From 1223115b976cea7b870270fb562acca0d0651ab1 Mon Sep 17 00:00:00 2001
From: Chad Nuttall <chadnuttall1@gmail.com>
Date: Fri, 25 Sep 2026 10:14:19 -0400
Subject: [PATCH] Migrate GitHub Actions to v7 (checkout, setup-node,
 upload-artifact)

Bump the three actions in tests.yml and production-smoke.yml from v5 to
v7 as one coordinated migration. No trigger uses pull_request_target or
workflow_run, so checkout v7's fork-PR hardening does not affect these
workflows. All three v7 releases run on node24, matching the runtime
checkout@v5.1 and setup-node@v5 already use inside the pinned Playwright
noble container.

Preserves persist-credentials: false on every checkout, the minimal
permissions blocks, node-version 24 with npm caching, and the
if: always() upload steps with 14-day retention.

Closes #89
---
 .github/workflows/production-smoke.yml |  6 +++---
 .github/workflows/tests.yml            | 12 ++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/production-smoke.yml b/.github/workflows/production-smoke.yml
index 201ecf0..cc94aac 100644
--- a/.github/workflows/production-smoke.yml
+++ b/.github/workflows/production-smoke.yml
@@ -42,10 +42,10 @@ jobs:
     env:
       SMOKE_BASE_URL: ${{ inputs.base_url || 'https://www.seasaba.com' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
@@ -57,7 +57,7 @@ jobs:
           echo "smoke target: $SMOKE_BASE_URL"
       - run: npm ci
       - run: npm run test:smoke:prod
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: production-smoke-results
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index c668007..caea9ea 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -24,10 +24,10 @@ jobs:
       options: --user 1001
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
@@ -38,7 +38,7 @@ jobs:
       - run: npm run test:coverage
       - run: npm run build:test
       - run: npm run test:e2e
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: website-test-results
@@ -57,10 +57,10 @@ jobs:
       options: --user 1001
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
@@ -69,7 +69,7 @@ jobs:
       # Lab budgets vs the test build: analytics IDs empty + vendors blocked
       # inside the run, so no third-party uptime can flake the gate.
       - run: node scripts/perf-baseline.mjs
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: performance-report