[3.10] gh-129641: Docs GHA build: use upload-artifact@v4 & Python 3.12

[encukou]

Use actions/upload-artifact@v4

The old version is discontinued and fails the build.

Switch to v4, and add options for backwards compatibility (from the docs at: https://github.com/actions/upload-artifact?tab=readme-ov-file#breaking-changes )

Use Python 3.12

The required version of Sphinx requires imghdr, which was removed in 3.13.

• Issue: 3.10: GHA Docs builds of PRs fail because they use removed actions/upload-artifact: v3 #129641

[hugovk]

As an act of preventative maintenance, shall we bump the other actions too? They will stop working too at some point, and we're already getting warnings for actions/setup-python@v4:

https://github.com/python/cpython/actions/runs/11667130843

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0d7545368d7..93d74375489 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -67,7 +67,7 @@ jobs:
     if: needs.check_source.outputs.run_tests == 'true'
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
       - name: Install Dependencies
         run: |
             sudo ./.github/workflows/posix-deps-apt.sh
@@ -97,7 +97,7 @@ jobs:
     if: needs.check_source.outputs.run_tests == 'true'
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
       - name: Install Dependencies
         run: sudo ./.github/workflows/posix-deps-apt.sh
       - name: Add ccache to PATH
@@ -222,7 +222,7 @@ jobs:
         echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> $GITHUB_ENV
     - name: 'Restore OpenSSL build'
       id: cache-openssl
-      uses: actions/cache@v3.0.2
+      uses: actions/cache@v4
       with:
         path: ./multissl/openssl/${{ env.OPENSSL_VER }}
         key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -270,7 +270,7 @@ jobs:
         echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> $GITHUB_ENV
     - name: 'Restore OpenSSL build'
       id: cache-openssl
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: ./multissl/openssl/${{ env.OPENSSL_VER }}
         key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index ee02848417c..86f281722b8 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -36,7 +36,7 @@ jobs:
     - name: Register Sphinx problem matcher
       run: echo "::add-matcher::.github/problem-matchers/sphinx.json"
     - name: 'Set up Python'
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '3'
         cache: 'pip'
@@ -46,7 +46,7 @@ jobs:
     - name: 'Build HTML documentation'
       run: make -C Doc/ SPHINXOPTS="-q" SPHINXERRORHANDLING="-W --keep-going" html
     - name: 'Upload'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: doc-html
         path: Doc/build/html
@@ -59,7 +59,7 @@ jobs:
     - uses: actions/checkout@v4
     - name: Register Sphinx problem matcher
       run: echo "::add-matcher::.github/problem-matchers/sphinx.json"
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         path: ~/.cache/pip
         key: ubuntu-doc-${{ hashFiles('Doc/requirements.txt') }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 4a08ef0d8da..ab8ce3855cb 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
     - name: "Check PRs"
-      uses: actions/stale@v5
+      uses: actions/stale@v9
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-pr-message: 'This PR is stale because it has been open for 30 days with no activity.'
diff --git a/.github/workflows/verify-ensurepip-wheels.yml b/.github/workflows/verify-ensurepip-wheels.yml
index 458e44413e5..8eaca6cd064 100644
--- a/.github/workflows/verify-ensurepip-wheels.yml
+++ b/.github/workflows/verify-ensurepip-wheels.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: '3'
       - name: Compare checksums of bundled pip and setuptools to ones published on PyPI

Also:

The `save-state` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

This can also be a separate PR.

[encukou]

@pablogsal, you're the RM; if you ask me I'll send a PR with eager updates.

I won't send it ...eagerly... as I haven't read the upgrade instructions for all of those, and for most I hope I won't have to until 3.10 goes EOL.
If/when any stop working, we should usually be able backport from main (or an older bugfix branch). I'd prefer doing eager updates there.

[encukou]

Turns out we need to restrict Python to 3.12 (or below) as well.

[miss-islington-app]

Thanks @encukou for the PR, and @pablogsal for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9.
🐍🍒⛏🤖

[miss-islington-app]

Sorry, @encukou and @pablogsal, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 7b0351cf6afb7ff8aae8d7fb2949e5578d483bca 3.9

[bedevere-app]

GH-130114 is a backport of this pull request to the 3.9 branch.