Upgrade to actions/upload-artifact@4.0.0 and actions/download-artifact@4.0.0

[freakboy3742]

What is the problem or limitation you are having?

The v4 releases of actions/upload-artifact and actions/download-artifact include a series of massive backwards incompatibilities:

• It is no longer possible to upload multiple artefacts with the same name
• It is no longer possible to download multiple artefacts with a wildcard (unconfirmed, but definitely not documnted)
• If you download multiple artefacts, they are now put into parallel subdirectories, instead of being merged into a single directory.

Describe the solution you'd like

Make the changes necessary to track the new releases.

Describe alternatives you've considered

• Stay on the v3 series forever. This will eventually cause bitrot, because the underlying Node version will be deprecated.
• Fork the packages...

Additional context

Github issue requesting guidance on migration

The following Dependabot PRs were created automatically, and failed CI:

• Bump actions/download-artifact from 3.0.2 to 4.0.0 #75
• Bump actions/upload-artifact from 3.1.3 to 4.0.0 #76
• Bump actions/upload-artifact from 3.1.3 to 4.0.0 briefcase#1577
• Bump actions/download-artifact from 3.0.2 to 4.0.0 briefcase#1578
• Bump actions/download-artifact from 3.0.2 to 4.0.0 rubicon-objc#394
• Bump actions/download-artifact from 3.0.2 to 4.0.0 travertino#119
• Bump actions/download-artifact from 3.0.2 to 4.0.0 toga#2285
• Bump actions/upload-artifact from 3.1.3 to 4.0.0 toga#2286
• Bump actions/download-artifact from 3.0.2 to 4.0.0 toga-chart#73

The following Dependabot PRs were created automatically, and passed CI:

• Bump actions/upload-artifact from 3.1.3 to 4.0.0 cpython-apple-source-deps#2
• Bump actions/download-artifact from 3.0.2 to 4.0.0 cpython-apple-source-deps#3
• Bump actions/upload-artifact from 3.1.3 to 4.0.0 Python-Apple-support#195
• Bump actions/download-artifact from 3.0.2 to 4.0.0 Python-Apple-support#196
• Bump actions/upload-artifact from 3.1.3 to 4.0.0 Python-support-testbed#52
• Bump actions/download-artifact from 3 to 4 briefcase-macOS-app-template#31
• Bump actions/upload-artifact from 3 to 4 briefcase-macOS-app-template#32
• Bump actions/download-artifact from 3 to 4 briefcase-windows-app-template#28
• Bump actions/upload-artifact from 3 to 4 briefcase-windows-app-template#29

Even though they passed CI, Dependabot was suspended for the upload/download actions. It's possible they've worked as intended; but given the size of the change, they usage needs to be carefully audited.

[rmartin16]

While the situation has improved for using the latest version of these actions, after experimenting with them a bit for a separate project, the downloading of artifacts seems much more finicky now. I have seen much higher rates of failures for downloads than with the previous version; most seem to be of the nature of a timeout.

So, while anecdotal, we'll probably be best served by letting these new GitHub services mature a bit more before implementing them en masse.

[rmartin16]

Additionally, because the previous and new versions are not compatible with each other in at least one important operating mode, the upgrade will likely require several co-dependent PRs to rollout the updates to use the new versions across the repos.

[rmartin16]

FWIW, more anecdotes about timeouts (which I'm also still seeing in a daily workflow I set up):

• Provide guidance for workflows broken by @4? actions/upload-artifact#472 (comment)
• https://github.com/orgs/community/discussions/81413
• Probably most relevant --> [bug] Unable to download artifact(s): Unable to download and extract artifact: Request timeout actions/download-artifact#249

[rmartin16]

I went ahead and did the work to upgrade to v4; whether you want to merge this now or later is up to you. There are still the request timeouts for the download-artifact action....but they seem like they may be occurring less often.

In general, the upgrades are rather straightforward; for the repos where the Dependabot PR succeeded, these new PRs can be merged independently and whenever. Although, I wasn't sure how to test any of them...

As for the repos where the Dependabot PRs failed, these new PRs will all need to be merged in tandem with #78.

The one peculiar bit is the output artifact-name from the python-package-create workflow; it required a non-obvious change for Toga so definitely evaluate if you agree with my change.