Update CI actions and packages

.github/workflows/benchmarks.yml

@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Post initial pending comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -182,7 +182,7 @@ jobs:
             "${{ matrix.runner-label }}"
 
       - name: Upload benchmark result
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: benchmark-${{ matrix.test }}-${{ matrix.mode }}-${{ matrix.runner-group }}
@@ -194,7 +194,7 @@ jobs:
       # No artifact downloads, no external scripts — just a few API calls.
       - name: Update PR comment (progressive)
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -331,7 +331,7 @@ jobs:
 
     steps:
       - name: Download all benchmark results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         continue-on-error: true
         with:
           pattern: benchmark-*
@@ -341,7 +341,7 @@ jobs:
       # overwrite progressive results with a less complete artifact set
       # (e.g., when cancel-in-progress killed some jobs mid-run).
       - name: Update PR comment with final report
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -511,7 +511,7 @@ jobs:
 
     steps:
       - name: Download all benchmark results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: benchmark-*
           path: benchmark-results

.github/workflows/ci.yml

@@ -71,10 +71,10 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Install cspell
-        run: npm install -g cspell
+        run: npm install -g cspell@10.0.0
 
       - name: run cspell
         run: cspell --config ./cspell.json "website/src/**/*.md" --no-progress --no-cache
@@ -90,8 +90,8 @@ jobs:
       - uses: actions/setup-node@v6
         name: Setup node
         with:
-          node-version: 22
-      - run: npm install -g markdownlint-cli2@0.19.0
+          node-version: 24
+      - run: npm install -g markdownlint-cli2@0.22.0
         name: Install markdownlint-cli2
       - run: markdownlint-cli2 "*.md" "website/src/**/*.md"
         name: run Markdownlint
@@ -110,7 +110,7 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
           cache: "yarn"
           cache-dependency-path: "website/yarn.lock"
 
@@ -208,7 +208,7 @@ jobs:
           github.event_name != 'pull_request' ||
           (github.event_name == 'pull_request' &&
            github.event.pull_request.head.repo.full_name == github.repository)
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -229,13 +229,13 @@ jobs:
           CI_BUILD: true
 
       - name: Upload Test Results as Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: test-results-${{ matrix.name }}
           path: ${{ matrix.directoryPath }}/TestResults/*.trx
 
       - name: Upload Coverage File as Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-${{ matrix.name }}
           # The * matches a single directory that is named with a GUID.
@@ -244,7 +244,7 @@ jobs:
 
       - name: Upload mismatch files as Artifact
         if: steps.run-tests.outcome == 'failure'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: mismatch-files-${{ matrix.name }}
           path: ${{ matrix.directoryPath }}/**/__mismatch__/*
@@ -255,7 +255,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all coverage artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           path: ./output/download
           pattern: coverage-*

.github/workflows/coverage.yml

@@ -72,7 +72,7 @@ jobs:
         timeout-minutes: 5
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -94,13 +94,13 @@ jobs:
           CI_BUILD: true
 
       - name: Upload Test Results as Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: test-results-${{ matrix.name }}
           path: ${{ matrix.directoryPath }}/TestResults/*.trx
 
       - name: Upload Coverage File as Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-${{ matrix.name }}
           # The * matches a single directory that is named with a GUID.
@@ -109,7 +109,7 @@ jobs:
 
       - name: Upload mismatch files as Artifact
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: mismatch-files-${{ matrix.name }}
           path: ${{ matrix.directoryPath }}/**/__mismatch__/*
@@ -126,7 +126,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all coverage artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           path: ./output/download
           pattern: coverage-*

.github/workflows/pr-labeler.yml

@@ -12,4 +12,4 @@ jobs:
     name: Apply Labels
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v6

.github/workflows/publish-website.yml

@@ -21,7 +21,7 @@ jobs:
           show-progress: false
 
       - name: Docker Login
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ secrets.CONTAINER_REG_URL }}
           username: ${{ secrets.CONTAINER_REG_USERNAME }}
@@ -30,7 +30,7 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
           cache: "yarn"
           cache-dependency-path: "website/yarn.lock"
 
@@ -66,7 +66,7 @@ jobs:
         working-directory: website
 
       - name: Build WebSite Container
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./website
           file: .docker/website/dockerfile

.github/workflows/release.yml

@@ -161,17 +161,17 @@ jobs:
           NitroIdentityScopes: ${{ secrets.NITRO_IDENTITY_SCOPES }}
 
       - name: 🖋️ Azure login (Windows)
-        uses: azure/login@v1
+        uses: azure/login@v3
         if: runner.os == 'Windows'
         with:
           creds: ${{ secrets.SIGNING_CREDENTIALS }}
 
       - name: 🖋️ Sign binary (Windows)
-        uses: azure/trusted-signing-action@v0
+        uses: azure/artifact-signing-action@v1
         if: runner.os == 'Windows'
         with:
           endpoint: ${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT_ENDPOINT }}
-          trusted-signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+          signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
           certificate-profile-name: ${{ secrets.WINDOWS_APP_CERT_PROFILE_NAME }}
           files: ${{ github.workspace }}\publish\nitro.exe
           file-digest: SHA256
@@ -278,7 +278,7 @@ jobs:
           security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
 
       - name: 📤 Upload zipped binary as artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: nitro-${{ matrix.rid }}
           path: nitro-${{ matrix.rid }}.zip
@@ -306,15 +306,15 @@ jobs:
       - name: 🧰 Setup Node
         uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
           registry-url: ${{ vars.NPM_REGISTRY_URL }}
           scope: "@chillicream"
 
       - name: 🧰 Enable corepack
         run: corepack enable
 
       - name: 📥 Download all zipped nitro binaries
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: nitro-*
           merge-multiple: true
@@ -376,7 +376,7 @@ jobs:
         shell: bash
 
       - name: 📤 Upload tarball as artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: chillicream-nitro-${{ env.GIT_TAG }}.tgz
           path: src/Nitro/CommandLine/src/chillicream-nitro/chillicream-nitro-${{ env.GIT_TAG }}.tgz
@@ -500,7 +500,7 @@ jobs:
 
       - name: 🔐 Create GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.ACTIONS_APP_ID }}
           private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}

dictionary.txt

@@ -36,6 +36,7 @@ cadastre
 callsite
 CCPA
 chillicream
+CODESIGN
 Codespaces
 colocated
 combinators
@@ -92,6 +93,8 @@ inmemory
 inspectable
 keepalive
 Kellner
+keyrings
+keyserver
 Kydne
 LASTEXITCODE
 Leia
@@ -126,11 +129,13 @@ nlte
 Noda
 nologo
 Normen
+notarytool
 noverlaps
 Npgsql
 nstartsWith
 NSwag
 ntouches
+NUGETAPIKEY
 nwithin
 oncall
 opencover
@@ -152,6 +157,7 @@ preparables
 PRIMEM
 PROJCS
 protobuf
+publishaot
 queryables
 quox
 quux
@@ -182,6 +188,7 @@ Skywalker
 snapshooter
 snupkg
 sortings
+spctl
 Specwise
 sqft
 srid
@@ -211,6 +218,7 @@ traceparent
 tracestate
 Trimmable
 Tzdb
+unittests
 unlisten
 unpublish
 unserialized
@@ -220,11 +228,13 @@ Upsert
 upvote
 URQL
 uuuu
+vnext
 vsix
 VXNlcjox
 websockets
 Wilhuff
 worklist
 Wunder
 xact
+xcrun
 xunit