Replace deprecated dsaltares/fetch-gh-release-asset with robinraju/re…

[lrknox]

…lease-downloader

Fixes DEP0040/DEP0169 deprecation warnings and "Could not find asset id" error caused by the unmaintained dsaltares action. Replaces all 25 usages across 5 workflow files with robinraju/release-downloader@v1, mapping repo→repository, version tags/TAG→tag TAG, file→fileName, and target→out-file-path.

[brtnfld]

Mismatch in .github/workflows/cmake-script.yml

While cmake-bintest.yml and cmake-ctest.yml were updated with the new hdf_tag logic, .github/workflows/cmake-script.yml was only partially modified. It was migrated to use robinraju/release-downloader, but did not receive the hdf_tag input changes.

Under the "Get hdf5 release" steps in cmake-script.yml, the code currently does this:

- name: Get hdf5 release
        if: ${{ (inputs.use_environ == 'release') }}
        uses: robinraju/release-downloader@v1
        with:
          repository: 'HDFGroup/hdf5'
          tag: '${{ inputs.use_hdf }}'
          fileName: '${{ inputs.use_hdf }}-win-vs2022_cl.zip'
          token: ${{ github.token }}

Why this will fail:

If inputs.use_hdf is passed as hdf5-2.1.1 (to match the filename hdf5-2.1.1-win-vs, the action will attempt to search for the release tag hdf5-2.1.1. This will fail with a 404 Not Found because the official repository tag is 2.1.1

If inputs.use_hdf is passed as 2.1.1 (to match the tag), the download will search for the asset 2.1.1-win-vs2022_cl.zip, which does not exist.

Suggested Fix:
Update .github/workflows/cmake-script.yml to match the patterns used in cmake-bintest.yml and cmake-ctest.yml:

Add hdf_tag to the inputs of cmake-script.yml:

    hdf_tag:
            description: "The hdf5 release tag for asset download (version only, without hdf5- prefix)"
            required: false
            type: string
            default: ''

Update the tag fields under the release download steps:

  - name: Get hdf5 release
           if: ${{ (inputs.use_environ == 'release') }}
           uses: robinraju/release-downloader@v1
           with:
             repository: 'HDFGroup/hdf5'
             tag: '${{ inputs.hdf_tag }}'
             fileName: '${{ inputs.use_hdf }}-win-vs2022_cl.zip'
             token: ${{ github.token }}

(Apply this update to all other release-download blocks for Linux and macOS inside cmake-script.yml)

[brtnfld]

| Severity | File | Issue

-- | -- | -- | --
1 | Critical | cmake-script.yml:517 | tag/fileName swapped for Windows_intel release — the only wrong block out of 25
2 | Critical | publish-release.yml:38 | inputs.use_hdf undeclared; evaluates to ''; S3 sync may wipe target (pre-existing, preserved by PR)
3 | High | BLOSC2/src/H5Zblosc2.c:428 | %z is not a valid C format specifier — UB (pre-existing, in touched function)
4 | Medium | BLOSC2/src/H5Zblosc2.c:443 | %d for size_t left unfixed while line 401 was fixed — inconsistent
5 | Medium | BLOSC2/src/H5Zblosc2.c:401 | %lu wrong for size_t on Windows MSVC (LLP64); should be %zu

Finding 1 — ACCURATE (cmake-script.yml:517)

Confirmed by reading the file directly. The release step has:

tag: '${{ inputs.use_hdf }}' # wrong: e.g. "hdf5-1.14.5"
fileName: '${{ inputs.hdf_tag }}-win-vs2022_intel.zip' # wrong: e.g. "1.14.5-..."
The snapshot step immediately above and every other platform's release step both correctly use hdf_tag for tag and use_hdf for fileName. The subsequent unzip line also uses use_hdf, so the file it tries to extract will never have been downloaded.

Finding 2 — ACCURATE (pre-existing bug preserved) (publish-release.yml:38)

The full file has only two declared inputs (use_tag, target_dir). Line 38 references ${{ inputs.use_hdf }} which is undeclared and evaluates to "". This was already present on main with the old action — the PR didn't introduce it, it preserved it.

Finding 3 — ACCURATE (pre-existing, in touched function) (BLOSC2/src/H5Zblosc2.c:428)

Line 428 confirmed:

sprintf(errmsg, "Too few dimensions for B2ND in filter values (%z/%d)", cd_nelmts - 8, ndim);
%z is a C length modifier, not a conversion specifier — it must be followed by d, u, i, etc. (%zu). With / as the "conversion character", this is undefined behavior per C99 §7.19.6.1. Unchanged by the PR but inside a modified function.

Finding 4 — ACCURATE (BLOSC2/src/H5Zblosc2.c:443)

Line 443 confirmed:

sprintf(errmsg, "Too few filter parameters for Blosc2 compression: %d", cd_nelmts);
cd_nelmts is size_t. The PR fixed the identical pattern at line 401 (%d → %lu) but left this instance unchanged — an inconsistency introduced by the partial fix.

Finding 5 — ACCURATE (BLOSC2/src/H5Zblosc2.c:401)

Line 401 confirmed:

sprintf(errmsg, "Too few filter parameters for B2ND: %lu", cd_nelmts);
%lu is unsigned long. On Windows MSVC (LLP64 ABI), unsigned long is 32-bit while size_t is 64-bit — wrong type. The portable fix is %zu. An improvement over the original %d, but still wrong on Windows.