Use current official GitHub Actions version tags

Replace SHA references with verified current major tags throughout workflows and composite actions. Preserve the Pages .nojekyll artifact with the supported v5 input and remove shellcheck warnings from job summaries.

Validation: actionlint, all nine YAML files parsed with duplicate-key checks, repository governance, website source closure, and git diff --check passed. This checkpoint changes YAML only.

Author: KSemenenko

.github/workflows/Features/BenchmarkComparisons/DeploySite/action.yml

@@ -7,7 +7,7 @@ runs:
   using: composite
   steps:
     - name: Download checked website files
-      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      uses: actions/download-artifact@v8
       with:
         name: site-qualification-${{ env.QUALIFIED_REVISION }}-${{ github.run_attempt }}
         path: qualification
@@ -31,10 +31,10 @@ runs:
         jq -e '.ok == true' predeploy-isolated-proof.json > /dev/null
         date --utc --iso-8601=seconds > predeploy-checked-at.txt
     - name: Configure GitHub Pages
-      uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+      uses: actions/configure-pages@v6
     - name: Deploy website to GitHub Pages
       id: deployment
-      uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+      uses: actions/deploy-pages@v5
     - name: Record website deployment result
       if: always()
       env:
@@ -46,7 +46,7 @@ runs:
         jq -n --arg outcome "$DEPLOYMENT_OUTCOME" --arg url "$DEPLOYMENT_URL" --arg revision "$SITE_REVISION" --arg run_url "https://github.com/$GH_REPO/actions/runs/$GITHUB_RUN_ID" --argjson attempt "$GITHUB_RUN_ATTEMPT" '{schemaVersion:1,siteSourceRevision:$revision,qualification:{runUrl:$run_url,attempt:$attempt},provider:{outcome:$outcome,pageUrl:$url}}' > deployment-receipt.json
     - name: Save website deployment results
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@v7
       with:
         name: site-publication-${{ github.run_id }}-${{ github.run_attempt }}
         path: |

.github/workflows/Features/BenchmarkComparisons/QualifySite/action.yml

@@ -56,15 +56,15 @@ runs:
         printf 'KEYLOAD_SITE_BENCHMARK_MODE=%s\n' "$benchmark_mode" >> "$GITHUB_ENV"
         printf 'benchmark_mode=%s\n' "$benchmark_mode" >> "$GITHUB_OUTPUT"
     - name: Download website source
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      uses: actions/checkout@v7
       with:
         ref: ${{ steps.source.outputs.revision }}
         # Keep the TUnit monitor socket below the Unix 103-byte path limit.
         path: w
         persist-credentials: false
     - name: Download current benchmark source
       if: steps.source.outputs.benchmark_mode == 'measured'
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      uses: actions/checkout@v7
       with:
         ref: ${{ steps.source.outputs.isolated_measured_revision }}
         path: measured-isolated
@@ -114,7 +114,7 @@ runs:
         cd w || exit
         git ls-files -z | xargs -0 sha256sum > "$EVIDENCE_DIR/source.sha256"
     - name: Set up .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+      uses: actions/setup-dotnet@v6
       with:
         global-json-file: w/global.json
     - name: Build and test code analyzers
@@ -183,12 +183,13 @@ runs:
       uses: ./control/.github/workflows/Features/BenchmarkComparisons/BuildIsolatedSite
     - name: Upload website for GitHub Pages
       if: success() && steps.source.outputs.mode == 'publish'
-      uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
+      uses: actions/upload-pages-artifact@v5
       with:
         path: _site
+        include-hidden-files: true
     - name: Save website test results
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@v7
       with:
         name: site-qualification-${{ steps.source.outputs.revision }}-${{ github.run_attempt }}
         path: |

.github/workflows/Features/BenchmarkComparisons/SessionSetup/action.yml

@@ -12,7 +12,7 @@ runs:
   using: composite
   steps:
     - name: Set up .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
+      uses: actions/setup-dotnet@v6
       with:
         global-json-file: global.json
     - name: Check Docker and kernel settings
@@ -24,7 +24,7 @@ runs:
       shell: bash
       run: node scripts/Features/BenchmarkComparisons/session-github-job.mjs
     - name: Download compiled benchmark runtime
-      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+      uses: actions/download-artifact@v8
       with:
         artifact-ids: ${{ inputs.runtime-artifact-id }}
         path: ${{ runner.temp }}/keyload-compiled-runtime

.github/workflows/Features/BenchmarkComparisons/SessionTeardown/action.yml

@@ -9,7 +9,7 @@ runs:
   steps:
     - name: Save execution database logs and test results
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ inputs.artifact-name }}
         path: |

.github/workflows/benchmarks.yml

@@ -32,9 +32,9 @@ jobs:
       KEYLOAD_COMPARISON_JOB_NAME: Prepare comparison runtime
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@v7
       - name: Set up .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
+        uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
       # KeyLoad cells run the released server image; this job compiles only the comparison harness.
@@ -60,7 +60,7 @@ jobs:
         id: plan
         run: node scripts/Features/BenchmarkComparisons/session-plan.mjs --output="$RUNNER_TEMP/session-plan.json" --github-output="$GITHUB_OUTPUT"
       - name: Save the canonical session plan
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: comparison-plan
           path: ${{ runner.temp }}/session-plan.json
@@ -81,14 +81,14 @@ jobs:
           [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
           reference="$KEYLOAD_IMAGE_REPOSITORY:latest@$digest"
           printf 'reference=%s\n' "$reference" >> "$GITHUB_OUTPUT"
-          printf 'KeyLoad cells use `%s`\n' "$reference" >> "$GITHUB_STEP_SUMMARY"
+          printf 'KeyLoad cells use %s\n' "$reference" >> "$GITHUB_STEP_SUMMARY"
           docker logout ghcr.io
       - name: Pack the compiled benchmark runtime
         if: (github.event_name == 'push' || inputs.mode == 'full')
         run: node scripts/Features/BenchmarkComparisons/compiled-test-bundle.mjs --pack
       - name: Save compiled runtime identities
         if: (github.event_name == 'push' || inputs.mode == 'full')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: comparison-compiled-runtime-identity
           path: |
@@ -99,7 +99,7 @@ jobs:
       - name: Save the compiled benchmark runtime
         id: runtime-bundle
         if: (github.event_name == 'push' || inputs.mode == 'full')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: comparison-compiled-test-bundle
           path: artifacts/benchmark-runtime-bundle/*
@@ -108,7 +108,7 @@ jobs:
           retention-days: 90
       - name: Save original preparation diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: comparison-runtime-qualification
           path: |
@@ -140,7 +140,7 @@ jobs:
       Benchmarks__KeyLoadImage: ${{ matrix.target == 'KeyLoad' && needs.comparison-runtime.outputs.keyload-image || '' }}
     steps: &database-steps
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@v7
       - name: Prepare the execution database session
         id: setup
         uses: ./.github/workflows/Features/BenchmarkComparisons/SessionSetup
@@ -160,7 +160,7 @@ jobs:
         run: node scripts/Features/BenchmarkComparisons/session-finalize.mjs
       - name: Save benchmark results
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifactName }}
           path: artifacts/comparisons/sessions/workers/${{ matrix.id }}/**
@@ -346,22 +346,22 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@v7
       - name: Download original authenticated session results
         run: |
           mkdir -p artifacts/comparisons/sessions
           node scripts/Features/BenchmarkComparisons/session-github-collect.mjs --input="$PWD/artifacts/comparisons/sessions/provider"
       - name: Check complete session accounting
         run: node scripts/Features/BenchmarkComparisons/session-aggregate-cli.mjs --input="$PWD/artifacts/comparisons/sessions/provider" --output="$PWD/artifacts/comparisons/sessions/aggregate"
       - name: Save combined benchmark results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: comparison-session-suite
           path: artifacts/comparisons/sessions/aggregate/**
           if-no-files-found: error
           retention-days: 90
       - name: Save GitHub result verification
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: comparison-session-provider-evidence
           path: |

.github/workflows/build-and-tests.yml

@@ -17,9 +17,9 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
       - name: Set up .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
       - name: Check repository and website source inventory
@@ -40,7 +40,7 @@ jobs:
       integration: ${{ steps.plan.outputs.integration }}
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
       - name: Read the shard manifest
         id: plan
         run: |
@@ -59,9 +59,9 @@ jobs:
       SHARD: ${{ matrix.shard }}
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
       - name: Set up .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
       - name: Build
@@ -70,7 +70,7 @@ jobs:
         run: node scripts/Features/TestInfrastructure/ci-test-shards.mjs run "$SHARD" --results-directory "$GITHUB_WORKSPACE/TestResults"
       - name: Save test results
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: test-results-units-${{ matrix.shard }}
           path: TestResults
@@ -84,9 +84,9 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
       - name: Set up .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
       - name: Build
@@ -98,7 +98,7 @@ jobs:
         run: node scripts/Features/TestInfrastructure/ci-test-shards.mjs run RC --results-directory "$GITHUB_WORKSPACE/TestResults"
       - name: Save test results
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: test-results-analyzers-recovery
           path: TestResults
@@ -118,9 +118,9 @@ jobs:
       SHARD: ${{ matrix.shard }}
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
       - name: Set up .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
       - name: Trust the development HTTPS certificate
@@ -138,7 +138,7 @@ jobs:
         run: node scripts/Features/TestInfrastructure/ci-test-shards.mjs run "$SHARD" --results-directory "$GITHUB_WORKSPACE/TestResults"
       - name: Save test results
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: test-results-integration-${{ matrix.shard }}
           path: TestResults
@@ -154,9 +154,9 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
       - name: Download test results
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@v8
         with:
           pattern: test-results-*
           path: TestResults

.github/workflows/release.yml

@@ -18,9 +18,9 @@ jobs:
         runtime: [linux-x64, linux-arm64, win-x64, win-arm64, osx-x64, osx-arm64]
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
       - name: Set up .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
       - name: Publish server and CLI
@@ -31,7 +31,7 @@ jobs:
           dotnet publish src/KeyLoad.Cli/KeyLoad.Cli.csproj --configuration Release --runtime "$RUNTIME" --self-contained true -warnaserror --output artifacts/publish/cli
           tar -czf "artifacts/keyload-$RUNTIME.tar.gz" -C artifacts/publish server cli
       - name: Save applications
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: keyload-${{ matrix.runtime }}
           path: artifacts/keyload-${{ matrix.runtime }}.tar.gz
@@ -49,9 +49,9 @@ jobs:
       IMAGE_REPOSITORY: managedcode/keyload
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
       - name: Set up .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
       - name: Sign in to GitHub Container Registry
@@ -69,9 +69,9 @@ jobs:
           [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ && "$digest" == "$latest" ]]
           mkdir -p artifacts
           printf '%s:%s@%s\n' "$image" "$GITHUB_SHA" "$digest" > artifacts/keyload-server-image.txt
-          printf 'Server image: `%s:%s@%s` (also tagged `latest`)\n' "$image" "$GITHUB_SHA" "$digest" >> "$GITHUB_STEP_SUMMARY"
+          printf 'Server image: %s:%s@%s (also tagged latest)\n' "$image" "$GITHUB_SHA" "$digest" >> "$GITHUB_STEP_SUMMARY"
       - name: Save the image reference
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: keyload-server-image
           path: artifacts/keyload-server-image.txt
@@ -83,15 +83,15 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
       - name: Set up .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        uses: actions/setup-dotnet@v6
         with:
           global-json-file: global.json
       - name: Build Docker image
         run: dotnet publish benchmarks/KeyLoad.ComparisonHost/KeyLoad.ComparisonHost.csproj /t:PublishContainer --configuration Release --runtime linux-x64 -warnaserror -p:ContainerRepository="keyload/benchmarks" -p:ContainerImageTag="$GITHUB_SHA" -p:ContainerArchiveOutputPath="$GITHUB_WORKSPACE/keyload-benchmarks.tar"
       - name: Save Docker image
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: keyload-docker-benchmarks
           path: keyload-benchmarks.tar

.github/workflows/website.yml

@@ -87,7 +87,7 @@ jobs:
           printf '%s\n' 'The triggering benchmark run did not complete within the bounded wait.' >&2
           exit 1
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.workflow_sha }}
           path: control
@@ -114,7 +114,7 @@ jobs:
       KEYLOAD_SITE_BENCHMARK_MODE: ${{ needs.qualify.outputs.benchmark_mode }}
     steps:
       - name: Download source code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.workflow_sha }}
           path: control