deps: update @actions/tool-cache to 2.0.2 and regenerate action bundle

[brianru]

Summary

Update @actions/tool-cache from 2.0.1 to the bounded patch target 2.0.2.

Modernization only; no @actions/tool-cache Critical/High advisory target. This PR also regenerates index.js, the checked-in Rollup bundle executed by the GitHub Action.

Evidence

• Remediation type: modernization.
• Dependency family: @actions/tool-cache.
• Diff scope: dependency-plus-source; the only source-class path is the generated dependency asset index.js.
• Compatibility gate: routine; src/index.js calls tool-cache.downloadTool with an explicit destination, so the upstream replacement of internally generated UUID paths with crypto.randomUUID() does not intersect the action's used path. @actions/core@1.11.1 was already resolved through the action's direct dependency.
• Source/test files changed: no handwritten source or tests. Generated asset changed: index.js, rebuilt from src/ with the repository release value VERSION=v1.24.0.
• Target repo: docker/scout-action.
• Target artifact: the Node 24 GitHub Action declared by action.yaml and executed from index.js.
• Attribution: repo-manifest.
• Dependency chain: action.yaml -> index.js -> src/index.js -> @actions/tool-cache.downloadTool.
• Minimality check: npm install @actions/tool-cache@^2.0.2 --package-lock-only --ignore-scripts --cache /tmp/deps-agent-test-lock; the repository npm configuration saves the direct target exactly as 2.0.2 and removes only its no-longer-needed transitive uuid package.
• Direct dependency movement: only @actions/tool-cache; uuid@3.4.0 is removed from the lockfile.
• Before baseline: npm audit --json --audit-level=high reported 0 Critical / 1 High (the High is transitive undici through the pre-existing direct @actions/core and @actions/github paths); 6 total findings.
• After baseline: 0 Critical / 1 High, unchanged; 5 total findings after the Moderate uuid finding is removed. The remaining High is outside this dependency family and npm audit reports no compatible automatic fix.
• Changelog: https://github.com/actions/toolkit/blob/1f7c2c79e034fe8a0d28006f52fc5b70f6dbb750/packages/tool-cache/RELEASES.md
• Commit comparison: actions/toolkit@500d0b4...1f7c2c7

Release-Age Gate

External target 2.0.2 was published 2025-01-15T21:08:59.747Z, well over 72 hours ago.

Usage Review

@actions/tool-cache@2.0.2 removes uuid in favor of native crypto.randomUUID() for internally generated download and extraction paths, and updates its @actions/core dependency to 1.11.1. I inspected src/index.js, where the action calls tc.downloadTool(asset.url, binary) with an explicit destination. The possible regression would be a failure to create or locate the downloaded Scout binary; that code path does not use the changed default temporary-path generation. No source or test change is needed.

Validation

• npm ci --ignore-scripts --cache /tmp/deps-agent-test-lock: passed for both the before and candidate locks.
• VERSION=v1.24.0 npm run build: passed; rerunning produced the same index.js SHA-256 2bb2d1270d66531f5436f37bf0d22a0a82523b129c98e45b9e6d82c35467a1ba.
• npm audit --json --audit-level=high: candidate remains 0 Critical / 1 High; the High is the existing transitive undici finding.
• git diff --check: passed.
• Local npm test and lint commands are not declared. The repository's GitHub-hosted Test workflow performs the action acceptance cases after a PR is opened.