fix(ci): bump GitHub Actions to Node 24 runtimes

[BnJam]

Closes #79

Summary

GitHub flagged actions running on the deprecated Node.js 20 runtime (forced to Node 24 by default June 16, 2026; removed from runners Sept 16, 2026). This PR bumps every Node 20 action in the workflows to its first Node 24-compatible major, verified against each action's action.yml (runs.using: node24).

Changes

• actions/checkout@v4 -> @v5
• actions/setup-python@v5 -> @v6
• actions/upload-artifact@v4 -> @v6
• actions/download-artifact@v4 -> @v7
• astral-sh/setup-uv@v3 -> @v7
• docker/setup-qemu-action@v3 -> @v4
• actions/upload-pages-artifact@v3 -> @v5 (composite; latest)
• actions/configure-pages@v5 -> @v6
• actions/deploy-pages@v4 -> @v5

Applied across all 4 workflow files (ci.yml, release.yml, static.yml, tag-release.yml), including commented-out references in release.yml for consistency. All bumps are runtime-only with unchanged inputs, and the newer majors require only runner >= v2.327.1, which GitHub-hosted runners satisfy.

CI note

The initial CI run failed in the tox -e lint step because Ruff 0.16.0 (released 2026-07-23) expanded its default enabled rule set from 59 to 413 rules; the unpinned ruff>=0.4.0 in tox.ini then flagged 46 pre-existing violations in code identical to main. Added [tool.ruff.lint] select = ["E4", "E7", "E9", "F"] to pyproject.toml to restore the classic rule set the project's CI was previously green with, as recommended in the Ruff 0.16 migration notes. CI is now fully green.

[BnJam]

Summary

Security gate passed. Every bumped action was verified against its canonical repository at the exact tag in question: actions/checkout@v5, actions/setup-python@v6, actions/upload-artifact@v6, actions/download-artifact@v7, astral-sh/setup-uv@v7, docker/setup-qemu-action@v4, actions/configure-pages@v6, actions/deploy-pages@v5 all exist and declare runs.using: node24; actions/upload-pages-artifact@v5 is a composite action and is the latest v5 tag, as claimed. Remaining actions not bumped (PyO3/maturin-action@v1, ncipollo/release-action@v1 via mutable tags, dtolnay/rust-toolchain@stable composite) are already Node 24 or runtime-free, so the "every Node 20 action" claim holds. Cross-action compatibility is sound: upload-artifact@v6/download-artifact@v7 share the v4+ artifact backend, and the Pages trio is mutually current. No workflow uses pull_request_target, so checkout v5.x's allow-unsafe-pr-checkout default change is not a concern here. This is a clean, low-risk CI migration.

Findings

• [Minor] pyproject.toml:82-89 — Unrelated change bundled into a "workflow-only" PR. The PR body describes this as a workflow-only change ("Tests: N/A (workflow-only change)") and lists only action bumps, but the diff also adds a [tool.ruff] configuration pinning the pre-0.16 default rule set (E4, E7, E9, F). This is defensible (the project's unbounded ruff>=0.14.4 in pyproject.toml:73 and ruff>=0.4.0 in tox.ini would otherwise pull in Ruff 0.16's 413-rule defaults and break the CI ruff check gate), but it is unrelated to the Node 24 migration and contradicts the repo's "never batch unrelated changes" convention (AGENTS.md §17). Recommend splitting into a separate PR or at minimum documenting it in the PR body.
• [Minor] pyproject.toml:88-89 — Reduced lint surface with no migration tracker. Pinning select = ["E4","E7","E9","F"] silently disables the expanded Ruff 0.16 defaults (W, I, UP, B, SIM, etc.) for all future runs. The inline comment frames this as temporary ("until the codebase is migrated"), but there is no linked issue or follow-up plan. If this is intentional, consider a tracking issue; if not, prefer migrating the codebase and keeping the full default set.
• [Minor] Mutable major tags in release-critical workflows. release.yml and tag-release.yml drive production PyPI publishing but reference mutable @v5/@v6/@v7 tags. These are already moving targets — actions/checkout@v5 now resolves to v5.1.0 (a [BREAKING] allow-unsafe-pr-checkout change) and actions/setup-python has already shipped v7. The minimal-bump policy is a reasonable start, but consider pinning SHA or full version tags on the publish path for reproducibility, and note that dependabot will re-flag these soon anyway.
• [Minor] release.yml:237-326 — Bumping commented-out references. The version bumps were also applied to the commented-out jobs. Harmless, but it churns dead code (AGENTS.md §17 discourages dead code) and the commented examples will drift from whatever versions are current when/if they are ever restored. Consider deleting the commented jobs instead.
• [Info] ci.yml:93 — upload-artifact@v6 upload with no matching download. The benchmark artifact is uploaded for manual retrieval only; no download step exists, so no cross-major mismatch. Confirmed intentional.

Verdict

APPROVE — All security and compatibility claims were independently verified (canonical repos, node24 runtimes, compatible artifact/Pages generations), and the only substantive issue is an unrelated pyproject.toml ruff-config change that should ideally be split or documented.

[BnJam]

technocore review via pipeline code-review:

Merged PR #80.