ci: move off the Node 20 actions, and let Dependabot keep them current

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+
+# Scoped to GitHub Actions on purpose.
+#
+# The `pub` ecosystem is deliberately left out: several dependencies here are
+# pinned or overridden for reasons Dependabot can't see — file_picker is held
+# at 10.x by appflowy_editor's API (issue #2), `intl` and
+# `path_provider_foundation` are dependency_overrides, and the whole tree is
+# constrained by the Flutter 3.41.9 pin in .fvmrc. Version-bump PRs against
+# those would be noise that has to be closed by hand. Dependabot *security*
+# alerts still cover pub packages; this file only controls version updates.
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    commit-message:
+      prefix: ci
+    # One PR for the routine bumps; a major version gets its own PR, since
+    # those carry the runtime/behaviour changes worth reviewing alone.
+    groups:
+      actions-minor:
+        update-types:
+          - minor
+          - patch

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
     name: Analyze & test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}
@@ -33,8 +33,8 @@ jobs:
     needs: analyze-test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -46,7 +46,7 @@ jobs:
       - run: flutter pub get
       - run: flutter build apk --release
       - run: flutter build appbundle --release
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: android
           path: |
@@ -58,7 +58,7 @@ jobs:
     needs: analyze-test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install Linux build deps
         run: |
           sudo apt-get update
@@ -70,7 +70,7 @@ jobs:
           cache: true
       - run: flutter pub get
       - run: flutter build linux --release
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: linux
           path: build/linux/x64/release/bundle/
@@ -80,15 +80,15 @@ jobs:
     needs: analyze-test
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}
           channel: stable
           cache: true
       - run: flutter pub get
       - run: flutter build windows --release
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: windows
           path: build/windows/x64/runner/Release/
@@ -98,7 +98,7 @@ jobs:
     needs: analyze-test
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}

.github/workflows/release.yml

@@ -39,8 +39,8 @@ jobs:
       # and lose data).
       HAS_KEYSTORE: ${{ secrets.ANDROID_KEYSTORE_BASE64 != '' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -85,7 +85,7 @@ jobs:
           echo "::notice::ANDROID_KEYSTORE_* secrets not configured — Android
           artifacts skipped (a per-run debug key would change the signing
           certificate every release and break in-place updates)."
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: env.HAS_KEYSTORE == 'true'
         with:
           name: release-android
@@ -99,7 +99,7 @@ jobs:
     # desktops.
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Compute package version
         # Dispatch dry-runs come from branches (no semver): package as 0.0.0.
         run: |
@@ -166,7 +166,7 @@ jobs:
           sed -i 's/^          //' "$PKG/DEBIAN/control"
           dpkg-deb --build --root-owner-group "$PKG" \
             "dist/markdown-studio-linux-amd64.deb"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-linux
           path: dist/
@@ -179,7 +179,7 @@ jobs:
       # exist; secrets can't be used in step `if:` directly.
       HAS_STORE_IDENTITY: ${{ secrets.MSIX_IDENTITY_NAME != '' && secrets.MSIX_PUBLISHER != '' && secrets.MSIX_PUBLISHER_DISPLAY_NAME != '' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Compute package version
         shell: pwsh
         run: |
@@ -280,7 +280,7 @@ jobs:
             --publisher-display-name $env:MSIX_PUBLISHER_DISPLAY_NAME
           Copy-Item build/windows/x64/runner/Release/markdown_studio.msix `
             dist/markdown-studio-windows-store.msix
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-windows
           path: dist/
@@ -289,7 +289,7 @@ jobs:
     name: macOS + iOS (unsigned)
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}
@@ -310,7 +310,7 @@ jobs:
           mkdir -p Payload
           cp -R build/ios/iphoneos/Runner.app Payload/
           zip -qry "dist/markdown-studio-ios-unsigned.ipa" Payload
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: release-apple
           path: dist/
@@ -326,8 +326,8 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           pattern: release-*
           merge-multiple: true