ci: update GitHub Actions

.github/workflows/bazel-ci.yml

@@ -1,7 +1,6 @@
 name: Bazel CI
 on:
   pull_request:
-  push:
     branches:
       - master
 
@@ -14,14 +13,14 @@ jobs:
         os: [macos-latest, ubuntu-latest, windows-latest]
         include:
           - os: macOS-latest
-            bazel_args: "--cxxopt=-std=c++17"
+            bazel_args: "--cxxopt=-std=c++17 --lockfile_mode=error"
           - os: ubuntu-latest
-            bazel_args: "--cxxopt=-std=c++17"
+            bazel_args: "--cxxopt=-std=c++17 --lockfile_mode=error"
           - os: windows-latest
-            bazel_args: "--cxxopt=/std:c++17"
+            bazel_args: "--cxxopt=/std:c++17 --lockfile_mode=error"
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Generate German locale on Ubuntu
         if: runner.os == 'Linux'

.github/workflows/cmake-ci.yml

@@ -1,7 +1,6 @@
 name: CMake CI
 on:
   pull_request:
-  push:
     branches:
       - master
 
@@ -12,17 +11,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, ubuntu-22.04, windows-2019]
+        os: [macos-14, ubuntu-22.04, windows-2022]
         dependencies: [submodule, vcpkg]
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: ${{ matrix.dependencies == 'submodule' }}
 
       - name: Mount vcpkg cache
         if: matrix.dependencies == 'vcpkg'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: "~/.cache/vcpkg/archives"
           key: vcpkg-${{ matrix.os }}

.github/workflows/coverage.yml

@@ -1,7 +1,6 @@
 name: Coverage
 on:
   pull_request:
-  push:
     branches:
       - master
 
@@ -11,10 +10,10 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Mount vcpkg cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: "~/.cache/vcpkg/archives"
           key: vcpkg-${{ runner.os }}

.github/workflows/doxygen.yml

@@ -4,13 +4,23 @@ on:
     branches:
       - master
 
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
 jobs:
   build:
     name: Documentation
     runs-on: ubuntu-24.04
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install doxygen
         run: |
@@ -22,9 +32,11 @@ jobs:
         run: doxygen
         working-directory: "${{ github.workspace }}/doc"
 
-      - name: Deploy documentation
-        uses: peaceiris/actions-gh-pages@v4
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          force_orphan: true
-          publish_dir: ./doc/html
+          path: ./doc/html
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/linting.yml

@@ -1,7 +1,6 @@
 name: Linting
 on:
   pull_request:
-  push:
     branches:
       - master
 
@@ -10,15 +9,15 @@ jobs:
     name: Include What You Use
     runs-on: ubuntu-latest
     container:
-      image: debian:sid-slim
+      image: debian:trixie-slim
     steps:
       - name: Install dependencies
         run: |
           apt-get update
           apt-get install -y --no-install-recommends ca-certificates clang-19 cmake git iwyu libbenchmark-dev libcurl4-openssl-dev ninja-build zlib1g-dev
 
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: true
 
@@ -42,7 +41,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # clang-format comes pre-installed
       # https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md

.github/workflows/release.yml

@@ -7,28 +7,21 @@ name: Handle Release
 jobs:
   build:
     name: Upload Release Asset
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
           submodules: true
 
       - name: Create tarball including submodules
         shell: bash
         env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PREFIX: prometheus-cpp-with-submodules
         run: |
           git archive --prefix "${PREFIX}/" -o "${PREFIX}.tar" HEAD
           git submodule foreach --recursive "git archive --prefix=${PREFIX}/\$path/ --output=\$sha1.tar HEAD && tar --concatenate --file=$(pwd)/${PREFIX}.tar \$sha1.tar && rm \$sha1.tar"
           gzip "${PREFIX}.tar"
-
-      # using the official actions/upload-release-asset action would be preferred but is blocked by
-      # https://github.com/actions/upload-release-asset/pull/41
-      - name: Upload the artifacts
-        uses: skx/github-action-publish-binaries@75ce5546020fc1848da842f40240f9fa03e7a3a8 # release-0.14
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          args: prometheus-cpp-with-submodules.tar.gz
+          gh release upload ${{ github.event.release.tag_name }} "${PREFIX}.tar.gz"