Modernize GitHub Actions in the CI templates: Node 20 deprecation, one archived action, stale pins

[gagelarsen]

Every job in the generated GitHub workflows emits a Node.js 20 deprecation warning. Filing the audit rather than fixing it now — this is unrelated to any work in flight, and the warnings do not fail anything.

Symptom

One warning annotation per job, e.g. from xmscore:

Node.js 20 is deprecated. The following actions target Node.js 20 but are being
forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5,
actions/upload-artifact@v4, nelonoel/branch-name@v1.0.1

Pre-existing, not caused by the Python 3.14 work — master emits the identical warning. The 3.14 fan-out only multiplies the count, since a repo with a 15-job matrix produces 15 of them.

GitHub is currently force-running these on Node 24, so nothing is broken today. The deadline is whenever Node 20 support is removed outright.

Audit

Action	Pinned	Latest	Uses	Note
actions/upload-release-asset	v1	v1.0.2	4	archived 2021-03-03 — no version to bump to
actions/setup-python	v2	v7.0.0	1	flake job only; five majors behind and inconsistent with the v5 used elsewhere in the same template
actions/checkout	v4	v7.0.1	6
actions/upload-artifact	v4	v7.0.1	10
actions/setup-python	v5	v7.0.0	3
allenevans/set-env	v2.0.0	v4.0.0	9
microsoft/setup-msbuild	v2	v3	1
little-core-labs/get-git-tag	v3.0.2	v3.0.2	5	at latest; last pushed 2023-10-31
nelonoel/branch-name	v1.0.1	v1.0.1	4	at latest; last pushed 2024-06-19
bruceadams/get-release	v1.3.2	v1.3.2	4	at latest; last pushed 2024-06-01
ilammy/msvc-dev-cmd	v1	v1.13.0	1	floating major, tracks fine
maxim-lobanov/setup-xcode	v1	v1.7.0	1	floating major, tracks fine

Agreed scope when this is picked up

1. Bump the first-party actions to current majors: checkout, setup-python (both the v5 and the stray v2), upload-artifact. Each major needs its changelog read — upload-artifact and checkout have both shipped breaking changes across majors in the past.
2. Replace actions/upload-release-asset. Archived, and it sits on the tag/release path uploading Conan cache tarballs. gh release upload or softprops/action-gh-release.
3. Drop the thin third-party wrappers in favour of native equivalents, removing four dependencies from the release path:
   • allenevans/set-env → echo "VAR=value" >> $GITHUB_ENV
   • little-core-labs/get-git-tag → ${GITHUB_REF#refs/tags/}
   • nelonoel/branch-name → ${GITHUB_REF#refs/heads/} / github.head_ref
   • bruceadams/get-release → gh release view
4. Leave ilammy/msvc-dev-cmd and maxim-lobanov/setup-xcode on their floating majors.

Why this is deliberately not urgent

Warnings only; the actions still run. But two things make it worth scheduling rather than ignoring:

• actions/upload-release-asset is archived and on the release-publishing path, so it will never be fixed upstream.
• Every xmsconan template change requires regenerating all eight consumer repos. Batching this with another rollout saves a pass over the suite — worth considering when the next one comes up.

Blast radius

Touches every job in github-ci.yaml.jinja and github-coverage.yaml.jinja, so a bad major bump breaks CI in all eight repos at once. Wants its own PR, its own release, and a canary repo before the rest. tests/test_ci_yaml_validation.py will catch YAML-level breakage but cannot catch behavioral changes in an action.