ci: migrate off Node 20 actions (actions-rs/*, mobiledevops/secret-to-file-action)

[jqnatividad]

Background

The publish workflows surface a GitHub Actions deprecation warning:

Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions-rs/cargo@v1, mobiledevops/secret-to-file-action@v1. Actions will be forced to run with Node.js 24 by default starting June 16, 2026. Node.js 20 will be removed from the runner on September 16, 2026.

actions-rs/* is also unmaintained (archived), so it won't get a Node 24 update.

Work

• Replace actions-rs/cargo@v1 with direct cargo invocations (run: steps) — the repo already uses dtolnay/rust-toolchain for toolchain setup, so actions-rs/toolchain is gone; actions-rs/cargo is the remaining holdout.
• Replace mobiledevops/secret-to-file-action@v1 (used to write the zipsign private key) with a maintained Node 24 action or an inline run: step that writes the secret to a file.
• Audit all .github/workflows/*.yml for any other Node 20 actions.

Acceptance

No Node 20 deprecation warnings in publish (and other) workflow runs; all actions on Node 24.

Surfaced during the 21.1.0 release publish.

[jqnatividad]

Status / handoff (WIP on branch ci/migrate-off-node20-actions)

Started the migration. publish.yml is done as the reviewable template (commit e389f087d). Pausing here before sweeping the rest.

Established approach (template)

• actions-rs/cargo@v1 → direct run: step.
  • Preserve the toolchain: input as an explicit cargo +${{ matrix.rust }} build … (matrix.rust is stable). This is not cosmetic — it guards against a stale per-directory rustup override beating dtolnay's default toolchain on self-hosted runners (see the note at publish.yml:188).
  • RUSTFLAGS carries over unchanged via env:.
  • use-cross handling (decided): simplify to plain cargo when a workflow has no active use-cross: true; only keep the ${{ matrix.job.use-cross == true && 'cross' || 'cargo' }} conditional + a gated Install cross step (taiki-e/install-action@v2, tool: cross) where a live cross target exists.
• mobiledevops/secret-to-file-action@v1 → inline decode:

  - name: Fetch zipsign private key
    shell: bash
    env:
      ZIPSIGN_KEY: ${{ secrets.QSV_ZIPSIGN_PRIV_KEY }}
    run: printf '%s' "$ZIPSIGN_KEY" | base64 -d > qsvpriv.key

  Secret passed via env (not interpolated into the script); shell: bash for Windows-target/macOS portability.
• actions-rs/audit-check@v1 → rustsec/audit-check@v2 (maintained successor, Node 24).

Remaining work (12 cargo workflows + 1 audit)

Simplify to plain cargo (no active use-cross: true):

• publish-nightly.yml, test-publish.yml, test-publish-nightly.yml
• publish-qsvpy.yml, macOS-arm64-selfhosted-publish.yml, macOS-arm64-selfhosted-publish-nightly.yml, macOS-arm64-selfhosted-publish-qsvpy.yml
• publish-aarch64-pc-windows-msvc.yml, publish-s390x-unknown-linux-gnu.yml, publish-powerpc64le-unknown-linux-gnu.yml (these cross-compile via --target + plain cargo, no use-cross set — keep as-is)
• rustfmt.yml

Keep the cross/cargo conditional + Install cross step (has an active use-cross: true):

• publish-portable.yml (aarch64-unknown-linux-gnu)

Audit action:

• security-audit.yml → rustsec/audit-check@v2

Each of the above also has the same mobiledevops/secret-to-file-action zipsign step to replace (except rustfmt.yml/test-publish*/security-audit.yml, which have no zipsign step).

Audit note

All other uses: are already Node 24 (checkout@v6, dtolnay/rust-toolchain@master, setup-python@v6, etc.). The only Node20/archived actions are the three above.

Verification per file

python3 -c "import yaml; yaml.safe_load(open(<file>))" parses clean, and grep -n "uses: actions-rs\|uses: mobiledevops" returns no matches (only explanatory comments remain).