chore(deps): refresh all upstream action pins and tool defaults

.github/actions/setup-cosign/action.yml

@@ -3,10 +3,10 @@ description: Thin wrapper over sigstore/cosign-installer so the version is pinne
 
 inputs:
   cosign-version:
-    description: "cosign release (e.g. v3.1.1). Must be set: cosign-installer v4 rejects an empty release."
+    description: "cosign release (e.g. v3.1.3). Must be set: cosign-installer v4 rejects an empty release."
     required: false
     # renovate: datasource=github-releases depName=sigstore/cosign
-    default: "v3.1.1"
+    default: "v3.1.3"
 
 runs:
   using: composite

.github/actions/setup-go/action.yml

@@ -14,7 +14,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: ${{ inputs.go-version }}
         cache-dependency-path: ${{ inputs.working-directory }}/go.sum

.github/actions/setup-mise/action.yml

@@ -42,7 +42,7 @@ runs:
         fi
 
     - name: Cache mise tools
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.local/share/mise
         key: mise-${{ runner.os }}-${{ hashFiles('**/.mise.toml', '**/mise.toml', '**/.tool-versions') }}

.github/actions/setup-sops/action.yml

@@ -6,12 +6,12 @@ inputs:
     description: "sops version (e.g. v3.9.1)"
     required: false
     # renovate: datasource=github-releases depName=getsops/sops
-    default: "v3.13.1"
+    default: "v3.13.3"
   age-version:
     description: "age version (e.g. v1.2.0)"
     required: false
     # renovate: datasource=github-releases depName=FiloSottile/age
-    default: "v1.3.1"
+    default: "v1.3.2"
   age-key:
     description: "age private key (multi-line). Written to ~/.config/sops/age/keys.txt"
     required: false

.github/actions/setup-trivy/action.yml

@@ -6,7 +6,7 @@ inputs:
     description: "Trivy CLI version (without the 'v' prefix)"
     required: false
     # renovate: datasource=github-releases depName=aquasecurity/trivy
-    default: "0.71.0"
+    default: "0.74.0"
 
 runs:
   using: composite

.github/workflows/ansible.yml

@@ -52,7 +52,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Full path + floating major tag: a relative ./.github/actions path
       # inside a reusable resolves against the consumer's checkout, not this
@@ -67,7 +67,7 @@ jobs:
       # environments — no setup-python (which can't provision Python on newer
       # self-hosted runners), no global pip.
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 

.github/workflows/auto-revert-on-main-failure.yml

@@ -43,7 +43,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ inputs.default-branch }}

.github/workflows/bats.yml

@@ -52,7 +52,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install bats
         env:
@@ -91,7 +91,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install shellcheck
         run: |

.github/workflows/claude-code-review.yml

@@ -24,7 +24,7 @@
         type: boolean
         default: false
       plugin-marketplace:
         description: "Optional plugin marketplace. Empty by default — the code-review plugin is broken on current Claude Code (spawns a non-existent claude-haiku agent), so we use a direct review prompt instead."
         type: string
         default: ""
       plugins:
@@ -67,7 +67,7 @@
       issues: write
       id-token: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # claude-code-action self-validates that the workflow file
           # on the PR matches the version on the default branch
@@ -82,7 +82,7 @@
         # anthropics/claude-code-action#1205) must never block a PR. The
         # review posts its findings as comments; the job status is not a gate.
         continue-on-error: true
-        uses: anthropics/claude-code-action@0cb4f3e5e764d2e00407d29b6bf0aa9df0976d88 # v1.0.146
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1.0.210
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: ${{ inputs.plugin-marketplace }}
@@ -91,10 +91,10 @@
           # on Claude Code 2.1.x — it spawns a non-existent claude-haiku agent
           # and posts nothing). Single line so it survives format(); a caller
           # passing `prompt` overrides it.
           prompt: ${{ inputs.prompt != '' && inputs.prompt || format('Review pull request {0}#{1} for bugs, security issues, performance problems, and missing test coverage. Follow the repo''s CLAUDE.md conventions if present. Post each specific problem as an inline comment with the mcp__github_inline_comment__create_inline_comment tool, and leave one short top-level summary via `gh pr comment`. Only flag real issues; if there are none, say so briefly.', github.repository, github.event.pull_request.number) }}
           # Without an explicit --allowedTools the inline-comment MCP tool is
           # denied, so Claude runs but posts nothing ("No buffered inline
           # comments" + permission_denials). Default to Anthropic's documented
           # PR-review tool set (examples/pr-review-comprehensive.yml); a caller
           # passing claude-args overrides it entirely.
           claude_args: ${{ inputs.claude-args != '' && inputs.claude-args || '--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"' }}

.github/workflows/claude.yml

@@ -57,12 +57,12 @@ jobs:
       id-token: write
       actions: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
-        uses: anthropics/claude-code-action@0cb4f3e5e764d2e00407d29b6bf0aa9df0976d88 # v1.0.146
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1.0.210
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           additional_permissions: |

.github/workflows/compose-validate.yml

@@ -41,7 +41,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Export env vars
         if: inputs.env-vars != ''

.github/workflows/container-security.yml

@@ -75,7 +75,7 @@ jobs:
     outputs:
       images: ${{ steps.parse.outputs.images }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve image list
         id: parse
@@ -123,7 +123,7 @@ jobs:
       matrix:
         image: ${{ fromJson(needs.extract-images.outputs.images) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Trivy scan (table)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -153,7 +153,7 @@ jobs:
 
       - name: Upload SARIF
         if: always() && inputs.upload-sarif && github.event_name != 'pull_request'
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-${{ steps.safename.outputs.name }}.sarif
 

.github/workflows/dependabot-uv-lockfile.yml

@@ -48,14 +48,14 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Check out the PR branch (not the merge ref) so the push lands back
           # on it. fetch-depth 0 so the later push has the full ref.
           ref: ${{ github.head_ref }}
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: ${{ inputs.uv-version }}
 

.github/workflows/docker-build.yml

@@ -113,10 +113,10 @@ jobs:
       digest: ${{ steps.build.outputs.digest }}
       tags: ${{ steps.meta.outputs.tags }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       # Mint a scoped App token for private modules pulled during the build.
       # setup-token (not setup-deps-reader) because we only need the token as
@@ -135,15 +135,15 @@ jobs:
 
       - name: Login to ${{ inputs.registry }}
         if: inputs.push
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ inputs.registry }}
           username: ${{ secrets.registry-username || github.actor }}
           password: ${{ secrets.registry-password || secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ inputs.registry }}/${{ inputs.image-name }}
           tags: |
@@ -156,7 +156,7 @@ jobs:
 
       - name: Build & push
         id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
@@ -218,13 +218,13 @@ jobs:
 
       - name: Upload SARIF
         if: inputs.run-trivy-scan && inputs.push && github.event_name != 'pull_request'
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy.sarif
 
       - name: Generate SBOM
         if: inputs.generate-sbom && inputs.push
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ inputs.registry }}/${{ inputs.image-name }}@${{ steps.build.outputs.digest }}
           format: spdx-json

.github/workflows/elixir.yml

@@ -187,7 +187,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Private-deps access (opt-in). Full path + floating major tag: a relative
       # ./.github/actions path inside a reusable resolves against the consumer's
@@ -210,14 +210,14 @@ jobs:
         with:
           working-directory: ${{ inputs.working-directory }}
 
-      - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         if: ${{ !inputs.use-mise }}
         with:
           elixir-version: ${{ inputs.elixir-version }}
           otp-version: ${{ inputs.otp-version }}
 
       - name: Cache deps and _build
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ${{ inputs.working-directory }}/deps
@@ -381,7 +381,7 @@ jobs:
     env:
       MIX_ENV: ${{ inputs.mix-env }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure private-deps access
         if: inputs.deps-reader-client-id != ''
@@ -397,14 +397,14 @@ jobs:
         with:
           working-directory: ${{ inputs.working-directory }}
 
-      - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         if: ${{ !inputs.use-mise }}
         with:
           elixir-version: ${{ inputs.elixir-version }}
           otp-version: ${{ inputs.otp-version }}
 
       - name: Cache deps and _build
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ${{ inputs.working-directory }}/deps

.github/workflows/expo.yml

@@ -92,7 +92,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve toolchain
         id: tc
@@ -138,7 +138,7 @@ jobs:
 
       - name: Setup Node
         if: ${{ !inputs.use-mise && inputs.package-manager != 'bun' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
           cache: ${{ inputs.package-manager }}
@@ -149,7 +149,7 @@ jobs:
       # manager's download dir explicitly (keyed on whichever lockfile exists).
       - name: Cache package downloads (mise path)
         if: inputs.use-mise
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.tc.outputs.cache_path }}
           key: mise-${{ inputs.package-manager }}-${{ runner.os }}-${{ hashFiles('**/bun.lockb', '**/package-lock.json', '**/yarn.lock', '**/pnpm-lock.yaml') }}

.github/workflows/fastapi.yml

@@ -68,10 +68,10 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: ${{ inputs.working-directory }}/uv.lock

.github/workflows/go.yml

@@ -169,7 +169,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Private-deps access (opt-in). Referenced by full path + floating major
       # tag because a relative `./.github/actions/...` inside a reusable would
@@ -195,7 +195,7 @@ jobs:
 
       - name: Set up Go
         if: ${{ !inputs.use-mise }}
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version }}
           cache-dependency-path: ${{ inputs.working-directory }}/go.sum
@@ -204,7 +204,7 @@ jobs:
       # such action, so cache them explicitly (keyed on go.sum).
       - name: Cache Go modules (mise path)
         if: inputs.use-mise
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/go/pkg/mod

.github/workflows/lint-workflows.yml

@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install actionlint
         env:
@@ -62,7 +62,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Install yamllint via uv. actions/setup-python can't provision Python on
       # newer runners (e.g. Debian 13 self-hosted: "3.12 not found"); uv is

.github/workflows/molecule.yml

@@ -73,13 +73,13 @@ jobs:
       matrix:
         role: ${{ fromJson(needs.prepare-matrix.outputs.roles) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # uv provisions Python and runs molecule in an ephemeral uvx
       # environment — no setup-python (which can't provision Python on newer
       # self-hosted runners), no global pip.
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true