ci: updated github actions ci workflow

[Phillip9587]

The same has been done for body-parser expressjs/body-parser#546 and router pillarjs/router#143

I noticed that the current CI workflow in this repository could benefit from some updates. Specifically:

1. Node.js Installation in the Matrix Test Run:

   • Currently, the workflow uses nvm to install Node.js versions.
   • It might be worth considering switching to the official actions/setup-node action. This action can leverage cached Node.js versions from the runner, which could improve efficiency and speed up the CI pipeline.

2. Deprecation of Artifact Actions v3:

   • The actions/upload-artifact@v3 and actions/download-artifact@v3 actions are being deprecated as of November 30, 2024 (GitHub Deprecation Notice).
   • These actions should be updated to their latest versions to ensure continued functionality in the CI workflow.

3. The Coverage setup could also be optimized:

   • Currently, the workflow uses the coverallsapp/github-action@master which points to v1 of this action. This v1 action uses node16 as runtime which is deprecated.

4. Minimum token permissions for the GITHUB_TOKEN:

   • GitHub Actions workflows have a GITHUB_TOKEN with write access to multiple scopes.
   • It is a best practice to reduce the scopes to the minimum needed for each workflow / step.
   • GitHub recommends defining minimum GITHUB_TOKEN permissions. https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
   • The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue. This change will help increase the Scorecard score for this repository.

[bjohansebas]

I would suggest making the linter a separate job, as it is done in express.

https://github.com/expressjs/express/blob/52ed64606fc1f5114d90265a66275a18f2d773af/.github/workflows/ci.yml#L23-L41

[wesleytodd]

I would like to merge this before we do the release. @bjohansebas you didn't make your review "request changes", does that mean you are not blocking on that comment? If so, I would like to merge this as is and we can revisit the lint job in a followup.

[Phillip9587]

@wesleytodd I can make the change now if you want me to?

[bjohansebas]

Yep, it's not a comment that blocks this PR

[wesleytodd]

Sorry, I saw the notification for the body-parser repo and thought it was for this. If you want to make it now that's fine, but I am not super concerned with landing it and I would like to release this now. So maybe we just merge this as is since it has been reviewed and approved and we can land that after.