Bump actions/upload-artifact off v4 (Node 20) before Sept 16, 2026

[dwcullop]

Background

PR #1088 pinned actions/upload-artifact to v4.6.2 (in .github/workflows/ci-build.yml) to avoid an intermittent silent-failure regression on v7 (see actions/upload-artifact#806).

v4 runs on Node.js 20. GitHub is sunsetting Node 20 on the Actions runner:

• June 2, 2026: Node 24 becomes the default runtime. v4 still works but emits a deprecation warning on every run.
• September 16, 2026: Node 20 is removed. v4 will stop working unless ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true is set on the runner / workflow (foot-gun; don't do this).

Source: GitHub Actions runner deprecation notice (visible as a warning annotation on every run after June 2):

Node.js 20 actions are deprecated... Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026.

What to do before September 16, 2026

Pick one:

1. Upgrade to actions/upload-artifact@v6.0.0 (Node 24, pre-ESM, no known silent-failure regressions). Single-file change.
2. Upgrade to @v7.x if the silent-failure regression has been fixed by then. Check actions/upload-artifact#806 and similar issues before going to v7.

Recommend option 1 unless v7 issues are resolved.

Other Node-20 actions to audit at the same time

While we're at it, check these for the same Node 20 / Node 24 transition:

• dotnet/nbgv@v0.5.1 (already flagged with the same deprecation warning on current builds)
• actions/setup-dotnet@v5.0.1 (verify which Node version it runs on)
• Any others surfaced by the deprecation warnings in the next CI run.

Don't lose track

This issue must be resolved before September 16, 2026 or PR CI breaks.

[JakenVeina]

The other discussion we were having was whether we should just drop this step in ci-build.yml completely.

What this is doing is, for every proposed PR to main or /releases/, ci-build.yml runs to make sure the solution builds, and all the tests pass. It then builds a full nuget package, and uploads it to github as a workflow artifact.

We don't appear to be DOING anything with these uploaded artifacts, that I can see. GitHub docs describe these artifacts as being useful for re-using in other jobs, to avoid having to repeat builds, or to support build attestation, but we're not currently doing any of that. Darrin and I discussed that they could be useful for debugging deployment issues, but ci-build.yml doesn't run for deployments. So, we're not really sure what purpose these artifacts serve.

That being said, these artifacts are automatically dropped after 90 days, so they're not exactly hurting anything, except that the ci-build.yml job started failing after upgrading to v7.