release: compute the prefix in the step that uses it, and sync action versions

The previous commit guarded the symptom. The structure was the problem:
the prefix went out through $GITHUB_OUTPUT and came back as a ${{ }}
expression, which GitHub splices into the next run: block as script text
before any shell parses it.

That hop is worse than what it replaced. The original 'echo prefix=$( ... )'
used an unquoted command substitution, so word splitting collapsed newlines
into spaces and only ever one line reached $GITHUB_OUTPUT. Assigning to a
variable and echoing it quoted preserves them: a directory name containing
a newline writes extra variables into $GITHUB_OUTPUT, which then chain into
the next step. Measured: old form 1 line, new form 3.

So drop the hop. The prefix is computed in the Build assets step and passed
as "$prefix" -- real shell quoting this time, since bash does the expansion
rather than the templating engine. filename_prefix comes in through env for
the same reason. No expression is now spliced into any run: block, and the
character allowlist added in the previous commit is no longer load-bearing,
so it goes.

Also takes upstream's actions/checkout@v6 and actions/setup-python@v6,
which is what the Node 20 deprecation notice on our runs was about. The
upstream AWS S3 upload step is deliberately not adopted: it targets
Adafruit's bucket.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: tyeth

.github/workflows/build.yml

@@ -7,13 +7,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Python 3
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v6
       with:
         python-version: 3.x
     - name: Versions
       run: |
         python3 --version
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
       with:
         submodules: true
     - name: Fetch correct submodule shas

.github/workflows/release.yml

@@ -10,20 +10,18 @@ jobs:
     steps:
     - name: Translate Repo Name For Build Tools filename_prefix
       id: repo-name
+      env:
+        REPO: ${{ github.repository }}
       run: |
-        echo "repo-name=$(
-        echo ${{ github.repository }} |
-        awk -F '\/' '{ print tolower($2) }' |
-        tr '_' '-'
-        )" >> $GITHUB_OUTPUT
+        echo "repo-name=$(echo "$REPO" | awk -F '/' '{ print tolower($2) }' | tr '_' '-')" >> "$GITHUB_OUTPUT"
     - name: Set up Python 3
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v6
       with:
         python-version: 3.x
     - name: Versions
       run: |
         python3 --version
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
       with:
         submodules: true
     - name: Fetch correct submodule shas
@@ -32,9 +30,16 @@ jobs:
       run: |
         sudo apt-get install -y gettext gawk
         pip install -r requirements.txt
-    - name: Package Folder Prefix For circuitpython-build-tools (Community Bundle Specific)
-      id: pkg-folder
+    - name: Build assets
+      env:
+        # Passed as environment, not spliced into the script by the expression.
+        FILENAME_PREFIX: ${{ steps.repo-name.outputs.repo-name }}
       run: |
+        # Computed in the step that consumes it. Going via $GITHUB_OUTPUT and an
+        # expression would put a directory name into the next step as script text:
+        # a newline in it writes extra variables to $GITHUB_OUTPUT, and a quote or
+        # backtick escapes whatever quoting that step uses. Held in a shell
+        # variable it stays exactly one argument.
         prefix=$(
         ls -RUx |
         gawk -F '\n' '{ match($1, /(drivers|helpers)\/(.+)\/(.+)\:/, arr) ; if (length(arr[0]) > 0 && match(arr[3], arr[2]) > 0) printf "%s, ", arr[3] }' |
@@ -47,17 +52,7 @@ jobs:
           echo "::error::no package folders matched under libraries/; refusing to build an empty bundle"
           exit 1
         fi
-        # ${{ }} splices this into the later run: block as text, before any shell
-        # sees it, so the quotes there cannot contain a folder name carrying a
-        # quote or a backtick. Allow only what a module name can be.
-        case "$prefix" in
-          *[!A-Za-z0-9_, -]*)
-            echo "::error::unexpected character in package folder list: $prefix"
-            exit 1 ;;
-        esac
-        echo "prefix=$prefix" >> "$GITHUB_OUTPUT"
-    - name: Build assets
-      run: circuitpython-build-bundles --filename_prefix ${{ steps.repo-name.outputs.repo-name }} --library_location libraries --library_depth 2 --package_folder_prefix "${{ steps.pkg-folder.outputs.prefix }}"
+        circuitpython-build-bundles --filename_prefix "$FILENAME_PREFIX" --library_location libraries --library_depth 2 --package_folder_prefix "$prefix"
     - name: Upload Release Assets
       uses: shogo82148/actions-upload-release-asset@v1
       with: