build(deps): adopt the five action major bumps as one commit

[thevolatilebit]

Resolves the five open Dependabot PRs — #19, #20, #21, #22, #23 — by landing their exact union in a single commit, plus the one config change that a bump silently invalidated.

Why consolidate rather than merge five PRs

All five edit the same uses: block in .github/workflows/CI.yml (three also edit Runic.yml), on adjacent lines. main requires linear history, so each merge would force a rebase of the remaining four and another ~90-minute matrix run. Each PR is already green on its own head, so this commit is their union, validated once as a set.

PR	Bump	Files
#23	actions/checkout v4 → v7	CI.yml ×4, Runic.yml
#19	julia-actions/setup-julia v2 → v3	CI.yml ×4, Runic.yml, CompatHelper.yml
#20	julia-actions/cache v2 → v3	CI.yml ×4, Runic.yml
#21	julia-actions/julia-downgrade-compat v1 → v2	CI.yml
#22	codecov/codecov-action v5 → v7	CI.yml

Breaking changes reviewed

All four majors move to a Node 24 action runtime, which the hosted runners already provide.

• setup-julia v3 — changes version: min semantics (min major/minor, latest patch) and now errors rather than warns on x86_64 Julia under Apple Silicon. Neither applies: we pin '1.12'/'1'/nightly and never set arch.
• cache v3 — JS rewrite; now saves the cache on failed jobs too (save-always, default true). Welcome for the nightly job, which occasionally hits its 90-minute timeout.
• checkout v7 — only tightens fork checkout under pull_request_target / workflow_run, events this repo does not use. v6's credential-file change does not affect julia-docdeploy (Documenter deploys via DOCUMENTER_KEY).
• codecov v7 — keeps the files and token inputs; the step stays continue-on-error.

The one non-mechanical change: julia-downgrade-compat

v2 replaces v1's textual Project.toml rewriting with a Resolver.jl min-resolve, and its skip input is now consulted only under mode: forcedeps. Our skip: Random, Statistics, TOML would have become inert config carrying a comment that no longer described it, so it is removed — v2 handles stdlibs itself, and its default mode: alldeps pins every dep and weakdep to its floor, which is exactly what the Project.toml floor comments already claim this job does.

forcedeps was considered and rejected: it min-resolves deps only, which would drop the Plots/Arrow weakdep floors that cfaffaf deliberately raised so this job would exercise them.

Note this is a silent semantic change CI cannot catch — the Downgrade compat job passes either way — which is the main reason these bumps wanted a read rather than a rubber stamp.

Note on #22's red check

The Julia nightly - ubuntu-latest job on #22 was cancelled at the 90-minute timeout, not failed on the bump; that job does not use codecov-action at all, and the job is continue-on-error: true (informational).

🤖 Generated with Claude Code