CI: Update all actions

[why]
Because we want to use Node 20 etc pp

[how]
Check for breaking changes and update.

Also replace checkout-files by checkout with sparse-checkout; as they
semselves encourage people to do.

action-gh-release has been updated to Node 20 but has not been released
with the change, so we access the latest version directly by hash.

[note]
Of course this is unchecked... what can ge wrong! 😬

Signed-off-by: Fini Jastrow <ulf.fini.jastrow@desy.de>

.github/workflows/casks.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Fetch stuff (no checkout)
-        uses: Bhacaz/checkout-files@v2
+        uses: actions/checkout@v4
         with:
-          files: bin/scripts/lib/fonts.json bin/scripts/fetch-archives.sh bin/scripts/generate-casks.sh
-          branch: ${{ github.head_ref || github.ref_name }}
+          sparse-checkout: |
+            bin/scripts
       - name: Fetch release artifacts
         run: |
           cd bin/scripts
@@ -35,7 +35,7 @@ jobs:
           cd bin/scripts
           ./generate-casks.sh --setversion ${{ steps.releasetag.outputs.tag }}
       - name: Upload casks as artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: casks
           path: casks
@@ -53,7 +53,7 @@ jobs:
           PAK=$(echo "${FORK_TOKEN}" | tr 'A-Za-z' 'N-ZA-Mn-za-m')
           echo "pak=${PAK}" >> $GITHUB_OUTPUT
       - name: Checkout Homebrew
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: ${{ env.HOMEBREW_FORK }}
           path: homebrew
@@ -67,7 +67,7 @@ jobs:
           git reset --hard upstream/master
           git push --force origin HEAD:nerdfonts
       - name: Retrieve new casks
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: casks
           path: casks

.github/workflows/contributors.yml

@@ -14,12 +14,12 @@ jobs:
     name: Update gh-pages contributors
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Fetch old from gh-pages
-        uses: Bhacaz/checkout-files@v2
+        uses: actions/checkout@v4
         with:
-          files: _posts/2017-01-05-all-contributors.md
-          branch: gh-pages
+          sparse-checkout: _posts
+          ref: gh-pages
       - name: Update the page
         run: |
           cd bin/scripts

.github/workflows/docker-release.yml

@@ -21,7 +21,7 @@ jobs:
     if: ${{ github.repository_owner == 'ryanoasis' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Determine font-patcher version
         id: patcher
@@ -35,7 +35,7 @@ jobs:
         # Docker Meta provides automatic, standard tagging
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: nerdfonts/patcher
           flavor: latest=true
@@ -45,24 +45,24 @@ jobs:
 
         # QEMU allows us to build container images for multiple architectures (amd64, ARM etc...)
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: linux/amd64,linux/arm64
 
         # Docker Buildx provides Buildkit support
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
         with:
           platforms: linux/amd64,linux/arm64
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PAT }}
 
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v5
         with:
           context: .
           platforms: linux/amd64,linux/arm64

.github/workflows/font-patcher.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup core dependencies
         run: |

.github/workflows/fontjson.yml

@@ -12,10 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Fetch files
-        uses: Bhacaz/checkout-files@v2
+        uses: actions/checkout@v4
         with:
-          files: bin/scripts/lib/fonts.json
-          branch: ${{ github.sha }}
+          sparse-checkout: bin/scripts/lib
 
       - name: Prepare file
         run: |
@@ -24,7 +23,7 @@ jobs:
           ls -l /tmp/fonts.json
 
       - name: Fetch gh-pages
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: gh-pages
 
@@ -47,7 +46,7 @@ jobs:
   update_gitignore:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Regenerate gitignore
         run: |

.github/workflows/lock.yml

@@ -14,7 +14,7 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v4
+      - uses: dessant/lock-threads@v5
         with:
           issue-inactive-days: '182'
           issue-comment: >

.github/workflows/packsvgs.yml

@@ -12,7 +12,7 @@ jobs:
   create-symbols-font:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Fetch dependencies
         run: |
           sudo apt update -y -q

.github/workflows/release.yml

@@ -29,11 +29,11 @@ jobs:
     if: ${{ github.repository_owner == 'ryanoasis' }}
 
     steps:
-      # Faster version instead of - uses: actions/checkout@v3
-      - uses: Bhacaz/checkout-files@v2
+      - uses: actions/checkout@v4
         with:
-          files: package.json bin/scripts/get-font-names-from-json.sh bin/scripts/lib/fonts.json
-          branch: ${{ github.head_ref || github.ref_name }}
+          sparse-checkout: -
+            .
+            bin/scripts
 
       - name: Determine font matrix
         id: set-matrix
@@ -68,7 +68,7 @@ jobs:
         # If the tag exists it is obviously a re-release
 
         # This would need a complete checkout, that we want to avoid
-        # uses: mukunku/tag-exists-action@v1.2.0
+        # uses: mukunku/tag-exists-action
         #   with:
         #     tag: "v${{ steps.rel_ver.outputs.val }}"
         #   env:
@@ -135,7 +135,7 @@ jobs:
 
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Check release variables
         run: |
           echo "$RELEASE_VERSION"
@@ -216,7 +216,7 @@ jobs:
           ./archive-fonts.sh "${{ matrix.font }}"
 
       - name: Upload zip and tar.xz archive for release
-        uses: softprops/action-gh-release@v0.1.15
+        uses: softprops/action-gh-release@ 4634c16e79c963813287e889244c50009e7f0981
         if: needs.setup-fonts-matrix.outputs.rel_upload == 'true'
         with:
           draft: true
@@ -225,7 +225,7 @@ jobs:
           files: archives/*
 
       - name: Upload patched fonts as artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: patched-fonts
           # adding multiple paths (i.e. LICENSE) is a workaround to get a least common ancestor
@@ -246,7 +246,7 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Bump version for source files
         run: |
           cd -- "$GITHUB_WORKSPACE/bin/scripts"
@@ -258,7 +258,7 @@ jobs:
           ./archive-font-patcher.sh
 
       - name: Upload font-patcher archive for release
-        uses: softprops/action-gh-release@v0.1.15
+        uses: softprops/action-gh-release@ 4634c16e79c963813287e889244c50009e7f0981
         if: needs.setup-fonts-matrix.outputs.rel_upload == 'true'
         with:
           draft: true
@@ -271,15 +271,15 @@ jobs:
     needs: [ setup-fonts-matrix, build, release-font-patcher ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Prepare repo (clear out old and obsolete fonts)
         run: |
           cd -- "$GITHUB_WORKSPACE/patched-fonts"
           find . -name "*.[to]tf" -exec rm {} \;
 
       - name: Download patched fonts from build
         id: download-patched-fonts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: patched-fonts
           path: .
@@ -383,7 +383,7 @@ jobs:
           clean: false
 
       - name: Adjust release tag to include previous commit
-        uses: EndBug/latest-tag@v1.5.1
+        uses: EndBug/latest-tag@v1
         if: needs.setup-fonts-matrix.outputs.rel_upload == 'true'
         with:
           ref: "v${{ needs.setup-fonts-matrix.outputs.rel_version }}"

.github/workflows/shellcheck.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Check scripts (1/2)
         run: |

.github/workflows/zip-release.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Fetch dependencies
       run: sudo apt install -y -q zipcmp
@@ -28,7 +28,7 @@ jobs:
         ./archive-font-patcher.sh intermediate
 
     - name: Upload archive as artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         path: archives/FontPatcher.zip
         retention-days: 1