chore(deps): update github actions (major)

.github/workflows/docker-publish.yml

@@ -112,7 +112,7 @@ jobs:
       REQ_CONCURRENT: ${{ inputs.req-concurrent }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -127,7 +127,7 @@ jobs:
 
       - name: Download context artifact
         if: ${{ inputs.artifact-name != '' }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{ inputs.context }}

.github/workflows/gradle-build-pr.yml

@@ -92,7 +92,7 @@ jobs:
     steps:
       - name: Filter changed paths
         id: filter
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           filters: ${{ inputs.paths-filters }}
 
@@ -117,7 +117,7 @@ jobs:
       RESOLVED_GRADLE_TASK: ${{ inputs.gradle-task != '' && inputs.gradle-task || (inputs.run-tests && 'build test' || 'build') }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Toolchain info
         shell: bash
@@ -156,7 +156,7 @@ jobs:
 
       - name: Upload test reports
         if: ${{ always() && inputs.run-tests }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-reports-${{ matrix.os }}-jdk${{ inputs.java-version }}
           path: |
@@ -176,7 +176,7 @@ jobs:
       contents: read
     steps:
       - name: Download all test reports
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
           pattern: test-reports-*

.github/workflows/gradle-docker-context.yml

@@ -86,7 +86,7 @@ jobs:
       GRADLE_OPTS: "-Dorg.gradle.parallel=true -Dorg.gradle.caching=true -Dorg.gradle.welcome=never"
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Validate Gradle wrapper
         if: ${{ inputs.validate-wrapper }}
@@ -111,7 +111,7 @@ jobs:
           fi
 
       - name: Upload context artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{ inputs.context-path }}

.github/workflows/gradle-publish.yml

@@ -53,7 +53,7 @@ jobs:
       GRADLE_OPTS: "-Dorg.gradle.parallel=true -Dorg.gradle.caching=true -Dorg.gradle.welcome=never"
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Toolchain info
         shell: bash
@@ -99,7 +99,7 @@ jobs:
 
       - name: Upload build reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: publish-reports-jdk${{ inputs.java-version }}
           path: |

.github/workflows/markdown-lint.yml

@@ -66,7 +66,7 @@ jobs:
     steps:
       - name: Filter changed paths
         id: filter
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           filters: ${{ inputs.paths-filters }}
 
@@ -82,10 +82,10 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Run markdownlint-cli2
-        uses: DavidAnson/markdownlint-cli2-action@v18
+        uses: DavidAnson/markdownlint-cli2-action@v24
         with:
           globs: ${{ inputs.glob }}
           config: ${{ inputs.config-file }}
@@ -97,7 +97,7 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Lychee link checker
         uses: lycheeverse/lychee-action@v2

.github/workflows/pr-lint.yml

@@ -43,7 +43,7 @@ jobs:
     name: Conventional PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -60,9 +60,9 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
       - name: Install commitlint
         run: npm install --no-save @commitlint/cli @commitlint/config-conventional
       - name: Lint commits in range

.github/workflows/sbom-publish.yml

@@ -97,15 +97,15 @@ jobs:
       # scan and checking out would just cost time.
       - name: Checkout
         if: ${{ inputs.artifact-name == '' }}
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Prepare SBOM directory
         shell: bash
         run: mkdir -p sbom
 
       - name: Download SBOM artifact
         if: ${{ inputs.artifact-name != '' }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact-name }}
           path: sbom
@@ -169,7 +169,7 @@ jobs:
 
       - name: Upload SBOM artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sbom-${{ inputs.project-name }}-${{ inputs.project-version }}
           path: sbom/**

.github/workflows/security-scan.yml

@@ -109,13 +109,13 @@ jobs:
     steps:
       - name: Checkout
         if: ${{ inputs.scan-type != 'image' && inputs.artifact-name == '' }}
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
 
       - name: Download artifact to scan
         if: ${{ inputs.artifact-name != '' }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{ inputs.artifact-path }}
@@ -201,7 +201,7 @@ jobs:
 
       - name: Upload SARIF artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: trivy-sarif-${{ inputs.scan-type }}
           path: trivy-results.sarif