i#6981: Use consistent version for upload-artifact and download-artif…

…act (#6983)

Changes the version used for upload-artifact and download-artifact
actions to the current one recommended at
https://github.com/actions/upload-artifact and
https://github.com/actions/download-artifact.

For these two actions, "v4" points to the latest available v4.x.x
release, as evidenced by the commit hash for the versions at
https://github.com/actions/download-artifact/tags and
https://github.com/actions/upload-artifact/tags. So we would still be
using the latest version as suggested by the security advisory for
download-artifact (GHSA-cxww-7g56-2vh6).

PR #6964 bumped the download-artifact version but not the
upload-artifact which caused a mismatch and the #6981 issue.

Test run worked fine:
https://github.com/DynamoRIO/dynamorio/actions/runs/10835746272

 Fixes: #6981

.github/workflows/ci-package.yml

@@ -127,7 +127,8 @@ jobs:
         CI_BRANCH: ${{ github.ref }}
 
     - name: Upload Artifacts
-      uses: actions/upload-artifact@v2
+      # This points to the latest upload-artifact v4.x.x.
+      uses: actions/upload-artifact@v4
       with:
         name: linux-tarball
         path: DynamoRIO-Linux-${{ steps.version.outputs.version_number }}.tar.gz
@@ -215,7 +216,8 @@ jobs:
         CI_BRANCH: ${{ github.ref }}
 
     - name: Upload AArch64
-      uses: actions/upload-artifact@v2
+      # This points to the latest upload-artifact v4.x.x.
+      uses: actions/upload-artifact@v4
       with:
         name: aarch64-tarball
         path: DynamoRIO-AArch64-Linux-${{ steps.version.outputs.version_number }}.tar.gz
@@ -303,7 +305,8 @@ jobs:
         CI_BRANCH: ${{ github.ref }}
 
     - name: Upload ARM
-      uses: actions/upload-artifact@v2
+      # This points to the latest upload-artifact v4.x.x.
+      uses: actions/upload-artifact@v4
       with:
         name: arm-tarball
         path: DynamoRIO-ARM-Linux-EABIHF-${{ steps.version.outputs.version_number }}.tar.gz
@@ -393,7 +396,8 @@ jobs:
         CI_BRANCH: ${{ github.ref }}
 
     - name: Upload Artifacts
-      uses: actions/upload-artifact@v2
+      # This points to the latest upload-artifact v4.x.x.
+      uses: actions/upload-artifact@v4
       with:
         name: android-tarball
         path: DynamoRIO-ARM-Android-EABI-${{ steps.version.outputs.version_number }}.tar.gz
@@ -484,7 +488,8 @@ jobs:
         CI_BRANCH: ${{ github.ref }}
 
     - name: Upload Artifacts
-      uses: actions/upload-artifact@v2
+      # This points to the latest upload-artifact v4.x.x.
+      uses: actions/upload-artifact@v4
       with:
         name: windows-zip
         path: DynamoRIO-Windows-${{ steps.version.outputs.version_number }}.zip
@@ -562,7 +567,8 @@ jobs:
         prerelease: false
 
     - name: Download Linux
-      uses: actions/download-artifact@v4.1.7
+      # This points to the latest download-artifact v4.x.x.
+      uses: actions/download-artifact@v4
       with:
         name: linux-tarball
     - name: Upload Linux
@@ -577,7 +583,8 @@ jobs:
         asset_content_type: application/x-gzip
 
     - name: Download AArch64
-      uses: actions/download-artifact@v4.1.7
+      # This points to the latest download-artifact v4.x.x.
+      uses: actions/download-artifact@v4
       with:
         name: aarch64-tarball
     - name: Upload AArch64
@@ -592,7 +599,8 @@ jobs:
         asset_content_type: application/x-gzip
 
     - name: Download ARM
-      uses: actions/download-artifact@v4.1.7
+      # This points to the latest download-artifact v4.x.x.
+      uses: actions/download-artifact@v4
       with:
         name: arm-tarball
     - name: Upload ARM
@@ -607,7 +615,8 @@ jobs:
         asset_content_type: application/x-gzip
 
     - name: Download Android
-      uses: actions/download-artifact@v4.1.7
+      # This points to the latest download-artifact v4.x.x.
+      uses: actions/download-artifact@v4
       with:
         name: android-tarball
     - name: Upload Android
@@ -622,7 +631,8 @@ jobs:
         asset_content_type: application/x-gzip
 
     - name: Download Windows
-      uses: actions/download-artifact@v4.1.7
+      # This points to the latest download-artifact v4.x.x.
+      uses: actions/download-artifact@v4
       with:
         name: windows-zip
     - name: Upload Windows