Update GitHub Actions for Node.js 24 compatibility

.github/actions/cache-typst/action.yml

@@ -41,7 +41,7 @@ runs:
 
     - name: Cache Typst package folder
       id: cache-typst-restore
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: ${{ env.TYPST_CACHE }}
         key: ${{ runner.os }}-typst-1

.github/workflows/actions/quarto-dev/action.yml

@@ -5,15 +5,15 @@ runs:
   using: "composite"
   steps:
     - name: Cache deno std deps
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ./src/resources/deno_std/cache
         key: ${{ runner.os }}-deno_std-2-${{ hashFiles('./src/resources/deno_std/deno_std.lock', './package/scripts/deno_std/deno_std.ts') }}
         restore-keys: |
           ${{ runner.os }}-deno_std-2-
 
     - name: Cache Cargo dependencies
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.cargo/registry

.github/workflows/create-release.yml

@@ -35,7 +35,7 @@ jobs:
       tag_pushed: ${{ steps.version_commit.outputs.tag_pushed }}
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -44,9 +44,9 @@ jobs:
         uses: ./.github/workflows/actions/prevent-rerun
 
       # we _also_ need npm, specifically for webui/preview
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: 18
+          node-version: 22
 
       - name: Get previous version
         id: read-version
@@ -78,7 +78,7 @@ jobs:
           # echo -e "Due to an issue with upstream dependency, the RHEL build may not included in this release." >> "release_note.md"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: News
           path: |
@@ -103,7 +103,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -116,7 +116,7 @@ jobs:
           tar --owner=root --group=root -zcvf  quarto-${{needs.configure.outputs.version}}.tar.gz *
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Source
           path: ./quarto-${{needs.configure.outputs.version}}.tar.gz
@@ -125,7 +125,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -153,7 +153,7 @@ jobs:
           popd
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Deb Zip
           path: ./package/quarto-${{needs.configure.outputs.version}}-linux-amd64.tar.gz
@@ -162,7 +162,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -190,7 +190,7 @@ jobs:
           popd
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Deb Arm64 Zip
           path: ./package/quarto-${{needs.configure.outputs.version}}-linux-arm64.tar.gz
@@ -201,7 +201,7 @@ jobs:
     if: false
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -240,7 +240,7 @@ jobs:
           popd
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: RHEL Zip
           path: ./package/quarto-${{needs.configure.outputs.version}}-linux-rhel7-amd64.tar.gz
@@ -253,7 +253,7 @@ jobs:
         arch: [x86_64, aarch64]
         format: [deb, rpm]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -302,7 +302,7 @@ jobs:
           fi
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Linux-${{ matrix.format }}-${{ matrix.arch }}-Installer
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-linux-${{ steps.pkg_arch.outputs.arch_name }}.${{ matrix.format }}
@@ -311,7 +311,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure, make-tarball]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           sparse-checkout: |
@@ -321,7 +321,7 @@ jobs:
         if: ${{ inputs.publish-release }}
         uses: ./.github/workflows/actions/prevent-rerun
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: Deb Zip
           path: .
@@ -352,7 +352,7 @@ jobs:
     needs: [configure]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -417,13 +417,13 @@ jobs:
           CERT_FINGERPRINT: ${{ secrets.SM_CLIENT_CERT_FINGERPRINT }}
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Windows Installer
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-win.msi
 
       - name: Upload Zip
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Windows Zip
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-win.zip
@@ -432,7 +432,7 @@ jobs:
     runs-on: windows-latest
     needs: [configure, make-installer-win]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           sparse-checkout: |
@@ -443,7 +443,7 @@ jobs:
         uses: ./.github/workflows/actions/prevent-rerun
 
       - name: "Download Windows Zip"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: Windows Zip
           path: .
@@ -480,7 +480,7 @@ jobs:
     runs-on: macos-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -529,13 +529,13 @@ jobs:
           QUARTO_APPLE_CONNECT_PW: ${{ secrets.APPLE_CONNECT_PW }}
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Mac Installer
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-macos.pkg
 
       - name: Upload Zip
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Mac Zip
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-macos.tar.gz
@@ -549,7 +549,7 @@ jobs:
     runs-on: macos-latest
     needs: [configure, make-installer-mac]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           sparse-checkout: |
@@ -559,7 +559,7 @@ jobs:
         if: ${{ inputs.publish-release }}
         uses: ./.github/workflows/actions/prevent-rerun
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: Mac Zip
           path: .
@@ -603,7 +603,7 @@ jobs:
       ]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           path: quarto-cli
@@ -615,7 +615,7 @@ jobs:
         uses: ./quarto-cli/.github/workflows/actions/prevent-rerun
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Rename news
         run: |
@@ -723,7 +723,7 @@ jobs:
       ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Prevent Re-run
         if: ${{ inputs.publish-release }}
@@ -751,7 +751,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure, publish-release]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github
@@ -761,7 +761,7 @@ jobs:
         uses: ./.github/workflows/actions/prevent-rerun
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - uses: ./.github/actions/docker
         with:

.github/workflows/performance-check.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # checkout full tree
           fetch-depth: 0

.github/workflows/publish-cloudsmith.yml

@@ -36,7 +36,7 @@ jobs:
       version: ${{ steps.resolve.outputs.version }}
       is_prerelease: ${{ steps.resolve.outputs.is_prerelease }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github
@@ -175,7 +175,7 @@ jobs:
           GH_REPO: quarto-dev/quarto-cli
 
       - name: Install and authenticate Cloudsmith CLI
-        uses: cloudsmith-io/cloudsmith-cli-action@v1.0.8
+        uses: cloudsmith-io/cloudsmith-cli-action@v2.0.2
         with:
           api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
 

.github/workflows/stale-needs-repro.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           start-date: 2023-01-01T01:00:00Z
           stale-issue-label: "stale"

.github/workflows/test-bundle.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # checkout full tree
           fetch-depth: 0

.github/workflows/test-quarto-latexmk.yml

@@ -22,7 +22,7 @@ jobs:
           - { os: ubuntu-latest }
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -55,7 +55,7 @@ jobs:
           ../dist/bin/tinitex/x86_64-unknown-linux-gnu/tinitex --help
 
       - name: Upload binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: tinitex-${{ matrix.config.os }}
           path: |

.github/workflows/test-smokes-parallel.yml

@@ -53,7 +53,7 @@ jobs:
       BUCKETS: ${{ steps.tests-buckets.outputs.BUCKETS }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Quarto
         uses: quarto-dev/quarto-actions/setup@v2