Update GitHub Actions to Node 24

[felix-exon]

Summary

• update actions/checkout to v7, upload-artifact to v7, and download-artifact to v8
• update softprops/action-gh-release to v3
• keep existing workflow inputs and release behavior unchanged

Testing

• actionlint v1.7.12
• bun run typecheck
• bun run build
• bun test (22 tests)
• CLI help smoke test

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • Updated automated build and release workflows to use newer action versions.
  • Improved reliability of artifact handling and release publishing processes.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI workflow upgrades actions/checkout from v4 to v7. The release workflow upgrades checkout, artifact upload, artifact download, and GitHub release actions across build, release, and Homebrew tap jobs.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: updating GitHub Actions dependencies to versions that run on Node 24.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/ci.yml (1)

13-14: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Disable credential persistence on read-only checkouts. These four actions/checkout steps only read the repository to build, test, or compute metadata; none of them push back to the checked-out repository. actions/checkout@v7 still persists the GITHUB_TOKEN in the local git config by default (flagged by zizmor as artipacked), which is an unnecessary credential-exposure surface for steps that never need to authenticate a push.

• .github/workflows/ci.yml#L13-L14: add with: persist-credentials: false to the CI checkout step.
• .github/workflows/release.yml#L62-L65: add persist-credentials: false to the build-binaries checkout step.
• .github/workflows/release.yml#L108-L117: add persist-credentials: false to the release job checkout step.
• .github/workflows/release.yml#L147-L154: add persist-credentials: false to the "Checkout source repo" step in update-homebrew-tap.

Do not apply this to the tap-repo checkout at .github/workflows/release.yml#L170-L175; it intentionally needs the persisted HOMEBREW_TAP_PAT to commit and push the formula update.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 13 - 14, Disable credential
persistence for the read-only checkout steps by adding persist-credentials:
false under the Checkout step in .github/workflows/ci.yml lines 13-14, and under
the build-binaries checkout (.github/workflows/release.yml lines 62-65), release
job checkout (lines 108-117), and “Checkout source repo” step in
update-homebrew-tap (lines 147-154). Do not modify the tap-repo checkout at
.github/workflows/release.yml lines 170-175, which requires persisted
credentials for pushing changes.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 13-14: Disable credential persistence for the read-only checkout
steps by adding persist-credentials: false under the Checkout step in
.github/workflows/ci.yml lines 13-14, and under the build-binaries checkout
(.github/workflows/release.yml lines 62-65), release job checkout (lines
108-117), and “Checkout source repo” step in update-homebrew-tap (lines
147-154). Do not modify the tap-repo checkout at .github/workflows/release.yml
lines 170-175, which requires persisted credentials for pushing changes.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 32868b15-72ad-401f-8089-66f26c9f406b

📥 Commits

Reviewing files that changed from the base of the PR and between 9fd0e13 and 9bfa949.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/release.yml

[felix-exon]

CodeRabbit-Hinweis zu persist-credentials: false: Das Hardening für die vier rein lesenden Checkouts ist grundsätzlich sinnvoll, bleibt in diesem PR aber bewusst außerhalb des freigegebenen Scopes. Dieser PR aktualisiert ausschließlich die Action-Majors auf ihre Node-24-Linien und lässt bestehende Inputs sowie das Release-Verhalten unverändert. Der Tap-Checkout muss seine Credentials für den anschließenden Push weiterhin behalten; das übrige Credential-Hardening sollte separat erfolgen.