Refresh upload-artifact pin to a Node.js 24-native release

[errfld]

Summary

The post-merge CI run for PR #198 is green but emits a deprecation annotation because the pinned actions/upload-artifact v5 action targets Node.js 20 and GitHub is forcibly running it on Node.js 24. Refresh the pin to a Node.js 24-native release before the compatibility shim is removed.

Evidence

• Main CI run: https://github.com/errfld/git-smee/actions/runs/30789953885
• Annotation: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 targets Node.js 20 and is being forced to run on Node.js 24.
• Current usage: .github/workflows/ci.yml:202 pins v5 SHA 330a01c490aca151604b8cf639adc76d48f6c5d4.
• Latest verified release is v7.0.1, published 2026-04-10, with commit SHA 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a; its action.yml declares runs.using: node24.
• This is a narrow follow-up to completed issue Refresh CI actions and macOS runner labels before deprecations bite #179, which previously refreshed the same action from v4 to v5.

Proposed change

Update only the actions/upload-artifact full-SHA pin and version comment in .github/workflows/ci.yml. Preserve the existing coverage artifact name, path, and upload behavior.

Acceptance criteria

• actions/upload-artifact is pinned by full SHA to a verified Node.js 24-native release.
• The coverage artifact inputs remain unchanged.
• Workflow YAML parses and actionlint passes.
• The hosted CI matrix passes and the upload-artifact Node.js 20 deprecation annotation is absent on the exact PR/main head.

Validation guidance

• Establish RED from run 30789953885 and a structural assertion that the current pin is Node.js 20-era v5.
• Verify the replacement SHA/tag and runs.using: node24 through the upstream GitHub API.
• Run workflow YAML parsing and actionlint locally when available, then verify hosted CI annotations after merge.

[errfld]

Implementation update for #199

Summary of changes

• Updated .github/workflows/ci.yml from the Node.js 20-era actions/upload-artifact v5 pin to v7.0.1 at full SHA 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a.
• Preserved the coverage artifact name (coverage-lcov) and path (lcov.info).

Preflight knowledge checks

• Memory search run: no matching memory issues for upload-artifact / Node.js 24.
• Decision search run: no matching decision issues.
• Blocker/parent/linked issues reviewed: no blockers or dependencies; reviewed completed predecessor Refresh CI actions and macOS runner labels before deprecations bite #179 and its implementation note.
• Prior task notes reviewed: Refresh CI actions and macOS runner labels before deprecations bite #179 documented the prior v4-to-v5 refresh and the requirement to retain full-SHA pinning.

Validation

• TDD RED: main CI run 30789953885 emitted the Node.js 20 forced-compatibility annotation; a local structural assertion also failed against the pre-change v5 pin.
• GREEN structural check: v7.0.1 pin appears once, old v5 pin is absent, and coverage artifact inputs are unchanged.
• Upstream verification: GitHub API shows v7.0.1 is pinned at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a; that exact commit's action.yml declares runs.using: node24.
• Local checks: all workflow YAML files parsed with PyYAML; cargo fmt --all -- --check; git diff --check.
• Hosted checks: PR ci: refresh upload-artifact for Node 24 #200 CI matrix, MSRV, Linux/macOS/Windows, coverage, security, repository guards, workflow lint/actionlint, and CodeQL passed on exact head 9f5760c9369f658887a0bcd18dd5334db295db39.
• Hosted annotation check: both exact-head coverage jobs report zero annotations, proving the upload-artifact Node.js 20 warning is gone.
• Review state: no inline findings; CodeRabbit was rate-limited but its status context passed, and repository merge policy reports the PR clean/mergeable without a required review.

Learnings

• Action major pins can become compatibility warnings again as GitHub advances its runner Node runtime; checking the upstream action.yml at the exact pinned SHA prevents relying on version comments alone.
• Check-run annotation API reads provide deterministic proof that a deprecation warning was removed, beyond merely observing a green job.

Follow-ups

• No further follow-up required for this action pin.

References

• PR: ci: refresh upload-artifact for Node 24 #200
• Commit: 9f5760c9369f658887a0bcd18dd5334db295db39
• Pre-change warning: https://github.com/errfld/git-smee/actions/runs/30789953885

[errfld]

Merged PR #200 as a8a6327398a2ebe53e110c29088290974ad742d2 after the full hosted matrix and workflow lint passed. Exact-head coverage check annotations were empty, confirming the Node.js 20 upload-artifact warning is removed.

[errfld]

Post-merge verification on main is complete: CI run 30790486003 and CodeQL run 30790485632 both passed on merge commit a8a6327398a2ebe53e110c29088290974ad742d2. Coverage check run 91612762601 reports zero annotations, confirming the Node.js 20 compatibility warning remains absent after merge.