Bump CI action dependencies to latest major versions

[tnull]

GitHub is deprecating Node.js 20 for Actions runners, with enforcement starting June 2026. Bump all action dependencies to their latest major versions which use Node.js 22+.

Co-Authored-By: HAL 9000

[ldk-reviews-bot]

👋 I see @joostjager was un-assigned.
If you'd like another reviewer assignment, please click here.

[ldk-claude-review-bot]

The fuzz job uploads with actions/upload-artifact@v7 (line 261) while the coverage job downloads with actions/download-artifact@v8 (line 86). Historically these two actions have been versioned in lockstep (v1/v1, v2/v2, v3/v3, v4/v4). The major version mismatch is unusual — please verify that upload-artifact v7 and download-artifact v8 are artifact-format compatible, or confirm whether these actions have intentionally diverged in versioning.

[ldk-claude-review-bot]

Major version bump to rustsec/audit-check@v2 — please verify that the ignore parameter syntax is still supported in v2. If the v2 API changed (e.g., switching to a different input name or format for advisory ignores), this could silently stop ignoring RUSTSEC-2021-0145 and cause spurious CI failures.

Also note: the comment on lines 22-23 still references MSRV rustc 1.63, but the project MSRV elsewhere in build.yml is 1.75. This is a pre-existing issue, not introduced by this PR.

[ldk-claude-review-bot]

Review Summary

Two inline comments posted:

1. .github/workflows/build.yml:86 — upload-artifact@v7 / download-artifact@v8 version mismatch. These actions have historically been versioned in lockstep. The fuzz job uploads at v7 and the coverage job downloads at v8 — verify these are artifact-format compatible.

2. .github/workflows/audit.yml:15 — rustsec/audit-check@v2 is a major version bump. Verify the ignore parameter is still supported with the same syntax in v2.

Cross-cutting concern

Version existence should be verified: Several of these version bumps are aggressive jumps from v4 (actions/checkout@v6 is +2 major versions, actions/upload-artifact@v7 is +3, actions/download-artifact@v8 is +4). Please confirm all target versions actually exist and are released. If any version tag doesn't exist, the workflow will fail silently at the checkout step of the action.

[tnull]

Need to double-check the bumped versions. Could be Claude messed up.

[tnull]

@TheBlueMatt I think this first requires that we bump the self-hosted runners to support node24:

Error: System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values. (Parameter ''using: node24' is not supported, use 'docker', 'node12', 'node16' or 'node20' instead.')

[TheBlueMatt]

Hmm, do we have to bother here? I guess we might have to upgrade the ones that aren't self-hosted but presumably things will keep working and we don't have to worry too much about javascript trash?

[ldk-reviews-bot]

Hi @tnull,

Thanks for your contributions to rust-lightning!

After too many struggles with bugs, outages, contributor bans, and, finally, a multi-week CI ban, the rust-lightning project is moving off of GitHub for day-to-day development.

You can still file issues and access the git tree here, but PRs will now take place exclusively at https://git.rust-bitcoin.org/. As such, this PR has been migrated to https://git.rust-bitcoin.org/lightningdevkit/rust-lightning/pulls/4531

If you log in using GitHub (or otherwise link your GitHub account from https://git.rust-bitcoin.org/user/settings/security), ownership of your PRs, issues, and comments will automatically transfer. To push updates to this PR, you'll need to use git push git@gitea-ssh.bitcoin.ninja:lightningdevkit/rust-lightning YOUR_LOCAL_COMMIT_OR_BRANCH:tnull/2026-04-bump-ci-workflows. This may require a permissions change - if it doesn't work initially just leave a comment and we'll get you access.