MAINT: Add dependabot and fix outdated action

Author: larsoner

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/wheels.yml

@@ -44,7 +44,7 @@ jobs:
           fetch-depth: 0
       - name: Build sdist
         run: pipx run build -s
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: sdist
           path: ./dist/*.tar.gz
@@ -96,7 +96,7 @@ jobs:
         env:
           CIBW_BUILD: ${{ matrix.python }}-${{ matrix.buildplat[1] }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.python == '*' && 'all' || matrix.python }}-${{ startsWith(matrix.buildplat[1], 'macosx') && 'macosx' || matrix.buildplat[1] }}
           path: ./wheelhouse/*.whl
@@ -106,7 +106,7 @@ jobs:
     needs: [build-sdist]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           name: sdist
           path: ./dist
@@ -127,7 +127,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test-sdist, build-wheel]
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: dist/
       - name: Check artifacts
@@ -143,16 +143,20 @@ jobs:
     runs-on: ubuntu-latest
     environment: "Package deployment"
     needs: [pre-publish]
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: dist/
+          pattern: '*'
+          merge-multiple: true
       - name: Consolidate artifacts
         run: |
+          set -eo pipefail
           mv dist/*/*.{tar.gz,whl} dist
           rmdir dist/*/
+          ls -lR dist/
       - uses: pypa/gh-action-pypi-publish@release/v1
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')