[dianagudu]

Summary

• Update all GitHub Actions to their current major versions:
  • actions/checkout v4/v6 → v7
  • actions/setup-node v4 → v7
  • docker/login-action v3 → v4
  • docker/setup-buildx-action v3 → v4
  • docker/metadata-action v5 → v6
  • docker/build-push-action v6 → v7
• Replace the unmaintained wangchucheng/git-repo-sync@v0.1.0 action with an equivalent inline Git mirror step.
• Add read-only workflow permissions to the mirror workflow.
• Leave the disabled deployment job unchanged; it will be handled separately when the new VM is ready.

Verification

• Workflow YAML parses successfully.
• Prettier check passes.
• Actionlint reports no new errors; only the pre-existing warnings in the disabled deployment job remain.
• The PR image build will verify checkout v7 and Docker action v7/v4/v6 compatibility without pushing.
• After merge, verify the mirror workflow and prerel image publishing.

[Copilot]

🟡 Changes recommended

On tag pushes, the unconditional branch push fails from detached HEAD and exits the workflow before tags can be pushed to GitLab.

1 open issue

• Skip branch push on tag events · New

What changed in this PR

This PR updates the actions used by CI and image publishing and replaces the third-party repository sync action with inline Git commands.

Changes:

• Upgrade checkout, Node setup, and Docker actions to newer major versions.
• Replace the mirror action with explicit Git push and delete handling.
• Restrict the mirror workflow’s GitHub token to read-only repository access, leaving the disabled deployment job unchanged.

File	Description
.github/​workflows/​mirror-repo.yml	Updates checkout, adds read-only permissions, and implements inline GitLab mirroring.
.github/​workflows/​ci-cd.yml	Updates checkout, Node setup, and Docker action versions.

_{Review effort: Balanced}