Update artifact actions to Node 24 runtimes

.github/workflows/release.yml

@@ -75,7 +75,7 @@ jobs:
           test "$(find dist -maxdepth 1 -name '*.whl' | wc -l)" -eq 1
           test "$(find dist -maxdepth 1 -name '*.tar.gz' | wc -l)" -eq 1
           sha256sum dist/*.whl dist/*.tar.gz > dist/SHA256SUMS
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: charactercheck-release-${{ inputs.version }}
           path: dist/
@@ -94,7 +94,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: charactercheck-release-${{ inputs.version }}
           path: dist
@@ -123,7 +123,7 @@ jobs:
       contents: read
       attestations: write
     steps:
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: charactercheck-release-${{ inputs.version }}
           path: dist
@@ -142,7 +142,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: charactercheck-release-${{ inputs.version }}
           path: dist
@@ -234,7 +234,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       VERSION: ${{ inputs.version }}
     steps:
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: charactercheck-release-${{ inputs.version }}
           path: dist

tests/test_release_workflow.py

@@ -0,0 +1,35 @@
+"""Release-workflow supply-chain and runtime guardrails."""
+
+import pathlib
+import re
+import unittest
+
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+RELEASE_WORKFLOW = ROOT / ".github" / "workflows" / "release.yml"
+
+
+class TestArtifactActions(unittest.TestCase):
+    def test_artifact_actions_are_node24_generations_and_commit_pinned(self):
+        workflow = RELEASE_WORKFLOW.read_text()
+        uses = re.findall(
+            r"actions/(upload-artifact|download-artifact)@([^\s]+) # v([^\s]+)",
+            workflow,
+        )
+
+        self.assertEqual(len(uses), 5)
+        self.assertEqual([name for name, _, _ in uses].count("upload-artifact"), 1)
+        self.assertEqual([name for name, _, _ in uses].count("download-artifact"), 4)
+
+        minimum_node24_major = {"upload-artifact": 7, "download-artifact": 8}
+        for name, revision, version in uses:
+            with self.subTest(action=name, version=version):
+                self.assertRegex(revision, r"^[0-9a-f]{40}$")
+                self.assertGreaterEqual(
+                    int(version.split(".", 1)[0]),
+                    minimum_node24_major[name],
+                )
+
+
+if __name__ == "__main__":
+    unittest.main()