Update GitHub Actions for Node.js 24 compatibility (#14199)

* Remove dead launcher composite action

This composite action built the Rust launcher using deprecated
actions-rs/toolchain@v1 and actions-rs/cargo@v1 (Node 16). It also
had a YAML bug (duplicate `uses:` keys in one step). No workflow
references it — the launcher build now happens directly in release
scripts.

* Update official GitHub Actions for Node.js 24 compatibility

GitHub is deprecating Node.js 20 for Actions runners (forced Node.js
24 starting June 2, 2026). Bump all official actions to their latest
Node.js 24-compatible versions:

- actions/checkout v4 → v6
- actions/cache (+ /restore, /save) v4 → v5
- actions/upload-artifact v4 → v7
- actions/download-artifact v4 → v8
- actions/setup-node v4 → v6
- actions/stale v9 → v10

Also bump node-version 18 → 22 in create-release.yml (Node 18 EOL'd
April 2025).

* Update third-party GitHub Actions for Node.js 24 compatibility

- astral-sh/setup-uv v3 → v7
- peter-evans/create-pull-request v7 → v8
- cloudsmith-io/cloudsmith-cli-action v1.0.8 → v2.0.2

* Bump Node.js 20 → 22 for Playwright/MECA in smoke tests

Node 20 EOL is April 30, 2026.

Author: cderv

.github/actions/cache-typst/action.yml

@@ -41,7 +41,7 @@ runs:
 
     - name: Cache Typst package folder
       id: cache-typst-restore
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: ${{ env.TYPST_CACHE }}
         key: ${{ runner.os }}-typst-1

.github/workflows/actions/launcher/action.yml

@@ -5,15 +5,15 @@ runs:
   using: "composite"
   steps:
     - name: Cache deno std deps
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ./src/resources/deno_std/cache
         key: ${{ runner.os }}-deno_std-2-${{ hashFiles('./src/resources/deno_std/deno_std.lock', './package/scripts/deno_std/deno_std.ts') }}
         restore-keys: |
           ${{ runner.os }}-deno_std-2-
 
     - name: Cache Cargo dependencies
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.cargo/registry

.github/workflows/actions/quarto-dev/action.yml

@@ -35,7 +35,7 @@ jobs:
       tag_pushed: ${{ steps.version_commit.outputs.tag_pushed }}
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -44,9 +44,9 @@ jobs:
         uses: ./.github/workflows/actions/prevent-rerun
 
       # we _also_ need npm, specifically for webui/preview
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: 18
+          node-version: 22
 
       - name: Get previous version
         id: read-version
@@ -78,7 +78,7 @@ jobs:
           # echo -e "Due to an issue with upstream dependency, the RHEL build may not included in this release." >> "release_note.md"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: News
           path: |
@@ -103,7 +103,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -116,7 +116,7 @@ jobs:
           tar --owner=root --group=root -zcvf  quarto-${{needs.configure.outputs.version}}.tar.gz *
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Source
           path: ./quarto-${{needs.configure.outputs.version}}.tar.gz
@@ -125,7 +125,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -153,7 +153,7 @@ jobs:
           popd
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Deb Zip
           path: ./package/quarto-${{needs.configure.outputs.version}}-linux-amd64.tar.gz
@@ -162,7 +162,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -190,7 +190,7 @@ jobs:
           popd
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Deb Arm64 Zip
           path: ./package/quarto-${{needs.configure.outputs.version}}-linux-arm64.tar.gz
@@ -201,7 +201,7 @@ jobs:
     if: false
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -240,7 +240,7 @@ jobs:
           popd
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: RHEL Zip
           path: ./package/quarto-${{needs.configure.outputs.version}}-linux-rhel7-amd64.tar.gz
@@ -253,7 +253,7 @@ jobs:
         arch: [x86_64, aarch64]
         format: [deb, rpm]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -302,7 +302,7 @@ jobs:
           fi
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Linux-${{ matrix.format }}-${{ matrix.arch }}-Installer
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-linux-${{ steps.pkg_arch.outputs.arch_name }}.${{ matrix.format }}
@@ -311,7 +311,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure, make-tarball]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           sparse-checkout: |
@@ -321,7 +321,7 @@ jobs:
         if: ${{ inputs.publish-release }}
         uses: ./.github/workflows/actions/prevent-rerun
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: Deb Zip
           path: .
@@ -352,7 +352,7 @@ jobs:
     needs: [configure]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -417,13 +417,13 @@ jobs:
           CERT_FINGERPRINT: ${{ secrets.SM_CLIENT_CERT_FINGERPRINT }}
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Windows Installer
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-win.msi
 
       - name: Upload Zip
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Windows Zip
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-win.zip
@@ -432,7 +432,7 @@ jobs:
     runs-on: windows-latest
     needs: [configure, make-installer-win]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           sparse-checkout: |
@@ -443,7 +443,7 @@ jobs:
         uses: ./.github/workflows/actions/prevent-rerun
 
       - name: "Download Windows Zip"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: Windows Zip
           path: .
@@ -480,7 +480,7 @@ jobs:
     runs-on: macos-latest
     needs: [configure]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
 
@@ -529,13 +529,13 @@ jobs:
           QUARTO_APPLE_CONNECT_PW: ${{ secrets.APPLE_CONNECT_PW }}
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Mac Installer
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-macos.pkg
 
       - name: Upload Zip
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Mac Zip
           path: ./package/out/quarto-${{needs.configure.outputs.version}}-macos.tar.gz
@@ -549,7 +549,7 @@ jobs:
     runs-on: macos-latest
     needs: [configure, make-installer-mac]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           sparse-checkout: |
@@ -559,7 +559,7 @@ jobs:
         if: ${{ inputs.publish-release }}
         uses: ./.github/workflows/actions/prevent-rerun
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: Mac Zip
           path: .
@@ -603,7 +603,7 @@ jobs:
       ]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.configure.outputs.version_commit }}
           path: quarto-cli
@@ -615,7 +615,7 @@ jobs:
         uses: ./quarto-cli/.github/workflows/actions/prevent-rerun
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Rename news
         run: |
@@ -723,7 +723,7 @@ jobs:
       ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Prevent Re-run
         if: ${{ inputs.publish-release }}
@@ -751,7 +751,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [configure, publish-release]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github
@@ -761,7 +761,7 @@ jobs:
         uses: ./.github/workflows/actions/prevent-rerun
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - uses: ./.github/actions/docker
         with:

.github/workflows/create-release.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # checkout full tree
           fetch-depth: 0

.github/workflows/performance-check.yml

@@ -36,7 +36,7 @@ jobs:
       version: ${{ steps.resolve.outputs.version }}
       is_prerelease: ${{ steps.resolve.outputs.is_prerelease }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github
@@ -175,7 +175,7 @@ jobs:
           GH_REPO: quarto-dev/quarto-cli
 
       - name: Install and authenticate Cloudsmith CLI
-        uses: cloudsmith-io/cloudsmith-cli-action@v1.0.8
+        uses: cloudsmith-io/cloudsmith-cli-action@v2.0.2
         with:
           api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
 

.github/workflows/publish-cloudsmith.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           start-date: 2023-01-01T01:00:00Z
           stale-issue-label: "stale"

.github/workflows/stale-needs-repro.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'quarto-dev/quarto-cli')
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # checkout full tree
           fetch-depth: 0

.github/workflows/test-bundle.yml

@@ -22,7 +22,7 @@ jobs:
           - { os: ubuntu-latest }
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -55,7 +55,7 @@ jobs:
           ../dist/bin/tinitex/x86_64-unknown-linux-gnu/tinitex --help
 
       - name: Upload binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: tinitex-${{ matrix.config.os }}
           path: |

.github/workflows/test-quarto-latexmk.yml

@@ -53,7 +53,7 @@ jobs:
       BUCKETS: ${{ steps.tests-buckets.outputs.BUCKETS }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Quarto
         uses: quarto-dev/quarto-actions/setup@v2