fix(ci): update GitHub Actions to Node.js 24

[wizzomafizzo]

Summary

• Upgrade docker/setup-buildx-action v3 → v4 (Node 24, removes deprecated install input)
• Upgrade actions/upload-artifact v4 → v6 (Node 24)
• Upgrade actions/download-artifact v4 → v7 (Node 24)
• Replace arduino/setup-task with gh release download from go-task/task (no Node 24 version available)
• Replace pozetroninc/github-action-get-latest-release with gh api call (no Node 24 version available)

Node.js 20 actions will be forced to Node.js 24 starting June 2, 2026 and removed September 16, 2026. The two replaced actions had no Node 24 release, so they've been swapped for authenticated gh CLI commands that run no third-party code.

Affected workflows: build.yml, fuzz.yml, lint-and-test.yml, scorecard.yml, zigcc-build.yml

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflows with newer versions of build and artifact management tools for improved CI/CD reliability and compatibility.
  • Optimized release artifact handling and Docker build setup across multiple deployment pipelines.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub Actions workflow files were updated to replace the arduino/setup-task action with shell-based gh CLI commands for task retrieval across build and fuzz workflows. The docker/setup-buildx-action was updated from v3 to v4, and artifact-related actions were upgraded to newer versions: actions/upload-artifact to v6 and actions/download-artifact to v7.

Changes

Cohort / File(s)	Summary
Task Setup Migration .github/workflows/build.yml, .github/workflows/fuzz.yml	Replaced arduino/setup-task action with direct gh release download of task_linux_amd64.tar.gz, manual extraction to /usr/local/bin, and cleanup. Also replaced release lookup action with gh api call for fetching latest release tag in build.yml.
Docker Buildx Action Upgrade .github/workflows/build.yml, .github/workflows/zigcc-build.yml	Updated docker/setup-buildx-action from pinned v3 to pinned v4; removed install: true parameter in build.yml.
Artifact Actions Upgrade .github/workflows/build.yml, .github/workflows/fuzz.yml, .github/workflows/lint-and-test.yml, .github/workflows/scorecard.yml	Upgraded actions/upload-artifact from v4 to v6 across all workflows; upgraded actions/download-artifact from v4 to v7 in build.yml for artifact retrieval steps.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• ci: harden workflows with pinned SHAs and explicit permissions #629: Modifies the same GitHub Actions workflow files, updating docker/setup-buildx-action and artifact action versions in parallel changes.

Poem

🐰 GitHub Actions, oh how you grow,
v3 to v4, let the buildx flow,
Task setup now runs with gh command's might,
Artifacts v6 dance in the workflow light!
No more third-party fuss, just shells so bright! 🎉

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(ci): update GitHub Actions to Node.js 24' accurately describes the main objective of the PR, which is to upgrade GitHub Actions to be compatible with Node.js 24 by updating action versions and replacing deprecated actions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/update-actions-node24

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sentry]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/build.yml (1)

151-157: Pin the Task release instead of downloading latest.

Omitting the tag makes every build depend on whatever go-task/task publishes next, which hurts reproducibility and can break historic rebuilds unexpectedly. Please download an explicit Task release tag here and reuse that same pin across both install steps.

♻️ Suggested shape

       - name: Install Task
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TASK_VERSION: v3.0.0
         run: |
-          gh release download -R go-task/task -p 'task_linux_amd64.tar.gz' -O /tmp/task.tar.gz
+          gh release download "$TASK_VERSION" -R go-task/task -p 'task_linux_amd64.tar.gz' -O /tmp/task.tar.gz
           sudo tar -xzf /tmp/task.tar.gz -C /usr/local/bin task
           rm /tmp/task.tar.gz
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Also applies to: 405-411

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/build.yml around lines 151 - 157, The workflow currently
downloads Task without a pinned release; update the "Install Task" step (the job
step named "Install Task" that runs `gh release download -R go-task/task -p
'task_linux_amd64.tar.gz'`) to use an explicit release tag: introduce a single
variable (e.g., TASK_VERSION) at the top of the workflow and replace the
unpinned download with a download that references that tag, then apply the same
TASK_VERSION variable in the other install step mentioned (the similar step
around lines 405-411) so both installs use the identical pinned release for
reproducible builds.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/build.yml:
- Around line 151-157: The workflow currently downloads Task without a pinned
release; update the "Install Task" step (the job step named "Install Task" that
runs `gh release download -R go-task/task -p 'task_linux_amd64.tar.gz'`) to use
an explicit release tag: introduce a single variable (e.g., TASK_VERSION) at the
top of the workflow and replace the unpinned download with a download that
references that tag, then apply the same TASK_VERSION variable in the other
install step mentioned (the similar step around lines 405-411) so both installs
use the identical pinned release for reproducible builds.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: dba1909d-1ed9-40f6-9a27-949b45d6b284

📥 Commits

Reviewing files that changed from the base of the PR and between 5a03fac and beefc79.

📒 Files selected for processing (5)

• .github/workflows/build.yml
• .github/workflows/fuzz.yml
• .github/workflows/lint-and-test.yml
• .github/workflows/scorecard.yml
• .github/workflows/zigcc-build.yml