Update the download/upload artifact actions to version 4.

[teo-tsirpanis]

Artifacts are now immutable and we can't upload many times to the same one as we do in the Release workflow, but what we can do is upload to many artifacts with a common prefix, and download all of them with a pattern.

---

TYPE: NO_HISTORY

[eddelbuettel]

Thanks for catching that. I find this (very common!) practice of a pinned version totally insane as well have to go around every couple of years to increment the value. What the heck is wrong with '@latest', preferably automatically picked?

[teo-tsirpanis]

What the heck is wrong with @latest, preferably automatically picked?

We protect ourselves from arbitrary code execution if the repository with the action gets compromised. The most secure thing we can do is pin on the Git hash, because the v4 tag for these actions for example will move to the latest 4.x action, and we do pin on the hash one action that requires advanced permissions but I'm fine with pinning on the tag actions provided by GitHub. We can use Dependabot to automatically open PRs to update the actions.

And we also protect ourselves from breaking changes, like here where CI fails because the new actions run on a Node.js version with a new libc, while some jobs run on Manylinux with a not so new libc.

[teo-tsirpanis]

Closing, we cannot merge it until we are able to bump the manylinux version used by CI.