build(deps): bump the github-actions group across 1 directory with 5 updates

.github/workflows/audit.yml

@@ -31,11 +31,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
 
       # Prebuilt binary — no source compile, unlike `cargo install cargo-audit`.
       - name: Install cargo-audit
-        uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
+        uses: taiki-e/install-action@c44f6b046f1c29ae5918b1e0bfdbb2f1813836fd # v2
         with:
           tool: cargo-audit
 

.github/workflows/nightly-agents-smoke.yml

@@ -51,7 +51,7 @@ jobs:
         # (= this list's length), so edit only this list.
         shard: [0, 1, 2, 3, 4]
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -66,7 +66,7 @@ jobs:
       # runner's default `docker` driver reads the bake --load'ed bases.
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/nightly-oracle.yml

@@ -51,7 +51,7 @@ jobs:
         # strategy.job-total (= this list's length), so edit only this list.
         shard: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -66,7 +66,7 @@ jobs:
       # runner's default `docker` driver reads the bake --load'ed bases.
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/nightly-replay.yml

@@ -58,7 +58,7 @@ jobs:
         # list. Per shard: a one-time ~44s base bake + ~15 x ~34s replays.
         shard: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
 
       # No "free disk space" step: the runner reports ~108 GB free and the build
       # uses ~15-20 GB. The old `rm -rf` of dotnet/android/… cost ~1m43s for
@@ -78,7 +78,7 @@ jobs:
       # driver (what local dev uses) reads the `bake --load`ed bases.
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/oc-connectivity.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
 
       - name: Install oc CLI
         uses: redhat-actions/openshift-tools-installer@144527c7d98999f2652264c048c7a9bd103f8a82 # v1

.github/workflows/pre-commit.yml

@@ -19,22 +19,22 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0   # base history for the PR diff
 
       # cargo-fmt uses the runner's preinstalled rustfmt; fail fast if it's gone.
       - name: Verify rustfmt is available
         run: rustfmt --version
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.x'
 
       - run: pip install pre-commit
 
       - name: Cache pre-commit environments
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cache/pre-commit
           # pythonLocation is in the key because python-version '3.x' floats the
@@ -76,7 +76,7 @@ jobs:
       # serves it from disk. trivy still self-refreshes the bundle when it ages
       # out, so a static key is safe for config/misconfig checks.
       - name: Cache trivy checks DB
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cache/trivy
           key: trivy-${{ runner.os }}

.github/workflows/publish-crate.yml

@@ -21,7 +21,7 @@ jobs:
   publish-crate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
 
       # .agents/delivery/RULES.md:6 — the release aborts unless the git tag,
       # Cargo.toml, and Chart.yaml versions all agree.

.github/workflows/release-images.yml

@@ -93,7 +93,7 @@ jobs:
     if: github.ref_type == 'tag' || inputs.tag != ''
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - name: git tag matches Cargo.toml + Chart.yaml (RULES.md principle 9)
         run: |
           ver="${TAG#v}"
@@ -109,7 +109,7 @@ jobs:
   cli:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo build -p eval-containers --release --quiet
@@ -137,9 +137,9 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -179,7 +179,7 @@ jobs:
       combo_shards: ${{ steps.l.outputs.combo_shards }}   # [{idx,items:[{b,a,task,kind}]}] sharded ≤256
       pertask_shards: ${{ steps.l.outputs.pertask_shards }} # [{idx,items:[{b,task,kind}]}] sharded ≤256
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - id: l
         env:
           GH_TOKEN: ${{ github.token }}
@@ -306,9 +306,9 @@ jobs:
           - arch: arm64
             runner: ${{ vars.FLEET_RUNNER_ARM || 'ubuntu-24.04-arm' }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -378,11 +378,11 @@ jobs:
           - arch: arm64
             runner: ${{ vars.FLEET_RUNNER_ARM || 'ubuntu-24.04-arm' }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - uses: docker/setup-buildx-action@v4   # kind=bake (swe-bench)
       - name: Ensure podman                    # kind=script (build.sh)
         run: command -v podman >/dev/null || { sudo apt-get update && sudo apt-get install -y podman; }
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -464,9 +464,9 @@ jobs:
       LEAVES: ${{ needs.enumerate.outputs.leaves }}
       PERTASK_SHARDS: ${{ needs.enumerate.outputs.pertask_shards }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -523,8 +523,8 @@ jobs:
       matrix:
         benchmark: ${{ fromJson(needs.enumerate.outputs.benchmarks) }}
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: docker/login-action@v4
+      - uses: actions/checkout@v7.0.1
+      - uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -564,10 +564,10 @@ jobs:
       matrix:
         shard: ${{ fromJson(needs.enumerate.outputs.combo_shards) }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - uses: docker/setup-qemu-action@v4   # combos build arm64 via --platform (QEMU) on this amd64 runner
       - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -634,9 +634,9 @@ jobs:
     if: always() && needs.merge.result == 'success' && !inputs.dry_run && (github.ref_type == 'tag' || inputs.tag != '' || inputs.rebuild_bases)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -671,7 +671,7 @@ jobs:
     if: github.ref_type == 'tag' || inputs.tag != ''
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - uses: azure/setup-helm@v5
       - name: Publish charts/eval at the tag
         run: |
@@ -688,7 +688,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/release.yml

@@ -55,7 +55,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -115,7 +115,7 @@ jobs:
       - name: enable windows longpaths
         run: |
           git config --global core.longpaths true
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -174,7 +174,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -224,7 +224,7 @@ jobs:
     outputs:
       val: ${{ steps.host.outputs.manifest }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -304,7 +304,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive

.github/workflows/test.yml

@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -108,7 +108,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
 
       - name: Install helm
         uses: azure/setup-helm@v5
@@ -155,7 +155,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -166,7 +166,7 @@ jobs:
           shared-key: replay
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}