[nstarke]

Summary

Integrates the seven open Dependabot PRs into a single change. They all
rewrite the same shared workflow files, so merging them serially would mean
conflict-resolving the same file six times.

PR	Bump
#42	actions/download-artifact	v4 → v8
#43	actions/upload-artifact	v4 → v7
#44	actions/checkout	v4 → v6
#45	codecov/codecov-action	v4 → v6
#47	github/codeql-action	v3 → v4
#48	mime-types (/api/agent)	2.1.35 → 3.0.2
#49	mime-types (root)	2.1.35 → 3.0.2

The action bumps are applied across every workflow and the
setup-cross composite action, not just the files the Dependabot branches
touched. Those branches were cut on 2026-03-29 and predate the CI
restructuring in #100, so they know nothing about ci-changes.yml,
ci-isa.yml, .github/actions/setup-cross/action.yml, coverity.yml,
cppcheck.yml, npm-audit.yml or semgrep.yml. Merging them as-is would
have left roughly half of the 48 action references behind on the old
majors.

Lockfiles are gitignored in this repo, so as with the original Dependabot
PRs the npm change is package.json only.

Breaking changes reviewed — none require code changes

• download-artifact v5 changed the output path for single-artifact
  downloads, but only when selecting by artifact-ids. Every call site here
  uses name: or pattern:, which the release notes list explicitly as
  unaffected.
• download-artifact v8 now errors on a digest mismatch instead of
  warning. Left at the secure default rather than setting
  digest-mismatch: warn.
• codecov-action v5 deprecated file/plugin for files/plugins.
  All four steps already use files: and pass an explicit
  token: ${{ secrets.CODECOV_TOKEN }}.
• upload-artifact v7 / download-artifact v8 moved to ESM and added
  archive / skip-decompress. Both default to the previous behaviour.
• The v6/v7/v8 majors are Node 24 runtime bumps needing runner 2.327.1+.
  All jobs run on hosted ubuntu-latest, which satisfies this. Self-hosted
  runners, if any are added later, would need updating.
• codeql-action v4 is the Node 24 lockstep line of v3 with matching
  minor versions; no input changes.
• mime-types v3 keeps the lookup export used in
  api/agent/routes/assets.js:17 and api/agent/routes/isa.js:68. Diffing
  the v2 and v3 tables, 73 of 1241 extensions changed mapping, none that
  these routes serve. Both serve extension-less agent binaries
  (ela-x86_64), where lookup returns false in both versions and the
  existing || 'application/octet-stream' fallback applies unchanged. The
  only mapping that could plausibly matter is .js
  (application/javascript → text/javascript, the current IANA value).
  Node engine requirement is >=18; CI pins Node 20.

Out of scope and deliberately left alone: actions/cache@v4,
actions/setup-node@v4, actions/github-script@v7 and
vapier/coverity-scan-action@v1, none of which Dependabot has opened a PR
for.

Test plan

• npx jest --runInBand tests/unit/api — 769 tests / 67 suites pass
• All ten workflow files and the composite action parse as valid YAML
• Confirmed no artifact-ids: usage anywhere under .github/
• Confirmed no deprecated file:/plugin: codecov inputs remain
• Verified real (unmocked) mime-types 3.0.2 lookup behaviour for the
  asset paths both routes serve
• CI green on this PR, including the CodeQL, Coverity and npm-audit
  workflows whose actions changed but which do not run on every push
• Confirm a release run uploads/downloads artifacts correctly, since
  publish-release-assets.yml and release-cross-static.yml only
  exercise on release events

Closes #42, closes #43, closes #44, closes #45, closes #47, closes #48, closes #49

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.39%. Comparing base (7643ab2) to head (8debeab).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #102      +/-   ##
==========================================
+ Coverage   80.28%   80.39%   +0.11%     
==========================================
  Files         221      221              
  Lines       16839    16842       +3     
  Branches     2494     2497       +3     
==========================================
+ Hits        13519    13540      +21     
+ Misses       3320     3302      -18     

Flag	Coverage Δ
agent	88.29% <ø> (ø)
agent-c	78.16% <ø> (+0.14%)	⬆️
gdb	90.29% <ø> (ø)
terminal	86.37% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.