[DEPS] bump the github-actions group across 1 directory with 12 updates

.github/workflows/backport.yaml

@@ -60,7 +60,7 @@ jobs:
           client-id: ${{ vars.PUSH_TO_MAIN_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_TO_MAIN_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ steps.bot.outputs.token }}
@@ -69,7 +69,7 @@ jobs:
         # A late push run checks out its event sha as origin/main; rescan the real tip instead.
         run: git fetch origin +refs/heads/main:refs/remotes/origin/main
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12" # relstate uses dt.UTC (3.11+)
 
@@ -110,7 +110,7 @@ jobs:
           client-id: ${{ vars.PUSH_TO_MAIN_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_TO_MAIN_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: main
           fetch-depth: 0 # the decline reads the pick from the head and the base's history

.github/workflows/ci-frontend-lint.yaml

@@ -35,13 +35,13 @@ jobs:
       frontend: ${{ github.event_name != 'pull_request' || steps.filter.outputs.frontend == 'true' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Check for frontend changes
         if: github.event_name == 'pull_request'
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |
@@ -59,7 +59,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -96,7 +96,7 @@ jobs:
           fi
 
       - name: Render lint report to PR
-        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: always() && hashFiles('frontend/biome-report.md') != '' && github.event.pull_request.head.repo.fork == false
         with:
           header: frontend-lint-results
@@ -120,7 +120,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -171,7 +171,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 

.github/workflows/ci-test.yaml

@@ -47,13 +47,13 @@ jobs:
       release: ${{ github.event_name != 'pull_request' || steps.release_filter.outputs.release == 'true' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Check for changes outside ignored paths
         if: github.event_name == 'pull_request'
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           # `every`: a file counts as relevant only if it matches ALL the
@@ -77,7 +77,7 @@ jobs:
       # A separate step: `every` above would need one file to match all release paths at once.
       - name: Check for release tooling changes
         if: github.event_name == 'pull_request'
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: release_filter
         with:
           predicate-quantifier: some
@@ -104,20 +104,20 @@ jobs:
         tier: [unit, integration]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # rig --changed-only needs git history
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: "0.6.14"
           python-version: 3.12.9
           enable-cache: true
 
       - name: Cache tox environments
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .tox/
           # Tier in the key: legs build different tox envs, and parallel saves
@@ -170,7 +170,7 @@ jobs:
 
       - name: Upload tier reports artifact
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: reports-${{ matrix.tier }}
           path: reports/
@@ -193,7 +193,7 @@ jobs:
       UNSTRACT_TEST_VERSION: ${{ github.sha }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -204,20 +204,20 @@ jobs:
         # Dependabot triggers (they get only Dependabot secrets, none set), so
         # both pull anonymously and can hit Docker Hub's rate limit.
         if: (github.event.pull_request == null || github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: "0.6.14"
           python-version: 3.12.9
           enable-cache: true
 
       - name: Cache tox environments
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .tox/
           key: ${{ runner.os }}-tox-uv-e2e-${{ hashFiles('**/pyproject.toml', '**/tox.ini') }}
@@ -242,14 +242,14 @@ jobs:
         run: ./run-platform.sh -e
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Bake instead of `compose build` so each ephemeral runner restores layers
       # from the GHA cache the release workflow also writes (matching per-service
       # scopes), instead of building cold every run. `load` exports the images
       # into the daemon so the compose stack can boot them.
       - name: Build service images
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
         with:
           files: ./docker/docker-compose.build.yaml
           load: true
@@ -290,7 +290,7 @@ jobs:
 
       - name: Upload e2e reports artifact
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: reports-e2e
           path: reports/
@@ -304,7 +304,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -332,19 +332,19 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: "0.6.14"
           python-version: 3.12.9
           enable-cache: true
 
       - name: Cache tox environments
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .tox/
           key: ${{ runner.os }}-tox-uv-rig-${{ hashFiles('**/pyproject.toml', '**/tox.ini') }}
@@ -364,15 +364,15 @@ jobs:
       - name: Restore main-branch test baseline (for regression detection)
         # One unified baseline across all tiers; this job is its sole
         # reader+writer. Restore-only here, save below on green main.
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: reports/previous-summary.json
           key: unstract-test-baseline-main-${{ github.run_id }}
           restore-keys: |
             unstract-test-baseline-main-
 
       - name: Download tier reports
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: reports-*
           path: reports/
@@ -395,15 +395,15 @@ jobs:
         # actions/cache saves only on a miss; the run id keys each main build a
         # fresh entry, and restore-keys' prefix pulls the latest next run.
         if: github.ref == 'refs/heads/main'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: reports/previous-summary.json
           key: unstract-test-baseline-main-${{ github.run_id }}
 
       - name: Render combined test report to PR
         # Dependabot runs get a read-only GITHUB_TOKEN, so the comment would be
         # refused; skip it there like forks. The job summary still carries it.
-        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: always() && hashFiles('reports/combined-test-report.md') != '' && github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]'
         with:
           header: test-results
@@ -417,7 +417,7 @@ jobs:
 
       - name: Upload combined reports artifact
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-reports
           path: reports/

.github/workflows/docker-tools-build-push.yaml

@@ -37,7 +37,7 @@ jobs:
         run: echo "${{ toJSON(github.event.inputs) }}"
 
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 

.github/workflows/lint-pr.yaml

@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 20
     steps:
       # Rule read from main, so a PR cannot weaken relmgr; it can still edit this workflow.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: main
           sparse-checkout: .github/release

.github/workflows/production-build.yaml

@@ -114,14 +114,14 @@ jobs:
     steps:
       - name: Checkout code for release
         if: github.event_name == 'release'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.release.tag_name }}
           persist-credentials: false
 
       - name: Checkout code for branch
         if: github.event_name != 'release'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -207,7 +207,7 @@ jobs:
       # Upload status for summary job
       - name: Upload build status
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: build-status-${{ matrix.service_name }}
           path: build-status/${{ matrix.service_name }}.json
@@ -360,7 +360,7 @@ jobs:
       # Send summary notification to Slack
       - name: Send Slack summary notification
         if: always()
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           webhook-type: incoming-webhook
           payload: |

.github/workflows/release-branch-ci.yaml

@@ -22,14 +22,14 @@ jobs:
     env:
       BRANCH: ${{ github.base_ref || github.ref_name }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
           persist-credentials: false
 
       # Classifier read from main, so a PR cannot weaken relmgr.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: main
           path: .relmgr

.github/workflows/release-branch-only.yaml

@@ -40,13 +40,13 @@ jobs:
           esac
 
       # The head's tip SHA, so a push to the head after the label makes the bot push fail, not skip a check.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0 # every branch, so origin/<base> is current
           persist-credentials: false
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: main
           path: .relmgr

.github/workflows/release-notification.yaml

@@ -13,7 +13,7 @@ jobs:
     steps:
 
       - name: Send Slack notification
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           webhook-type: incoming-webhook
           payload: |

.github/workflows/state.yaml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -25,7 +25,7 @@ jobs:
           python3 .github/release/relstate.py > state.json
           cat state.json
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: relstate
           path: state.json