CI: upgrade upload-artifact pin for Node 24 runtime

[seonghobae]

Consumer evidence

ContextualWisdomLab/quarantine-sandbox-runtime root exact 7482108c0b74f58f447722a98330f9ad44215eec, native branch-coverage job 101640016078 in run 34089522598, executed actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 under the current GitHub-hosted Node 24 runtime.

The action completed its upload, but emitted all of the following current runtime warnings:

• Node.js 20 is deprecated ... action targets Node.js 20 but [is] being forced to run on Node.js 24;
• [DEP0040] DeprecationWarning: The punycode module is deprecated;
• [DEP0169] DeprecationWarning: url.parse() behavior is not standardized and prone to errors that have security implications.

The quarantine runtime contract requires deprecation warnings to be root-caused rather than hidden. Do not use ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true as a workaround.

Owner action

Inventory the canonical reusable workflows and action-pin policy in .github, determine the latest reviewed immutable actions/upload-artifact SHA that natively targets the supported Node runtime, update the canonical owner once, and let thin consumers inherit it. Preserve exact-SHA pinning, artifact digest/provenance behavior, retention semantics and fail-closed upload errors. Add/adjust a reusable-workflow contract test so a Node-runtime-deprecated upload-artifact pin cannot silently return.

Acceptance

1. Canonical .github workflow uses an immutable reviewed actions/upload-artifact SHA with no Node 20 compatibility warning on current hosted runners.
2. Consumer exact-head run shows no DEP0040, DEP0169, or forced-Node-24 warning from that action.
3. Artifact upload still succeeds with expected digest/name and failure behavior.
4. No leaf repository suppresses the warning or locally forks the central workflow.
5. Release/provenance consumers receive the owner release/version bump through their normal immutable dependency path.

[seonghobae]

Fresh consumer evidence from ContextualWisdomLab/quarantine-sandbox-runtime root exact c0839dc1a4eac69bf12dfd82777c2182e0b8769d, native CI 34157422907 confirms the deprecated action remains live after the prior specimen. Coverage job 101852032799 and branch-coverage job 101852032932 both successfully uploaded exact-head JSON artifacts, but GitHub forced actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 onto Node 24 and emitted the Node 20 deprecation warning plus runtime DEP0040 (punycode) and DEP0169 (url.parse()) warnings. The uploaded artifacts were coverage-json-c0839dc1a4eac69bf12dfd82777c2182e0b8769d (artifact 10031465485, archive digest sha256:55310f871c1d53dcb5b6e01a0a61c1f88fcaf89c8b9b54d91f9e956e335ebf1a) and branch-coverage-json-c0839dc1a4eac69bf12dfd82777c2182e0b8769d (artifact 10031469433, archive digest sha256:1276584ddc5c4055a0d095050930845f43cdf4acbe085ec016dcfe0bb2adb875).

Primary upstream authority now gives a concrete candidate for owner review: the latest actions/upload-artifact release is v7.0.1, published 2026-04-10, targeting commit 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a; that exact commit's action.yml declares runs.using: node24. Please review and, if compatible with the canonical artifact/provenance semantics, pin that full SHA in the .github owner workflow rather than suppressing warnings in leaf repositories. Consumer acceptance should require the same artifact name/digest/fail-closed upload behavior and absence of forced-Node-24, DEP0040, and DEP0169 warnings on a fresh exact head.

[seonghobae]

Fresh quarantine-sandbox-runtime artifact-action specimen: exact child 4990976015c554df1cc485135dfa1d5e3a38e4ca, branch-coverage job 101905358853, used pinned actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. Runner warned that this Node 20 action is being forced onto Node 24 and emitted DEP0040 (punycode) plus DEP0169 (url.parse()) deprecations while artifact 10037275727 uploaded successfully with digest sha256:41be203dce7d8588f2ab450cf63983a9f4053515afad35762e86bfcb466bc189. Leaf is not suppressing warnings or changing the central action pin; please preserve artifact name/digest/provenance semantics while updating the reusable owner path.

[seonghobae]

Fresh quarantine-runtime canary evidence, 2026-09-09 KST:

• ContextualWisdomLab/quarantine-sandbox-runtime#104@d098385045cefd8b337ba2bd0069107a01756b81, native CI 34259463376, branch-coverage job 102173494703 is GREEN but still runs local actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 and emits the current forced-Node-24 / Node-20-target deprecation warning plus the downstream DEP0040 (punycode) and DEP0169 (url.parse) warnings. The repository workflow still contains that exact v4 SHA in both production and branch coverage uploads.
• Upstream actions/upload-artifact now publishes v7.0.1 at immutable commit 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a; its current action.yml explicitly declares runs.using: node24.

This strengthens the existing owner-path repair: the warning is not an unavoidable runner transition anymore. Please evaluate/pin the reviewed Node-24-native upstream SHA centrally and keep thin consumers from carrying the old Node-20-targeting v4 pin. Do not use ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION or a leaf suppression. After central integration, rerun an unchanged quarantine-runtime head and require the warning family to disappear while artifact digest/name/fail-closed behavior remains intact.