GitHub Actions versions are stale across most workflows

[petercorke]

Audited 2026-07-29 (prompted by a similar finding in another toolbox
repo). docs.yml's actions have been bumped to current majors as part of
the same change that fixed the Image sidebar bug (see git history), but
the rest of .github/workflows/ was deliberately left alone — bumping
release.yml touches the real PyPI publish pipeline and deserves its own
careful pass (verify the actual release workflow file, don't just bump
and hope), not a drive-by alongside a docs fix.

Action	Pinned	Latest (2026-07-29)	Where	Gap
actions/download-artifact	v4	v8	release.yml	4 majors
actions/upload-artifact	v4	v7	release.yml	3 majors
actions/checkout	v6	v7	ci.yml, release.yml	1 major
actions/setup-python	v6	v7	release.yml	1 major
googleapis/release-please-action	v4	v5	release-please.yml	1 major
amannn/action-semantic-pull-request	v5	v6	commitlint.yml	1 major
mamba-org/setup-micromamba	v2	v3	ci.yml	1 major
codecov/codecov-action	v6	v7	ci.yml	1 major
pypa/gh-action-pypi-publish	release/v1	—	release.yml	none — floating tag, already tracks latest v1.x

download-artifact and upload-artifact are the standouts — 3-4 majors
behind, both used in release.yml's build→publish artifact handoff. Most
of these actions/* majors turned out to be low-risk (mainly Node.js
runtime bumps: v24 requires Actions Runner ≥ v2.327.1, a non-issue on
GitHub-hosted runners), confirmed while bumping docs.yml, but
download-artifact/upload-artifact v4→v7/v8 haven't been checked for
breaking input/output changes yet — do that before bumping release.yml.

Note: the mamba-org/setup-micromamba row is moot once the separate
conda/micromamba-removal work lands — don't bump that one, just delete it.

Fix

For each remaining workflow file, check that action's release notes
between the pinned and latest major for actual breaking changes (not just
Node runtime bumps), then bump. Do release.yml last and most carefully
— it's the one that actually publishes to PyPI. Re-run
.github/workflows/ci.yml on a real PR after bumping it, since it's the
main test gate.