[glen-84]

Summary

• Moves every third-party action to its newest release that is at least a week old, pinned by full SHA with the exact version as its comment. This includes the majors actions/checkout v7, setup-dotnet v6, setup-node v7, cache v6, and labeler v7. The CI-installed cspell, markdownlint-cli2, and dotnet-coverage follow the same rule. The Nitro client actions, which ChilliCream publishes with each platform release, move to their newest release, v16.6.7, without that wait.
• Moves the release jobs off the deprecated ubuntu-22.04 image to ubuntu-26.04. The exception is the Nitro CLI's glibc build legs, which build on Ubuntu 22.04, the oldest LTS GitHub still runs, so the published binaries keep running on older distributions; linux-arm64 moves down to ubuntu-22.04-arm for the same reason. The musl leg builds in alpine:3.24.2, since 3.21 reaches end of life on 2026-11-01, and the macOS legs build on macos-26.
• setup-dotnet and the benchmark install read the SDK version from global.json instead of repeating it. The cache cleanup deletes both of a closed PR's refs with gh cache delete, replacing the archived gh-actions-cache extension.

Test plan

• Every pin resolves to the commit of the tag its comment names, and actionlint 1.7.12 reports no new findings.
• cspell and markdownlint-cli2 at the new versions report no issues with the jobs' own commands.
• objdump -T on the 16.6.7 release binaries shows linux-x64, built on 22.04, needs glibc 2.34, and linux-arm64, built on 24.04, needs 2.38. Building on 22.04 caps both at 2.35. The macOS binaries keep minos 14.0, which the ILCompiler package sets.
• A linux-musl-x64 build in alpine:3.24.2 runs on Alpine 3.21 (musl 1.2.5).
• The release, website deploy, coverage, and scheduled workflows only run after merge. The next 16.* tag is the first release run on the new images.

[Copilot]

Copilot review overview

🟡 Changes recommended

The Nitro v16.6.7 actions were published only five days before review, conflicting with the stated one-week minimum.

Review effort: Balanced
Findings: 2

Open (2)

• Action release pin is newer than the required one-week age · New
• Action release pin is newer than the required one-week age · New

What changed in this PR

Updates CI dependencies and runner images while centralizing SDK selection and modernizing cache cleanup.

Changes:

• Upgrades and SHA-pins GitHub Actions and CI tools.
• Moves release builds to newer Ubuntu, Alpine, and macOS images.
• Reads .NET SDK versions from global.json and replaces the archived cache extension.

File	Description
.github/​workflows/​release.yml	Updates release runners, actions, and Nitro publishing.
.github/​workflows/​publish-website.yml	Updates website build and deployment actions.
.github/​workflows/​pr-labeler.yml	Upgrades the PR labeler.
.github/​workflows/​nitro-cli-e2e.yml	Updates Nitro E2E actions and SDK setup.
.github/​workflows/​issue-labeler.yml	Upgrades the issue labeler.
.github/​workflows/​coverage.yml	Updates coverage workflow actions and SDK setup.
.github/​workflows/​cost-oracle-nightly.yml	Updates nightly workflow actions and Rust tooling.
.github/​workflows/​ci.yml	Updates CI actions, linters, coverage tooling, and SDK setup.
.github/​workflows/​ci-cleanup.yml	Replaces the archived cache extension with GitHub CLI commands.
.github/​workflows/​benchmarks.yml	Updates benchmark actions and uses global.json.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Nitro CLI E2E snapshots: no flow recordings changed vs main.