ci: upgrade low-risk GitHub Actions dependencies

[lizhengfeng101]

Summary

• Upgrade 8 GitHub Actions to their latest major versions (low-risk subset from chore(deps): bump the actions group across 1 directory with 10 updates #454)
• Deliberately keeps upload-artifact and download-artifact at v4 to avoid artifact format and hash-enforcement breaking changes that could disrupt the release pipeline

Upgraded actions

Action	From	To
actions/checkout	v4	v7
actions/setup-node	v4	v7
actions/cache	v4	v6
actions/github-script	v7	v9
actions/upload-pages-artifact	v3	v5
actions/deploy-pages	v4	v5
softprops/action-gh-release	v2	v3
actions/attest-build-provenance	v2	v4

Deferred (high-risk, separate PR needed)

Action	From	To	Risk
actions/upload-artifact	v4	v7	Direct upload format changes
actions/download-artifact	v4	v8	Hash-mismatch now errors by default; no longer auto-unzips all files

Safety verification

• All upgraded actions require Runner >= v2.327.1 (Node 24 runtime); checkout v6+ in container jobs requires >= v2.329.0
• Verified: self-hosted runner is v2.335.1 (API + CI log + machine confirmed)
• checkout v7's fork-PR guard does NOT affect our pull_request_target workflow (default checkout without explicit ref is exempt)
• actions/github-script v9 remains CommonJS-compatible for our post-review-comments.js script

Test plan

• CI passes on this PR (validates checkout, cache, setup-node work correctly)
• Manually trigger pages deploy to verify upload-pages-artifact + deploy-pages
• Next tag release will validate action-gh-release + attest-build-provenance (upload/download-artifact untouched)

[github-actions]

🔍 OpenCodeReview found 5 issue(s) in this PR.

• ✅ Successfully posted inline: 5 comment(s)

[github-actions]

Potential issue: Non-existent action version. actions/checkout@v7 does not appear to be a valid release. The latest known major version is v4. Using a non-existent version tag will cause all workflow runs to fail immediately at the checkout step.

If a newer version has indeed been released, please verify the exact tag on the actions/checkout releases page before merging. Additionally, per security best practices, consider pinning third-party actions to a full commit SHA rather than a mutable tag to prevent potential tag-hijacking attacks.

[github-actions]

Critical: Non-existent action version. actions/checkout@v7 does not exist. The latest major version is v4. Using a non-existent tag will cause this workflow to fail immediately at runtime. This same incorrect bump appears in multiple places in this file (lines 32, 73, 170) and across all other modified workflow files.

Please revert to actions/checkout@v4 or pin to a specific commit SHA for better security.

Suggestion:

Suggested change

	- uses: actions/checkout@v7
	- name: Trust workspace
	run: git config --global --replace-all safe.directory '*'
	- uses: actions/checkout@v4
	- name: Trust workspace
	run: git config --global --replace-all safe.directory '*'

[github-actions]

Critical: Non-existent action version. softprops/action-gh-release@v3 does not exist. The latest major version is v2. This will cause the release job to fail when attempting to create a GitHub release.

Suggestion:

Suggested change

	uses: softprops/action-gh-release@v3
	uses: softprops/action-gh-release@v2

[github-actions]

Critical: Non-existent action version. actions/attest-build-provenance@v4 does not exist. The latest major version is v2. This will cause the attestation step to fail.

Suggestion:

Suggested change

	uses: actions/attest-build-provenance@v4
	uses: actions/attest-build-provenance@v2

[github-actions]

Potential issue: actions/checkout@v7 may not exist. As of the latest known releases, actions/checkout is at v4. Jumping three major versions (v4 → v7) is highly unusual for first-party GitHub Actions. This same pattern appears across all workflow files in this PR (e.g., actions/cache@v6, actions/setup-node@v7, actions/github-script@v9), suggesting an automated bulk version bump that may reference non-existent tags.

If the workflow runs with a non-existent action version tag, it will fail immediately. Please verify that each referenced version tag actually exists in the respective action repository before merging.