chore(deps): consolidate 7 GitHub Actions version bumps

[jbdevprimary]

Summary

Consolidates 7 independently-mergeable Dependabot GitHub-Actions bumps into a single PR/CI run instead of 7 sequential rebase-merge cycles:

• chore(deps): bump astral-sh/setup-uv from 8.0.0 to 8.3.2 #28 astral-sh/setup-uv 8.0.0 → 8.3.2
• chore(deps): bump actions/checkout from 4 to 7 #26 actions/checkout 4 → 7
• chore(deps): bump SonarSource/sonarqube-scan-action from 7.1.0 to 8.2.0 #25 SonarSource/sonarqube-scan-action 7.1.0 → 8.2.0
• chore(deps): bump github/codeql-action from 3 to 4 #22 github/codeql-action 3 → 4
• chore(deps): bump googleapis/release-please-action from 4.4.0 to 5.0.0 #18 googleapis/release-please-action 4.4.0 → 5.0.0 (breaking change is Node 20→24 internally on the action side only, no user-facing config change)
• chore(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 #15 actions/upload-pages-artifact 4.0.0 → 5.0.0
• chore(deps): bump actions/deploy-pages from 4.0.5 to 5.0.0 #6 actions/deploy-pages 4.0.5 → 5.0.0

Each commit is cherry-picked verbatim from its original Dependabot PR (same author, same message), with 3 small merge conflicts resolved (all .github/workflows/cd.yml and .github/workflows/ci.yml — later bumps in this batch touched lines earlier bumps had already touched).

Not included: #7 (dependabot/fetch-metadata) and #5 (tj-actions/changed-files) — both bump actions inside .github/workflows/dependabot-automerge.yml and .github/workflows/autofix.yml respectively, neither of which exists on main yet (they're introduced by #16, still pending). Those two will be re-triaged once #16 lands.

Test plan

• actionlint .github/workflows/*.yml — clean
• make test — 9/9 bats tests pass
• CI green on this PR

Closing #28, #26, #25, #22, #18, #15, #6 once this merges, each pointing here.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Warning

Review limit reached

@jbdevprimary, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 23 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6fdb5bca-c958-42ca-b4e5-5f90aff0cf55

📥 Commits

Reviewing files that changed from the base of the PR and between 1a079e7 and 4a98460.

📒 Files selected for processing (5)

• .github/workflows/cd.yml
• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/release.yml
• install.bash

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/consolidate-actions-bumps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

Summary

This PR consolidates 7 GitHub Actions dependency updates into a single batch. The workflow files are well-structured, and the version bumps appear appropriate.

Critical Issues Requiring Fix

Security Vulnerabilities (3): The .github/workflows/codeql.yml file uses mutable tag references (@v7, @v4) instead of SHA-pinned commits. This creates a supply chain security risk, as tags can be moved to point to different (potentially malicious) commits. All other workflow files in this PR correctly use SHA-pinned references with version comments for traceability.

The three actions that need SHA pinning in codeql.yml:

• actions/checkout@v7 → should use SHA with # v7.0.0 comment
• github/codeql-action/init@v4 → should use SHA with # v4.0.0 comment
• github/codeql-action/analyze@v4 → should use SHA with # v4.0.0 comment

Once these security issues are addressed with SHA-pinned references matching the pattern used throughout the rest of the PR, this will be ready to merge.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jbdevprimary]

Superseded by #34 — #16 rewrote every workflow file, so this conflicted across all five. The two real bumps (checkout v7.0.0, sonarqube-scan v8.2.0) were reapplied on top of current main, with both SHAs verified against their upstream tags.