Pin GHA's upload-artifact to 3.1.3

[marcospri]

As a temporary workaround for the changes newer versions (>3.2.0) around not uploading temporary hidden files

[robertknight]

As a temporary workaround for the changes newer versions (>3.2.0) around not uploading temporary files

The issue is not uploading hidden files specifically, see actions/upload-artifact#602. The suggested workaround on that issue of setting the include-hidden-files option for the action did not work in my testing (thread).

I did get an alternative solution working by configuring COVERAGE_FILE to use a non-hidden name, but that's more complex to roll out everywhere:

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a244d13b1..6a6eada4a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -95,12 +95,14 @@ jobs:
       - run: python -m pip install 'tox<4'
       - run: tox -e tests
         env:
-          COVERAGE_FILE: .coverage.${{ matrix.python-version }}
+          # Use a non-hidden file name to work around issues uploading hidden
+          # files in `actions/upload-artifact`.
+          COVERAGE_FILE: coverage.tests
       - name: Upload coverage file
         uses: actions/upload-artifact@v3
         with:
           name: coverage
-          path: .coverage.*
+          path: coverage.tests
   Coverage:
     needs: tests
     runs-on: ubuntu-latest
@@ -123,6 +125,10 @@ jobs:
           name: coverage
       - run: python -m pip install 'tox<4'
       - run: tox -e coverage
+        env:
+          # nb. In this context `COVERAGE_FILE` specifies a basename. All files
+          # matching `coverage.{name}` will be combined.
+          COVERAGE_FILE: coverage
   Functests:
     runs-on: ubuntu-latest
     services:
diff --git a/tox.ini b/tox.ini
index d9758c08a..f11c2da40 100644
--- a/tox.ini
+++ b/tox.ini
@@ -101,7 +101,7 @@ setenv =
     dev: WEB_CONCURRENCY = {env:WEB_CONCURRENCY:2}
     dev: H_API_AUTH_COOKIE_SECRET_KEY = {env:H_API_AUTH_COOKIE_SECRET_KEY:"dev_h_api_auth_cookie_secret_key"}
     dev: H_API_AUTH_COOKIE_SALT = {env:H_API_AUTH_COOKIE_SALT:"dev_h_api_auth_cookie_salt"}
-    tests: COVERAGE_FILE = {env:COVERAGE_FILE:.coverage.{envname}}
+    {coverage,tests}: COVERAGE_FILE = {env:COVERAGE_FILE:.coverage.{envname}}
     dev: DATABASE_URL = {env:DATABASE_URL:postgresql://postgres@localhost/postgres}
     dev: REPLICA_DATABASE_URL = {env:DATABASE_URL:postgresql://postgres@localhost/postgres}
     tests: DATABASE_URL = {env:DATABASE_URL:postgresql://postgres@localhost/h_tests}