ci: upgrade 3rd-party GitHub Actions to latest versions (PFP-3026)

[rajkz-dh]

Summary

Upgrades all outdated 3rd-party GitHub Actions across 33 workflow files and pins every action to a commit hash (not a floating tag). Also migrates deprecated `cloudflare/pages-action` and `codecov/test-results-action`. Motivated by INC-2615 (Trivy supply chain incident) and tracked under PFP-3026.

Actions upgraded

Sub-issue	Action	Old	New	Commit hash
PFP-3027	`actions/checkout`	v4 (various hashes)	v6.0.2	`de0fac2e`
PFP-3028	`actions/cache` + `cache/save` + `cache/restore`	v4	v5.0.4	`66822842`
PFP-3029	`actions/upload-artifact`	v3/v4	v7.0.0	`bbbca2dd`
PFP-3030	`actions/download-artifact`	v4/v6	v8.0.1	`3e5f45b2`
PFP-3031	`actions/setup-python`	v5	v6	`a309ff8b`
PFP-3032	`actions/setup-java`	v4	v5	`be666c2f`
PFP-3033	`actions/create-github-app-token`	v1	v3.1.1	`1b10c78c`
PFP-3034	`acryldata/sane-checkout-action`	—	v7 (already current)	`186e92cc`
PFP-3035	`gradle/actions/setup-gradle`	v4	v5.0.2	`07231958`
PFP-3036	`gradle/gradle-build-action`	v2/v3	v3.5.0	`ac2d340d`
PFP-3037	`docker/login-action`	v3	v4.0.0	`b45d80f8`
PFP-3038	`astral-sh/setup-uv`	v5	v7.6.0	`37802adc`
PFP-3039	`aws-actions/configure-aws-credentials`	v5	v6.0.0	`8df58475`
PFP-3040	`dorny/paths-filter`	—	v4.0.1 (already current)	`fbd0ab8f`
PFP-3041	`cloudflare/pages-action` → `wrangler-action`	v1	v4.0.0	`ebbaa158`
PFP-3042	`amannn/action-semantic-pull-request`	v5	v6.1.1	`48f25628`
PFP-3043	`marocchino/sticky-pull-request-comment`	v2	v3.0.2	`70d2764d`
PFP-3044	`actions/setup-node`	—	not used in this repo	—
PFP-3045	`actions/setup-go`	—	not used in this repo	—

Codecov migration

`codecov/test-results-action` is deprecated in favour of `codecov/codecov-action` with `report_type: test_results`. Migrated all 11 usages across 10 workflow files:

• `codecov/test-results-action@0fa95f0e # v1` → `codecov/codecov-action@75cd1169 # v5.5.4` + `report_type: test_results`
• All existing coverage `codecov-action` steps also bumped from `1af58845` → `75cd1169` (v5.5.4)

Affected files: `build-and-test.yml`, `docker-unified.yml`, `docker-unified-nightly.yml`, `playwright-e2e-tests.yml`, `metadata-io.yml`, `metadata-ingestion.yml`, `airflow-plugin.yml`, `dagster-plugin.yml`, `gx-plugin.yml`, `prefect-plugin.yml`

Cloudflare migration notes (PFP-3041)

`cloudflare/pages-action` is deprecated. Migrated to `cloudflare/wrangler-action@v4.0.0`:

• `projectName` + `directory` inputs → `command: pages deploy --project-name=`
• Output `steps.cloudflare.outputs.url` → `steps.cloudflare.outputs.deployment-url`

Affected files: `react-cloudflare-pages.yml`, `python-build-pages.yml`

Notes

• `actions/create-github-app-token` was genuinely at v1 in this repo (unlike datahub-fork/datahub-apps where it was already at v3).
• `actions/cache/save` and `actions/cache/restore` sub-actions upgraded alongside `actions/cache`.
• All 16 commit hashes verified against the GitHub tag API.

Test plan

• Verify CI passes on this PR
• Check `react-cloudflare-pages.yml` deploys frontend preview successfully
• Check `python-build-pages.yml` publishes Python wheel site successfully
• Verify codecov test results upload works with `report_type: test_results`
• Verify upload/download artifact handoff between jobs (v7 + v8 are compatible)

[github-actions]

Linear: PFP-4032

Thanks for your contribution! We have created an internal ticket to track this PR. A member of the core DataHub team will be assigned to review it within the next few business days - you will get a follow-up comment once a reviewer is assigned.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[rajkz-dh]

All 16 action upgrades are correct — every commit hash verified against the GitHub tag API. Cloudflare pages-action → wrangler-action migration is syntactically correct including the deployment-url output ref fix. codecov/test-results-action properly migrated to codecov-action@v5.5.4 with report_type: test_results on all 11 usages.

Two minor description issues (fixed in updated description below):

• 6 stale commit hash prefixes from before hash-correction commits were pushed
• Missing codecov migration section