Update CI workflow to use the latest versions of the actions

[mateusz-olczyk]

I can see the following message in the GitHub Actions dashboard:

Warning: Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

So I updated all the actions to their newest versions available.

[Copilot]

Pull request overview

Updates GitHub Actions workflow dependencies in response to the upcoming Node.js runtime change on GitHub-hosted runners, aiming to keep CI and release automation compatible.

Changes:

• Bumped action versions used in CI and scheduled workflows.
• Updated the reusable publish-to-bcr workflow reference to the v1 major tag.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/publish-to-bcr.yaml	Updates the referenced reusable workflow for publishing to BCR.
.github/workflows/generate_bzldep_index.yaml	Updates action versions for the scheduled index generation workflow.
.github/workflows/ci.yaml	Updates checkout action versions across CI jobs.

Comments suppressed due to low confidence (1)

.github/workflows/ci.yaml:71

• In test-indexers, the list items under steps: appear to be indented at the same level as steps: itself, which makes the workflow invalid YAML (GitHub Actions expects `steps:
  • ...). Please indent the - uses/- nameentries understeps:` by two more spaces so the workflow parses correctly.

    steps:
    - uses: actions/checkout@v6
    - name: Install Conan
      run: |
        python3 -m pip install --upgrade pip
        pip install conan

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Yannic]

Please follow-up on pinning to a commit sha instead of the tag. There was an attack on GH tags recently

[jayconrod]

I think we tried that in October and it didn't work for some reason. I think publish-to-bcr broke when we used a commit instead of a tag. We can try again though and document why it doesn't work (if that's still the case).