ci: bump Actions off Node 20 runtime (#6)

.github/workflows/ci.yml

@@ -9,8 +9,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: "22"
           cache: npm

.github/workflows/docs.yml

@@ -23,9 +23,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "22"
           cache: npm
@@ -38,9 +38,11 @@ jobs:
           npm run build -w website
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: website/build
+          # v4+ excludes dotfiles by default; Docusaurus needs .nojekyll.
+          include-hidden-files: true
 
   deploy:
     needs: build
@@ -50,4 +52,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/know-code.yml

@@ -13,15 +13,15 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           # Default pull_request checkout is a merge commit (no trailers).
           # Verify must run on the PR tip that carries Know-Code-Verified.
           # On push, head.sha is empty so this is github.sha (the new tip).
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "22"
           cache: npm

.github/workflows/release.yml

@@ -20,12 +20,12 @@ jobs:
     runs-on: ubuntu-latest
     environment: npm-release
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       # Node 24 → npm ≥ 11.5.1 (required for trusted publishing).
       # Do NOT set registry-url: setup-node would inject a dummy NODE_AUTH_TOKEN
       # that prevents the OIDC exchange (ENEEDAUTH).
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "24"
           package-manager-cache: false

.github/workflows/umami-proxy.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Deploy Worker
         uses: cloudflare/wrangler-action@v4

action/README.md

@@ -16,7 +16,7 @@ on:
 
 # ...
 
-- uses: actions/checkout@v4
+- uses: actions/checkout@v5
   with:
     fetch-depth: 0
     ref: ${{ github.event.pull_request.head.sha || github.sha }}

action/action.yml

@@ -38,7 +38,7 @@ runs:
   using: composite
   steps:
     - name: Setup Node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
       with:
         node-version: "22"
 

packages/cli/src/commands-core.test.ts

@@ -256,6 +256,7 @@ describe("commands: config / init / quiz / doctor / reset / ship", () => {
     const yml = consumerWorkflowYaml("develop");
     assert.match(yml, /base-branch: develop/);
     assert.match(yml, /chtnnh\/know-code\/action@v0\.3\.0/);
+    assert.match(yml, /actions\/checkout@v5/);
     assert.match(yml, /pull_request:/);
     assert.match(yml, /push:/);
     assert.match(yml, /branches:\n {6}- develop/);
@@ -274,6 +275,8 @@ describe("commands: config / init / quiz / doctor / reset / ship", () => {
       join(repoRoot, ".github", "workflows", "know-code.yml"),
       "utf8",
     );
+    assert.match(workflow, /actions\/checkout@v5/);
+    assert.match(workflow, /actions\/setup-node@v5/);
     assert.match(workflow, /push:/);
     assert.match(workflow, /branches: \[main\]/);
     assert.match(workflow, /verify --from/);
@@ -283,6 +286,7 @@ describe("commands: config / init / quiz / doctor / reset / ship", () => {
     assert.match(workflow, /else\n            know-code verify\n/);
 
     const action = readFileSync(join(repoRoot, "action", "action.yml"), "utf8");
+    assert.match(action, /actions\/setup-node@v5/);
     assert.match(action, /^ {2}from:/m);
     assert.match(action, /zero before SHA/);
     assert.match(action, /--from \$FROM/);

packages/cli/src/commands/init.ts

@@ -26,7 +26,7 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           ref: \${{ github.event.pull_request.head.sha || github.sha }}

website/docs/ci.md

@@ -26,7 +26,7 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha || github.sha }}