ci(backport): Update GitHub Actions workflows (#2279)

* Backport components of:
   - PR #2103
   - PR #2237
   - PR #2248
   - PR #2254
   - PR #2275

.github/workflows/docs.yml

@@ -84,8 +84,14 @@ jobs:
         # is not empty
         [ "$(ls -A docs/_build/html/lite)" ]
 
+    - name: Fix permissions if needed
+      run: |
+        chmod -c -R +rX "docs/_build/html/" | while read line; do
+          echo "::warning title=Invalid file permissions automatically fixed::$line"
+        done
+
     - name: Upload artifact
-      uses: actions/upload-pages-artifact@v1
+      uses: actions/upload-pages-artifact@v2
       with:
         path: 'docs/_build/html'
 

.github/workflows/lint.yml

@@ -18,6 +18,6 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Lint Dockerfile
-      uses: hadolint/hadolint-action@v2.1.0
+      uses: hadolint/hadolint-action@v3.1.0
       with:
         dockerfile: docker/Dockerfile

.github/workflows/lower-bound-requirements.yml

@@ -39,4 +39,4 @@ jobs:
         # free. Though still show warnings by setting warning control to 'default'.
         export PYTHONWARNINGS='default'
         # Run on tests/ to skip doctests of src given examples are for latest APIs
-        pytest --override-ini filterwarnings= --ignore tests/benchmarks/ --ignore tests/contrib --ignore tests/test_notebooks.py tests/
+        pytest --override-ini filterwarnings= --ignore tests/contrib --ignore tests/benchmarks --ignore tests/test_notebooks.py tests/

.github/workflows/publish-package.yml

@@ -123,13 +123,13 @@ jobs:
       if: >-
         (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pyhf')
         || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pyhf')
-      uses: pypa/gh-action-pypi-publish@v1.8.6
+      uses: pypa/gh-action-pypi-publish@v1.8.10
       with:
         repository-url: https://test.pypi.org/legacy/
         print-hash: true
 
     - name: Publish distribution 📦 to PyPI
       if: github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pyhf'
-      uses: pypa/gh-action-pypi-publish@v1.8.6
+      uses: pypa/gh-action-pypi-publish@v1.8.10
       with:
         print-hash: true