From a5ae08882f253caef7d9aa3c863688400a230cd5 Mon Sep 17 00:00:00 2001
From: Neil Galvin <neil@galv.in>
Date: Sun, 30 Aug 2026 14:34:07 +0100
Subject: [PATCH] chore(deps): refresh all upstream action pins and tool
 defaults

Audited every pinned upstream action by resolving its SHA against upstream
tags (the version comments were verified, not trusted). 15 of 23 were behind.

Notable majors: setup-uv v8.2.0 -> v10.0.1, checkout v6.0.3 -> v7.0.1,
cache v5.0.5 -> v6.1.0, setup-node/setup-go v6.4.0 -> v7.0.0.

The actions/* majors are ESM/dependency migrations with no input changes and
were already node24, so they need no newer runner agent than the old pins.

Two behaviour changes, both checked against usage here:

- checkout v7 refuses to check out a fork PR head under pull_request_target /
  workflow_run. No workflow here does that; consumers that do will need to
  stay on v6 or redesign.
- setup-uv v9 flips prune-cache to false; v10 disables caching under
  pull_request_target / workflow_run / release when enable-cache is auto.
  Every caching call site here sets enable-cache: true explicitly, so v10's
  default change is inert.

Also bumped the pinned tool-version input defaults (trivy, cosign, sops, age,
tofu); each download URL was preflighted against upstream release assets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdnSdFQLSYFwWnS8tXU5KQ
---
 .github/actions/setup-cosign/action.yml       |  4 +-
 .github/actions/setup-go/action.yml           |  2 +-
 .github/actions/setup-mise/action.yml         |  2 +-
 .github/actions/setup-sops/action.yml         |  4 +-
 .github/actions/setup-trivy/action.yml        |  2 +-
 .github/workflows/ansible.yml                 |  4 +-
 .../workflows/auto-revert-on-main-failure.yml |  2 +-
 .github/workflows/bats.yml                    |  4 +-
 .github/workflows/claude-code-review.yml      |  4 +-
 .github/workflows/claude.yml                  |  4 +-
 .github/workflows/compose-validate.yml        |  2 +-
 .github/workflows/container-security.yml      |  6 +-
 .github/workflows/dependabot-uv-lockfile.yml  |  4 +-
 .github/workflows/docker-build.yml            | 16 ++---
 .github/workflows/elixir.yml                  | 12 ++--
 .github/workflows/expo.yml                    |  6 +-
 .github/workflows/fastapi.yml                 |  4 +-
 .github/workflows/go.yml                      |  6 +-
 .github/workflows/lint-workflows.yml          |  4 +-
 .github/workflows/molecule.yml                |  4 +-
 .github/workflows/node-bun.yml                |  6 +-
 .github/workflows/opentofu.yml                |  6 +-
 .github/workflows/playwright-integration.yml  |  4 +-
 .github/workflows/python-uv.yml               |  4 +-
 .github/workflows/release.yml                 |  2 +-
 .github/workflows/scrapy.yml                  |  4 +-
 .github/workflows/secret-scan.yml             |  2 +-
 .github/workflows/self-test.yml               |  6 +-
 .github/workflows/sops-audit.yml              |  2 +-
 .github/workflows/toml-lint.yml               |  6 +-
 .github/workflows/trivy-repo.yml              |  6 +-
 .github/workflows/turbo.yml                   |  4 +-
 CHANGELOG.md                                  | 58 +++++++++++++++++++
 README.md                                     |  2 +-
 examples/README.md                            | 18 +++---
 35 files changed, 142 insertions(+), 84 deletions(-)

diff --git a/.github/actions/setup-cosign/action.yml b/.github/actions/setup-cosign/action.yml
index 4b5291e..8e9cbae 100644
--- a/.github/actions/setup-cosign/action.yml
+++ b/.github/actions/setup-cosign/action.yml
@@ -3,10 +3,10 @@ description: Thin wrapper over sigstore/cosign-installer so the version is pinne
 
 inputs:
   cosign-version:
-    description: "cosign release (e.g. v3.1.1). Must be set: cosign-installer v4 rejects an empty release."
+    description: "cosign release (e.g. v3.1.3). Must be set: cosign-installer v4 rejects an empty release."
     required: false
     # renovate: datasource=github-releases depName=sigstore/cosign
-    default: "v3.1.1"
+    default: "v3.1.3"
 
 runs:
   using: composite
diff --git a/.github/actions/setup-go/action.yml b/.github/actions/setup-go/action.yml
index 4cb536d..e79406e 100644
--- a/.github/actions/setup-go/action.yml
+++ b/.github/actions/setup-go/action.yml
@@ -14,7 +14,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: ${{ inputs.go-version }}
         cache-dependency-path: ${{ inputs.working-directory }}/go.sum
diff --git a/.github/actions/setup-mise/action.yml b/.github/actions/setup-mise/action.yml
index 506775c..d24cbfc 100644
--- a/.github/actions/setup-mise/action.yml
+++ b/.github/actions/setup-mise/action.yml
@@ -42,7 +42,7 @@ runs:
         fi
 
     - name: Cache mise tools
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.local/share/mise
         key: mise-${{ runner.os }}-${{ hashFiles('**/.mise.toml', '**/mise.toml', '**/.tool-versions') }}
diff --git a/.github/actions/setup-sops/action.yml b/.github/actions/setup-sops/action.yml
index 496a73a..6fe2319 100644
--- a/.github/actions/setup-sops/action.yml
+++ b/.github/actions/setup-sops/action.yml
@@ -6,12 +6,12 @@ inputs:
     description: "sops version (e.g. v3.9.1)"
     required: false
     # renovate: datasource=github-releases depName=getsops/sops
-    default: "v3.13.1"
+    default: "v3.13.3"
   age-version:
     description: "age version (e.g. v1.2.0)"
     required: false
     # renovate: datasource=github-releases depName=FiloSottile/age
-    default: "v1.3.1"
+    default: "v1.3.2"
   age-key:
     description: "age private key (multi-line). Written to ~/.config/sops/age/keys.txt"
     required: false
diff --git a/.github/actions/setup-trivy/action.yml b/.github/actions/setup-trivy/action.yml
index d8343a4..44a228b 100644
--- a/.github/actions/setup-trivy/action.yml
+++ b/.github/actions/setup-trivy/action.yml
@@ -6,7 +6,7 @@ inputs:
     description: "Trivy CLI version (without the 'v' prefix)"
     required: false
     # renovate: datasource=github-releases depName=aquasecurity/trivy
-    default: "0.71.0"
+    default: "0.74.0"
 
 runs:
   using: composite
diff --git a/.github/workflows/ansible.yml b/.github/workflows/ansible.yml
index abd2b3b..aed5319 100644
--- a/.github/workflows/ansible.yml
+++ b/.github/workflows/ansible.yml
@@ -52,7 +52,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Full path + floating major tag: a relative ./.github/actions path
       # inside a reusable resolves against the consumer's checkout, not this
@@ -67,7 +67,7 @@ jobs:
       # environments — no setup-python (which can't provision Python on newer
       # self-hosted runners), no global pip.
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
diff --git a/.github/workflows/auto-revert-on-main-failure.yml b/.github/workflows/auto-revert-on-main-failure.yml
index 52e3d42..c1708c6 100644
--- a/.github/workflows/auto-revert-on-main-failure.yml
+++ b/.github/workflows/auto-revert-on-main-failure.yml
@@ -43,7 +43,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ inputs.default-branch }}
diff --git a/.github/workflows/bats.yml b/.github/workflows/bats.yml
index a3ab96d..aa4460d 100644
--- a/.github/workflows/bats.yml
+++ b/.github/workflows/bats.yml
@@ -52,7 +52,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install bats
         env:
@@ -91,7 +91,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install shellcheck
         run: |
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index d4e950f..d24fa31 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -67,7 +67,7 @@ jobs:
       issues: write
       id-token: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # claude-code-action self-validates that the workflow file
           # on the PR matches the version on the default branch
@@ -82,7 +82,7 @@ jobs:
         # anthropics/claude-code-action#1205) must never block a PR. The
         # review posts its findings as comments; the job status is not a gate.
         continue-on-error: true
-        uses: anthropics/claude-code-action@0cb4f3e5e764d2e00407d29b6bf0aa9df0976d88 # v1.0.146
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1.0.210
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: ${{ inputs.plugin-marketplace }}
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index ec81898..de61b42 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -57,12 +57,12 @@ jobs:
       id-token: write
       actions: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
-        uses: anthropics/claude-code-action@0cb4f3e5e764d2e00407d29b6bf0aa9df0976d88 # v1.0.146
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1.0.210
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           additional_permissions: |
diff --git a/.github/workflows/compose-validate.yml b/.github/workflows/compose-validate.yml
index cc22639..9116a92 100644
--- a/.github/workflows/compose-validate.yml
+++ b/.github/workflows/compose-validate.yml
@@ -41,7 +41,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Export env vars
         if: inputs.env-vars != ''
diff --git a/.github/workflows/container-security.yml b/.github/workflows/container-security.yml
index c2abb7b..d5b185e 100644
--- a/.github/workflows/container-security.yml
+++ b/.github/workflows/container-security.yml
@@ -75,7 +75,7 @@ jobs:
     outputs:
       images: ${{ steps.parse.outputs.images }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve image list
         id: parse
@@ -123,7 +123,7 @@ jobs:
       matrix:
         image: ${{ fromJson(needs.extract-images.outputs.images) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Trivy scan (table)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -153,7 +153,7 @@ jobs:
 
       - name: Upload SARIF
         if: always() && inputs.upload-sarif && github.event_name != 'pull_request'
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-${{ steps.safename.outputs.name }}.sarif
 
diff --git a/.github/workflows/dependabot-uv-lockfile.yml b/.github/workflows/dependabot-uv-lockfile.yml
index 41359b5..9e65763 100644
--- a/.github/workflows/dependabot-uv-lockfile.yml
+++ b/.github/workflows/dependabot-uv-lockfile.yml
@@ -48,14 +48,14 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Check out the PR branch (not the merge ref) so the push lands back
           # on it. fetch-depth 0 so the later push has the full ref.
           ref: ${{ github.head_ref }}
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: ${{ inputs.uv-version }}
 
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 1e1b865..f4b9dc5 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -113,10 +113,10 @@ jobs:
       digest: ${{ steps.build.outputs.digest }}
       tags: ${{ steps.meta.outputs.tags }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       # Mint a scoped App token for private modules pulled during the build.
       # setup-token (not setup-deps-reader) because we only need the token as
@@ -135,7 +135,7 @@ jobs:
 
       - name: Login to ${{ inputs.registry }}
         if: inputs.push
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ inputs.registry }}
           username: ${{ secrets.registry-username || github.actor }}
@@ -143,7 +143,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ inputs.registry }}/${{ inputs.image-name }}
           tags: |
@@ -156,7 +156,7 @@ jobs:
 
       - name: Build & push
         id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
@@ -218,13 +218,13 @@ jobs:
 
       - name: Upload SARIF
         if: inputs.run-trivy-scan && inputs.push && github.event_name != 'pull_request'
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy.sarif
 
       - name: Generate SBOM
         if: inputs.generate-sbom && inputs.push
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ inputs.registry }}/${{ inputs.image-name }}@${{ steps.build.outputs.digest }}
           format: spdx-json
diff --git a/.github/workflows/elixir.yml b/.github/workflows/elixir.yml
index e3f9540..90153f6 100644
--- a/.github/workflows/elixir.yml
+++ b/.github/workflows/elixir.yml
@@ -187,7 +187,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Private-deps access (opt-in). Full path + floating major tag: a relative
       # ./.github/actions path inside a reusable resolves against the consumer's
@@ -210,14 +210,14 @@ jobs:
         with:
           working-directory: ${{ inputs.working-directory }}
 
-      - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         if: ${{ !inputs.use-mise }}
         with:
           elixir-version: ${{ inputs.elixir-version }}
           otp-version: ${{ inputs.otp-version }}
 
       - name: Cache deps and _build
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ${{ inputs.working-directory }}/deps
@@ -381,7 +381,7 @@ jobs:
     env:
       MIX_ENV: ${{ inputs.mix-env }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure private-deps access
         if: inputs.deps-reader-client-id != ''
@@ -397,14 +397,14 @@ jobs:
         with:
           working-directory: ${{ inputs.working-directory }}
 
-      - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         if: ${{ !inputs.use-mise }}
         with:
           elixir-version: ${{ inputs.elixir-version }}
           otp-version: ${{ inputs.otp-version }}
 
       - name: Cache deps and _build
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ${{ inputs.working-directory }}/deps
diff --git a/.github/workflows/expo.yml b/.github/workflows/expo.yml
index a91e2dd..3b891ef 100644
--- a/.github/workflows/expo.yml
+++ b/.github/workflows/expo.yml
@@ -92,7 +92,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve toolchain
         id: tc
@@ -138,7 +138,7 @@ jobs:
 
       - name: Setup Node
         if: ${{ !inputs.use-mise && inputs.package-manager != 'bun' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
           cache: ${{ inputs.package-manager }}
@@ -149,7 +149,7 @@ jobs:
       # manager's download dir explicitly (keyed on whichever lockfile exists).
       - name: Cache package downloads (mise path)
         if: inputs.use-mise
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.tc.outputs.cache_path }}
           key: mise-${{ inputs.package-manager }}-${{ runner.os }}-${{ hashFiles('**/bun.lockb', '**/package-lock.json', '**/yarn.lock', '**/pnpm-lock.yaml') }}
diff --git a/.github/workflows/fastapi.yml b/.github/workflows/fastapi.yml
index 2a85429..76081cd 100644
--- a/.github/workflows/fastapi.yml
+++ b/.github/workflows/fastapi.yml
@@ -68,10 +68,10 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: ${{ inputs.working-directory }}/uv.lock
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 1b9d467..0934ec0 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -169,7 +169,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Private-deps access (opt-in). Referenced by full path + floating major
       # tag because a relative `./.github/actions/...` inside a reusable would
@@ -195,7 +195,7 @@ jobs:
 
       - name: Set up Go
         if: ${{ !inputs.use-mise }}
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version }}
           cache-dependency-path: ${{ inputs.working-directory }}/go.sum
@@ -204,7 +204,7 @@ jobs:
       # such action, so cache them explicitly (keyed on go.sum).
       - name: Cache Go modules (mise path)
         if: inputs.use-mise
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/go/pkg/mod
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index 6377c1a..9226e11 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install actionlint
         env:
@@ -62,7 +62,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Install yamllint via uv. actions/setup-python can't provision Python on
       # newer runners (e.g. Debian 13 self-hosted: "3.12 not found"); uv is
diff --git a/.github/workflows/molecule.yml b/.github/workflows/molecule.yml
index 21c684b..793374c 100644
--- a/.github/workflows/molecule.yml
+++ b/.github/workflows/molecule.yml
@@ -73,13 +73,13 @@ jobs:
       matrix:
         role: ${{ fromJson(needs.prepare-matrix.outputs.roles) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # uv provisions Python and runs molecule in an ephemeral uvx
       # environment — no setup-python (which can't provision Python on newer
       # self-hosted runners), no global pip.
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
diff --git a/.github/workflows/node-bun.yml b/.github/workflows/node-bun.yml
index e66c829..995e3d7 100644
--- a/.github/workflows/node-bun.yml
+++ b/.github/workflows/node-bun.yml
@@ -86,7 +86,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve toolchain
         id: tc
@@ -134,7 +134,7 @@ jobs:
 
       - name: Setup Node
         if: ${{ !inputs.use-mise && inputs.package-manager != 'bun' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
           cache: ${{ inputs.package-manager }}
@@ -145,7 +145,7 @@ jobs:
       # manager's download dir explicitly (keyed on whichever lockfile exists).
       - name: Cache package downloads (mise path)
         if: inputs.use-mise
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.tc.outputs.cache_path }}
           key: mise-${{ inputs.package-manager }}-${{ runner.os }}-${{ hashFiles('**/bun.lockb', '**/package-lock.json', '**/yarn.lock', '**/pnpm-lock.yaml') }}
diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml
index df73e48..d806372 100644
--- a/.github/workflows/opentofu.yml
+++ b/.github/workflows/opentofu.yml
@@ -7,7 +7,7 @@ on:
         description: "OpenTofu version. Ignored when use-mise is true — the version then comes from the consumer's mise.toml."
         type: string
         # renovate: datasource=github-releases depName=opentofu/opentofu
-        default: "1.12.1"
+        default: "1.12.6"
       use-mise:
         description: |
           Install OpenTofu via mise (reads the consumer's mise.toml) instead
@@ -56,7 +56,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Full path + floating major tag: a relative ./.github/actions path
       # inside a reusable resolves against the consumer's checkout, not this
@@ -83,7 +83,7 @@ jobs:
           EOF
           fi
 
-      - uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2.0.1
+      - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
         if: ${{ !inputs.use-mise }}
         with:
           tofu_version: ${{ inputs.tofu-version }}
diff --git a/.github/workflows/playwright-integration.yml b/.github/workflows/playwright-integration.yml
index 02eec9a..cd32f87 100644
--- a/.github/workflows/playwright-integration.yml
+++ b/.github/workflows/playwright-integration.yml
@@ -75,10 +75,10 @@ jobs:
       contents: read
       packages: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node (registry auth)
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
           # registry-url + scope only take effect (write an auth'd .npmrc)
diff --git a/.github/workflows/python-uv.yml b/.github/workflows/python-uv.yml
index a6c3b50..f133ab1 100644
--- a/.github/workflows/python-uv.yml
+++ b/.github/workflows/python-uv.yml
@@ -94,7 +94,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Private-deps access (opt-in). Referenced by full path + floating major
       # tag because a relative `./.github/actions/...` inside a reusable would
@@ -110,7 +110,7 @@ jobs:
           repositories: ${{ inputs.deps-reader-repositories }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: ${{ inputs.uv-version }}
           enable-cache: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3f646b0..51134e4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/scrapy.yml b/.github/workflows/scrapy.yml
index 75e2271..03812bb 100644
--- a/.github/workflows/scrapy.yml
+++ b/.github/workflows/scrapy.yml
@@ -57,10 +57,10 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: ${{ inputs.working-directory }}/uv.lock
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 4ddfe6b..5442ae1 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -60,7 +60,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Full history is required for `betterleaks git` to traverse commits.
           fetch-depth: 0
diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml
index 4d6dccd..961d903 100644
--- a/.github/workflows/self-test.yml
+++ b/.github/workflows/self-test.yml
@@ -23,8 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - name: Validate composite action metadata
         run: |
           set -euo pipefail
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: setup-mise
         uses: ./.github/actions/setup-mise
diff --git a/.github/workflows/sops-audit.yml b/.github/workflows/sops-audit.yml
index 2a775c4..c05e028 100644
--- a/.github/workflows/sops-audit.yml
+++ b/.github/workflows/sops-audit.yml
@@ -47,7 +47,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # sops-config-changelog needs history to diff against base.
           fetch-depth: ${{ inputs.sops-config-changelog && 0 || 1 }}
diff --git a/.github/workflows/toml-lint.yml b/.github/workflows/toml-lint.yml
index 8f85821..3902c17 100644
--- a/.github/workflows/toml-lint.yml
+++ b/.github/workflows/toml-lint.yml
@@ -40,7 +40,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install taplo
         env:
@@ -63,12 +63,12 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # uv provisions the interpreter (setup-python can't on newer
       # self-hosted runners); tomllib is stdlib so nothing is pip-installed.
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Parse all TOML
         env:
diff --git a/.github/workflows/trivy-repo.yml b/.github/workflows/trivy-repo.yml
index 657ee45..6589739 100644
--- a/.github/workflows/trivy-repo.yml
+++ b/.github/workflows/trivy-repo.yml
@@ -98,7 +98,7 @@ jobs:
             *) echo "::error::invalid scan-type: $SCAN_TYPE (expected fs|config)"; exit 1 ;;
           esac
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Trivy scan (table)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -155,7 +155,7 @@ jobs:
             *) echo "::error::invalid scan-type: $SCAN_TYPE (expected fs|config)"; exit 1 ;;
           esac
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Trivy scan (SARIF)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -170,7 +170,7 @@ jobs:
           skip-files: ${{ inputs.skip-files }}
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-${{ inputs.scan-type }}.sarif
           # Distinguish fs vs config findings in the Security tab so they
diff --git a/.github/workflows/turbo.yml b/.github/workflows/turbo.yml
index a4e4553..a29d2e2 100644
--- a/.github/workflows/turbo.yml
+++ b/.github/workflows/turbo.yml
@@ -55,7 +55,7 @@ jobs:
     env:
       TURBO_TELEMETRY_DISABLED: 1
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: ${{ inputs.checkout-fetch-depth }}
 
@@ -72,7 +72,7 @@ jobs:
           bun-version-file: ${{ inputs.working-directory }}/package.json
 
       - name: Restore Turborepo cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.working-directory }}/.turbo
           # Suffix lets consumers segment caches per PR / per env without
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41cd7b8..a626a5a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,64 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags.
 
 ## [Unreleased]
 
+### Changed
+
+- Refreshed every pinned upstream action to its latest release. SHAs and the
+  trailing version comments both move; no input surface changes.
+
+  | Action | Was | Now |
+  | --- | --- | --- |
+  | `astral-sh/setup-uv` | v8.2.0 | v10.0.1 |
+  | `actions/checkout` | v6.0.3 | v7.0.1 |
+  | `actions/cache` | v5.0.5 | v6.1.0 |
+  | `actions/setup-node` | v6.4.0 | v7.0.0 |
+  | `actions/setup-go` | v6.4.0 | v7.0.0 |
+  | `github/codeql-action/upload-sarif` | v4.36.2 | v4.37.9 |
+  | `anthropics/claude-code-action` | v1.0.146 | v1.0.210 |
+  | `docker/login-action` | v4.2.0 | v4.6.0 |
+  | `docker/setup-buildx-action` | v4.1.0 | v4.3.0 |
+  | `docker/setup-qemu-action` | v4.1.0 | v4.2.0 |
+  | `docker/metadata-action` | v6.1.0 | v6.2.0 |
+  | `docker/build-push-action` | v7.2.0 | v7.3.0 |
+  | `erlef/setup-beam` | v1.24.0 | v1.24.1 |
+  | `anchore/sbom-action` | v0.24.0 | v0.24.2 |
+  | `opentofu/setup-opentofu` | v2.0.1 | v2.0.2 |
+
+  The `actions/*` majors are ESM/dependency migrations with no input changes;
+  all were already `node24`, so they need no newer runner agent than the
+  pinned versions did. `actions/checkout` v7 additionally refuses to check out
+  a fork PR head under `pull_request_target` / `workflow_run` — no workflow
+  here does that (the only `ref:` uses are `inputs.default-branch` and
+  `github.head_ref`), but consumers that check out a fork head from those
+  events will need `actions/checkout@v6` or a redesign.
+
+  `setup-uv` crosses two breaking releases: v9 flips `prune-cache` to `false`
+  (larger caches, evicted by GitHub's per-repo LRU — no billing impact), and
+  v10 disables caching under `pull_request_target` / `workflow_run` /
+  `release` when `enable-cache` is left at `auto`. Every caching call site
+  here sets `enable-cache: true` explicitly, so v10's default change is inert
+  for them.
+
+- Bumped the pinned tool-version input defaults to current releases; each
+  download URL was preflighted against the upstream release assets.
+
+  | Input | Was | Now |
+  | --- | --- | --- |
+  | `setup-trivy` `trivy-version` | 0.71.0 | 0.74.0 |
+  | `setup-cosign` `cosign-version` | v3.1.1 | v3.1.3 |
+  | `setup-sops` `sops-version` | v3.13.1 | v3.13.3 |
+  | `setup-sops` `age-version` | v1.3.1 | v1.3.2 |
+  | `opentofu.yml` `tofu-version` | 1.12.1 | 1.12.6 |
+
+  Already current: `taplo` 0.10.0, `betterleaks` 1.8.1, `actionlint` 1.7.12,
+  `trivy-action-version` 0.36.0.
+
+### Documentation
+
+- Example snippets in `README.md` / `examples/README.md` now show
+  `actions/checkout@v7`, `astral-sh/setup-uv@v10` and `actions/labeler@v7`
+  (the labeler config format is unchanged from v5).
+
 ## [3.0.1] - 2026-08-30
 
 ### Fixed
diff --git a/README.md b/README.md
index 3b12f25..d892de9 100644
--- a/README.md
+++ b/README.md
@@ -122,7 +122,7 @@ which default to the self-hosted pool.
 
 ```yaml
 steps:
-  - uses: actions/checkout@v6
+  - uses: actions/checkout@v7
   - uses: nkg/github-actions/.github/actions/setup-mise@v3
   - run: mise run build
 ```
diff --git a/examples/README.md b/examples/README.md
index 0ec2ebb..43abb28 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -762,7 +762,7 @@ jobs:
   label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v7
 ```
 
 `.github/labeler.yml` (the per-repo config the action consumes):
@@ -817,7 +817,7 @@ jobs:
       web: ${{ steps.f.outputs.web }}
       api: ${{ steps.f.outputs.api }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: f
         uses: dorny/paths-filter@v4
         with:
@@ -902,7 +902,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-sops@v3
         with:
           age-key: ${{ secrets.SOPS_AGE_KEY }}
@@ -920,13 +920,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-deps-reader@v3
         with:
           app-client-id: ${{ vars.DEPS_READER_CLIENT_ID }}
           app-private-key: ${{ secrets.DEPS_READER_PRIVATE_KEY }}
           repositories: sproncy-schemas,sproncy-secrets-core
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@v10
       - run: uv sync --frozen
 ```
 
@@ -937,7 +937,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-trivy@v3
       - run: trivy fs --severity HIGH,CRITICAL .
 
@@ -958,7 +958,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-mise@v3   # runs `mise install` from .mise.toml
       - run: mise run build
 ```
@@ -970,7 +970,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-go@v3
         with:
           go-version: "1.23"
@@ -994,7 +994,7 @@ jobs:
           app-client-id: ${{ vars.APP_CLIENT_ID }}
           app-private-key: ${{ secrets.APP_PRIVATE_KEY }}
           permission-contents: write          # omit all permission-* for the installation's full set
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           token: ${{ steps.token.outputs.token }}
       - run: git push