chore(ci): bump GitHub Actions off Node 20 runtimes

.github/workflows/clk-rebase.yml

@@ -56,7 +56,7 @@ jobs:
           dnf install -y git python3-GitPython
 
       - name: Checkout kernel-src-tree
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           repository: ctrliq/kernel-src-tree
           token: ${{ steps.generate-token.outputs.token }}
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: true
 
       - name: Checkout kernel-src-tree-tools
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           repository: ctrliq/kernel-src-tree-tools
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/kernel-build-and-test-multiarch-trigger.yml

@@ -229,7 +229,7 @@ jobs:
           fi
 
       - name: Upload check results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         if: always()  # Upload even if checks fail
         with:
           name: check-results

.github/workflows/kernel-build-and-test-multiarch.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Download check results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: check-results
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -209,7 +209,7 @@ jobs:
 
       - name: Upload head_ref for baseline search
         if: steps.pr_metadata.outputs.skip_ci != 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: head-ref
           path: pr_metadata/head_ref.txt
@@ -259,15 +259,15 @@ jobs:
     steps:
     - name: Generate GitHub App token
       id: generate_token
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
       with:
-        app-id: ${{ secrets.APP_ID }}
+        client-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.APP_PRIVATE_KEY }}
         repositories: |
           kernel-container-build
 
     - name: Checkout kernel source
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         fetch-depth: 1
         path: kernel-src-tree
@@ -281,7 +281,7 @@ jobs:
         git checkout -b "$HEAD_REF"
 
     - name: Checkout kernel-container-build
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         repository: ctrliq/kernel-container-build
         ref: main
@@ -338,7 +338,7 @@ jobs:
 
     # Upload kernel compilation logs
     - name: Upload kernel compilation logs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       if: always()
       with:
         name: kernel-compilation-logs-${{ matrix.arch }}
@@ -347,7 +347,7 @@ jobs:
 
     # Upload kselftests qcow2 image
     - name: Upload kselftests qcow2 image
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       if: ${{ always() && needs.pre-setup.outputs.skip_kselftests == 'false' }}
       with:
         name: kernel-qcow2-kselftests-${{ matrix.arch }}
@@ -358,7 +358,7 @@ jobs:
 
     # Upload LTP qcow2 image
     - name: Upload LTP qcow2 image
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       if: ${{ always() && needs.pre-setup.outputs.skip_ltp == 'false' }}
       with:
         name: kernel-qcow2-ltp-${{ matrix.arch }}
@@ -370,7 +370,7 @@ jobs:
 
     # Upload plain boot qcow2 image (only when both kselftests and LTP are skipped)
     - name: Upload plain boot qcow2 image
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       if: ${{ always() && needs.pre-setup.outputs.skip_kselftests == 'true' && needs.pre-setup.outputs.skip_ltp == 'true' }}
       with:
         name: kernel-qcow2-boot-${{ matrix.arch }}
@@ -390,15 +390,15 @@ jobs:
     steps:
     - name: Generate GitHub App token
       id: generate_token
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
       with:
-        app-id: ${{ secrets.APP_ID }}
+        client-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.APP_PRIVATE_KEY }}
         repositories: |
           kernel-container-build
 
     - name: Checkout kernel-container-build
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         repository: ctrliq/kernel-container-build
         ref: main
@@ -417,21 +417,21 @@ jobs:
 
     - name: Download qcow2 image (kselftests)
       if: ${{ needs.pre-setup.outputs.skip_kselftests == 'false' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kernel-qcow2-kselftests-${{ matrix.arch }}
         path: output
 
     - name: Download qcow2 image (LTP — kselftests skipped)
       if: ${{ needs.pre-setup.outputs.skip_kselftests == 'true' && needs.pre-setup.outputs.skip_ltp == 'false' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kernel-qcow2-ltp-${{ matrix.arch }}
         path: output
 
     - name: Download qcow2 image (plain boot — both skipped)
       if: ${{ needs.pre-setup.outputs.skip_kselftests == 'true' && needs.pre-setup.outputs.skip_ltp == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kernel-qcow2-boot-${{ matrix.arch }}
         path: output
@@ -453,7 +453,7 @@ jobs:
 
     # Upload boot logs
     - name: Upload boot logs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       if: always()
       with:
         name: boot-logs-${{ matrix.arch }}
@@ -472,15 +472,15 @@ jobs:
     steps:
     - name: Generate GitHub App token
       id: generate_token
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
       with:
-        app-id: ${{ secrets.APP_ID }}
+        client-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.APP_PRIVATE_KEY }}
         repositories: |
           kernel-container-build
 
     - name: Checkout kernel-container-build
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         repository: ctrliq/kernel-container-build
         ref: main
@@ -498,7 +498,7 @@ jobs:
         fi
 
     - name: Download qcow2 image
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kernel-qcow2-kselftests-${{ matrix.arch }}
         path: output
@@ -520,7 +520,7 @@ jobs:
 
     # Upload kselftest logs
     - name: Upload kselftest logs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       if: always()
       with:
         name: kselftest-logs-${{ matrix.arch }}
@@ -542,15 +542,15 @@ jobs:
     steps:
     - name: Generate GitHub App token
       id: generate_token
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
       with:
-        app-id: ${{ secrets.APP_ID }}
+        client-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.APP_PRIVATE_KEY }}
         repositories: |
           kernel-container-build
 
     - name: Checkout kernel-container-build
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         repository: ctrliq/kernel-container-build
         ref: main
@@ -568,7 +568,7 @@ jobs:
         fi
 
     - name: Download qcow2 image
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kernel-qcow2-ltp-${{ matrix.arch }}
         path: output
@@ -600,7 +600,7 @@ jobs:
         fi
 
     - name: Upload LTP logs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       if: always()
       with:
         name: ltp-logs-${{ matrix.arch }}
@@ -634,21 +634,21 @@ jobs:
 
     steps:
     - name: Checkout kernel source
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         fetch-depth: 1
 
     - name: Generate GitHub App token
       id: generate_token
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
       with:
-        app-id: ${{ secrets.APP_ID }}
+        client-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.APP_PRIVATE_KEY }}
         repositories: |
           kernel-container-build
 
     - name: Checkout kernel-container-build
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         repository: ctrliq/kernel-container-build
         ref: main
@@ -663,17 +663,17 @@ jobs:
 
     - name: Generate GitHub App token for comparison
       id: generate_token_compare
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
       with:
-        app-id: ${{ secrets.APP_ID }}
+        client-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.APP_PRIVATE_KEY }}
         repositories: |
           kernel-src-tree
           kernel-container-build
 
     - name: Download current LTP results
       if: needs.test-ltp.result == 'success'
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: ltp-logs-${{ matrix.arch }}
         path: output-current
@@ -862,14 +862,14 @@ jobs:
 
     steps:
     - name: Checkout kernel source
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         fetch-depth: 1  # Shallow clone - only current commit needed for comparison logic
         ref: ${{ needs.pre-setup.outputs.pr_number != '0' && format('refs/pull/{0}/head', needs.pre-setup.outputs.pr_number) || needs.pre-setup.outputs.head_sha }}
 
     - name: Download current kselftest logs
       if: ${{ needs.pre-setup.outputs.skip_kselftests == 'false' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kselftest-logs-${{ matrix.arch }}
         path: output-current
@@ -885,9 +885,9 @@ jobs:
 
     - name: Generate GitHub App token for comparison
       id: generate_token_compare
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
       with:
-        app-id: ${{ secrets.APP_ID }}
+        client-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.APP_PRIVATE_KEY }}
         repositories: |
           kernel-src-tree
@@ -1227,17 +1227,17 @@ jobs:
         echo "All test stages passed and no regressions detected, proceeding with PR creation"
 
     - name: Checkout kernel source
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         fetch-depth: 100  # Fetch more history for commit counting
         token: ${{ secrets.GITHUB_TOKEN }}
         ref: ${{ needs.pre-setup.outputs.pr_number != '0' && format('refs/pull/{0}/head', needs.pre-setup.outputs.pr_number) || needs.pre-setup.outputs.head_sha }}
 
     - name: Generate GitHub App token
       id: generate_token
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3.1.1
       with:
-        app-id: ${{ secrets.APP_ID }}
+        client-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.APP_PRIVATE_KEY }}
         repositories: |
           kernel-src-tree
@@ -1275,42 +1275,42 @@ jobs:
 
     - name: Download kernel compilation logs (x86_64)
       if: steps.detect_arch.outputs.has_x86_64 == 'true'
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kernel-compilation-logs-x86_64
         path: artifacts/build/x86_64
 
     - name: Download kernel compilation logs (aarch64)
       if: steps.detect_arch.outputs.has_aarch64 == 'true'
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kernel-compilation-logs-aarch64
         path: artifacts/build/aarch64
 
     - name: Download boot logs (x86_64)
       if: steps.detect_arch.outputs.has_x86_64 == 'true'
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: boot-logs-x86_64
         path: artifacts/boot/x86_64
 
     - name: Download boot logs (aarch64)
       if: steps.detect_arch.outputs.has_aarch64 == 'true'
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: boot-logs-aarch64
         path: artifacts/boot/aarch64
 
     - name: Download kselftest logs (x86_64)
       if: steps.detect_arch.outputs.has_x86_64 == 'true' && needs.pre-setup.outputs.skip_kselftests == 'false'
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kselftest-logs-x86_64
         path: artifacts/test/x86_64
 
     - name: Download kselftest logs (aarch64)
       if: steps.detect_arch.outputs.has_aarch64 == 'true' && needs.pre-setup.outputs.skip_kselftests == 'false'
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       with:
         name: kselftest-logs-aarch64
         path: artifacts/test/aarch64

.github/workflows/lt-rebase-merge.yml

@@ -207,7 +207,7 @@ jobs:
           echo "✅ PR base branch is correct: $BASE_BRANCH"
 
       - name: Checkout kernel-src-tree
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           repository: ctrliq/kernel-src-tree
           token: ${{ steps.generate-token.outputs.token }}
@@ -216,7 +216,7 @@ jobs:
           persist-credentials: true
 
       - name: Checkout kernel-src-tree-tools
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           repository: ctrliq/kernel-src-tree-tools
           token: ${{ steps.generate-token.outputs.token }}