here, so the only bump cadence is someone noticing a warning. Each intervening major was checked inert for this repo: no package.json, so setup-node's packageManager auto-cache never fires; the fork-checkout gate added in checkout v6/v7 applies only to pull_request_target and workflow_run, and neither workflow uses them.

The narrower real risk: by docs.yml's own design a PR uploads but never deploys, so the upload-pages-artifact v5 + deploy-pages v5 pairing first executes on the merge commit. Mitigating it — the build-and-upload half does run on the PR, the permissions block already matches deploy-pages v5's stated requirement, and recovery is a one-line revert.

No version bumps: .github/workflows/ is repo-level and ships to nobody. The guard agrees — no plugin directory touched. Both files re-parse, and all versions were confirmed against the releases API rather than assumed.

[Copilot]

Pull request overview

Updates GitHub Actions workflow dependencies to eliminate Node.js 20 deprecation warnings and makes the docs link-check tooling fully deterministic by pinning the Lychee binary version (independent of the action tag), aligning CI behavior with the repo’s existing “pin the toolchain” rationale.

Changes:

• Bump key GitHub Actions dependencies to newer major versions to move off Node.js 20-based action runtimes.
• Upgrade Pages artifact upload/deploy actions (upload-pages-artifact@v5, deploy-pages@v5) to ensure the underlying artifact action is Node.js 24-compatible.
• Pin lycheeverse/lychee-action’s downloaded checker binary via lycheeVersion: v0.24.2 to prevent silent upstream drift.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/validate.yml	Updates checkout/setup-python/setup-node action majors to clear Node 20 deprecation warnings in validation workflows.
.github/workflows/docs.yml	Updates checkout/setup-node/pages actions and pins the Lychee checker binary version for deterministic link checking.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.