ci: update setup-node and upload-artifact to current majors

[katsugtgz]

ci: update setup-node and upload-artifact to current majors

The other workflow files in this repo already use setup-node@v6 and upload-artifact@v7. Two files were left behind on v4:

Changes:

• .github/workflows/e2e-fullstack.yml: actions/setup-node@v4 -> v7, actions/upload-artifact@v4 -> v7
• .github/workflows/secret-scan.yml: actions/upload-artifact@v4 -> v7

Validation:

• python3 -c "import yaml; yaml.safe_load(open(f))" passes for both files
• inputs in use (node-version, cache, cache-dependency-path, name, path, retention-days) are all supported in the new majors
• upload-artifact v4 artifacts remain readable; v6+ requires runner 2.327.1+, which GitHub-hosted runners already satisfy

Scope: the two workflow files above only. No runtime or dependency changes.

[katsugtgz]

Note for maintainers: the workflow runs on this PR show action_required because first-time fork contributors need a maintainer to approve workflow runs. The changes are version references only, as described above.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@b0e90fe). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #399   +/-   ##
=======================================
  Coverage        ?   14.83%           
=======================================
  Files           ?      387           
  Lines           ?    22857           
  Branches        ?        0           
=======================================
  Hits            ?     3391           
  Misses          ?    19466           
  Partials        ?        0           

Flag	Coverage Δ
agents-unit	9.76% <ø> (?)
cspm-unit	8.20% <ø> (?)
data-unit	17.01% <ø> (?)
identity-unit	13.01% <ø> (?)
responder-unit	26.78% <ø> (?)
tools-unit	16.60% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[fabriziosalmi]

Merged, thank you. Rebased onto main first; your commit is unchanged and still authored by you.

Checked rather than taken on trust, since the description and the diff disagree slightly. Your text says the other workflows already use setup-node@v6, and the diff goes to v7. The diff is right and the text undersells it: v7.0.0 is the current release of actions/setup-node, and v7.0.1 of actions/upload-artifact, so "current majors" in the title is accurate.

Where that leaves the repository:

action	before	after
upload-artifact	v4 in these two files, v7 in the other four places	v7 everywhere
setup-node	v4 here, v6 in five other places	v7 here, v6 in those five

So upload-artifact is now consistent and setup-node is not, with the two files you touched ahead of the rest rather than behind it. That is a pre-existing gap and not something to hold your change for; the remaining v6 usages are worth a separate sweep.

All 27 checks passed, including E2E Full-Stack (login flows), which is the workflow this changes, so both bumps are exercised rather than assumed.

One thing worth flagging, because it will affect anyone else contributing here. Branch protection on main requires 14 status checks, one of which is CodeQL. CodeQL is configured through GitHub's default setup rather than a workflow file, and it does not report on a pull request from a fork: 28 check runs on your head commit and not one of them is CodeQL, while the same check ran and passed on #406 from a branch in this repository. Your pull request was therefore BLOCKED on a check that structurally cannot run for it, with everything else green. I merged with an administrative override. That is not a reasonable thing to ask an outside contributor to depend on, and the requirement needs revisiting.

[fabriziosalmi]

Following up on the branch-protection note above: fixed. CodeQL is no longer one of the required status checks on main, so a pull request from a fork can now go green on its own merits instead of waiting on a check that never reports for it.

The other thirteen required checks are unchanged, and CodeQL still runs and still reports on pull requests from branches in this repository. It simply no longer gates a merge it cannot evaluate.

Thanks again for the contribution, and sorry you had to be the one to hit that.