Bring the GitHub Actions up to date, and let Dependabot keep them there

.github/dependabot.yml

@@ -0,0 +1,19 @@
+# Keeps the GitHub Actions in `.github/workflows/` current.
+#
+# Julia dependencies are not handled here — Dependabot has no Julia ecosystem, and
+# `.github/workflows/CompatHelper.yml` already opens the `[compat]` bumps nightly.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    # One PR per action rather than a combined bump: a major of `setup-julia` or `codecov-action`
+    # can need a workflow change alongside it, and that is easier to review on its own.
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "CI"
+    labels:
+      - dependencies
+      - github-actions

.github/workflows/CI.yml

@@ -10,6 +10,23 @@ concurrency:
     # Cancel intermediate builds: only if it is a pull request build.
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
+# Temporary: go straight to the General registry instead of through a package server.
+#
+# `AbstractNeuralNetworks` 0.7.0 was registered at 04:00 UTC on 2026-08-23 and the package servers
+# were still serving a registry that stopped at 0.6.4 hours later, so jobs died in `Pkg.resolve`
+# before running anything. It is not a matter of picking a better server: all eight official
+# mirrors, in both the conservative and the eager flavour, and the third-party storage mirrors too,
+# were serving the identical tree — the lag is at the storage server they all pull from. An empty
+# `JULIA_PKG_SERVER` makes Pkg clone the registry over git and fetch packages from their own
+# repositories, which resolves the same environment that resolves locally. Same workaround as
+# SymbolicNeuralNetworks.jl.
+#
+# The cost is speed: no CDN and no registry tarball. Remove this once the package servers have
+# caught up (check with `curl -sL https://pkg.julialang.org/registries` against
+# `gh api repos/JuliaRegistries/General/commits/master --jq .commit.tree.sha`), and check whether it
+# is still needed before assuming it is.
+env:
+  JULIA_PKG_SERVER: ""
 jobs:
     test:
         name: Julia ${{ matrix.version }} - ${{ matrix.os }} - ${{ matrix.arch }} - ${{ github.event_name }}
@@ -25,45 +42,53 @@ jobs:
                     - ubuntu-latest
                     - macOS-latest
                     - windows-latest
+                # `default` is the runner's own architecture. Not `x64`: `macOS-latest` is aarch64,
+                # and setup-julia v3 refuses `x64` there unless `force-arch` is set, because that
+                # build runs under Rosetta.
                 arch:
-                    - x64
+                    - default
                 experimental: [false]
                 include:
                     - version: "^1.13.0-0"
                       os: ubuntu-latest
-                      arch: x64
+                      arch: default
                       experimental: true
                     - version: "^1.13.0-0"
                       os: macOS-latest
-                      arch: x64
+                      arch: default
                       experimental: true
                     - version: "^1.13.0-0"
                       os: windows-latest
-                      arch: x64
+                      arch: default
                       experimental: true
                     - version: "nightly"
                       os: ubuntu-latest
-                      arch: x64
+                      arch: default
                       experimental: true
                     - version: "nightly"
                       os: macOS-latest
-                      arch: x64
+                      arch: default
                       experimental: true
                     - version: "nightly"
                       os: windows-latest
-                      arch: x64
+                      arch: default
                       experimental: true
         steps:
-            - uses: actions/checkout@v4
-            - uses: julia-actions/setup-julia@v1
+            - uses: actions/checkout@v7
+            - uses: julia-actions/setup-julia@v3
               with:
                   version: ${{ matrix.version }}
                   arch: ${{ matrix.arch }}
-            - uses: julia-actions/cache@v1
+            # `cache-registries` defaults to true; with the git registry above, a restored copy is
+            # whatever the previous run cloned, which puts the staleness straight back. Artifacts,
+            # packages and compiled code are still cached, which is where the time goes.
+            - uses: julia-actions/cache@v3
+              with:
+                  cache-registries: "false"
             - uses: julia-actions/julia-buildpkg@v1
             - uses: julia-actions/julia-runtest@v1
             - uses: julia-actions/julia-processcoverage@v1
-            - uses: codecov/codecov-action@v3
+            - uses: codecov/codecov-action@v7
               env:
                   CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
               with:

.github/workflows/Documenter.yml

@@ -7,19 +7,25 @@ on:
     tags: '*'
   pull_request:
 
+# Temporary: go straight to the General registry instead of through a package server; see the
+# comment in `CI.yml`. Same workaround as SymbolicNeuralNetworks.jl.
+env:
+  JULIA_PKG_SERVER: ""
 jobs:
   build:
     name: Documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
       - name: Install packages for generating tikz images
         run: |
           sudo apt-get install imagemagick
           sudo apt-get install poppler-utils
           sudo apt-get install texlive-xetex
           sudo apt-get install texlive-science
-      - uses: julia-actions/setup-julia@latest
+      # `@latest` is not a moving alias — it is a literal tag, and upstream stopped moving it
+      # in November 2024. Pin the major instead.
+      - uses: julia-actions/setup-julia@v3
         with:
           version: '1'
       - name: Install BrenierTwoFluid package

.github/workflows/Latex.yml

@@ -6,11 +6,15 @@ on:
       - main
   pull_request:
 
+# Temporary: go straight to the General registry instead of through a package server; see the
+# comment in `CI.yml`. Same workaround as SymbolicNeuralNetworks.jl.
+env:
+  JULIA_PKG_SERVER: ""
 jobs:
   LatexDocs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: install imagemagick, poppler-utils and texlive
         run: |
             sudo apt-get install imagemagick
@@ -20,7 +24,7 @@ jobs:
             sudo apt-get install latex-cjk-all
             sudo apt-get install texlive-fonts-recommended
             sudo apt-get install texlive-fonts-extra
-      - uses: julia-actions/setup-julia@latest
+      - uses: julia-actions/setup-julia@v3
         with:
           version: '1'
       - name: install BrenierTwoFluid
@@ -53,7 +57,7 @@ jobs:
           xelatex -shell-escape GeometricMachineLearning.jl.tex
           xelatex -shell-escape GeometricMachineLearning.jl.tex
       - name: Upload PDF file
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Docs in PDF version
           path: docs/build/GeometricMachineLearning.jl.pdf

.github/workflows/Register.yml

@@ -9,6 +9,8 @@ jobs:
   register:
     runs-on: ubuntu-latest
     steps:
-      - uses: julia-actions/RegisterAction@latest
+      # The `latest` tag points at a 2022 commit that matches no release; v0.3.2 (2023-01) is
+      # the newest one there is.
+      - uses: julia-actions/RegisterAction@v0.3.2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}