From bedd3221a659daa3a237ccd8382e196131a742e1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 06:35:43 +0000
Subject: [PATCH 1/2] chore(deps): bump the github-actions group with 11
 updates

Bumps the github-actions group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
| [actions/setup-go](https://github.com/actions/setup-go) | `6.5.0` | `7.0.0` |
| [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) | `24.0.0` | `24.1.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5.4.0` | `6.0.0` |
| [actions/labeler](https://github.com/actions/labeler) | `6.2.0` | `7.0.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` |
| [actions/attest](https://github.com/actions/attest) | `4.1.1` | `4.2.0` |


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

Updates `actions/setup-python` from 6.3.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97)

Updates `actions/setup-go` from 6.5.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e)

Updates `DavidAnson/markdownlint-cli2-action` from 24.0.0 to 24.1.0
- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)
- [Commits](https://github.com/davidanson/markdownlint-cli2-action/compare/8de2aa07cae85fd17c0b35642db70cf5495f1d25...6bf21b07787794f89a243495939cd651942aeabe)

Updates `actions/setup-dotnet` from 5.4.0 to 6.0.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](https://github.com/actions/setup-dotnet/compare/26b0ec14cb23fa6904739307f278c14f94c95bf1...a98b56852c35b8e3190ac28c8c2271da59106c68)

Updates `actions/labeler` from 6.2.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d...bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13)

Updates `github/codeql-action/init` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/autobuild` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `actions/attest` from 4.1.1 to 4.2.0
- [Release notes](https://github.com/actions/attest/releases)
- [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: DavidAnson/markdownlint-cli2-action
  dependency-version: 24.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-dotnet
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/labeler
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/attest
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/actionlint.yml                |  2 +-
 .github/workflows/benchmark-compare.yml         |  6 +++---
 .github/workflows/benchmark.yml                 |  6 +++---
 .github/workflows/ci.yml                        |  4 ++--
 .github/workflows/container-ci.yml              |  2 +-
 .github/workflows/coverage-gate.yml             |  2 +-
 .github/workflows/cpp-ci.yml                    |  2 +-
 .github/workflows/cross-platform-smoke.yml      |  4 ++--
 .github/workflows/dart-flutter-ci.yml           |  2 +-
 .github/workflows/docs-ci.yml                   |  2 +-
 .github/workflows/docs-quality.yml              |  4 ++--
 .github/workflows/dotnet-ci.yml                 |  4 ++--
 .github/workflows/fuzzing.yml                   |  2 +-
 .github/workflows/go-ci.yml                     |  4 ++--
 .github/workflows/grype-scan.yml                |  2 +-
 .github/workflows/hadolint-ci.yml               |  2 +-
 .github/workflows/iac-scan.yml                  |  2 +-
 .github/workflows/java-ci.yml                   |  2 +-
 .github/workflows/kotlin-android-ci.yml         |  2 +-
 .github/workflows/monorepo-changed-paths.yml    |  2 +-
 .github/workflows/mutation-testing.yml          |  4 ++--
 .github/workflows/node-ci.yml                   |  2 +-
 .github/workflows/osv-scan.yml                  |  2 +-
 .github/workflows/pr-hygiene.yml                |  4 ++--
 .github/workflows/private-static.yml            |  4 ++--
 .github/workflows/public-codeql.yml             | 12 ++++++------
 .github/workflows/public-dependency-review.yml  |  2 +-
 .github/workflows/public-scorecard-json.yml     |  2 +-
 .github/workflows/public-scorecard.yml          |  4 ++--
 .github/workflows/python-ci.yml                 |  2 +-
 .github/workflows/qt-ci.yml                     |  2 +-
 .github/workflows/r-ci.yml                      |  2 +-
 .github/workflows/release-supply-chain-free.yml |  2 +-
 .github/workflows/release-supply-chain.yml      |  4 ++--
 .github/workflows/release.yml                   |  2 +-
 .github/workflows/rust-ci.yml                   |  2 +-
 .github/workflows/secret-scan.yml               |  2 +-
 .github/workflows/semgrep-ci.yml                |  2 +-
 .github/workflows/sql-ci.yml                    |  2 +-
 .github/workflows/swift-ci.yml                  |  2 +-
 .github/workflows/terraform-ci.yml              |  2 +-
 .github/workflows/web-ci.yml                    |  2 +-
 .github/workflows/zizmor-no-sarif.yml           |  2 +-
 .github/workflows/zizmor-sarif.yml              |  4 ++--
 44 files changed, 64 insertions(+), 64 deletions(-)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 85b3d55..1bc6cb5 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -66,7 +66,7 @@ jobs:
           PY
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/benchmark-compare.yml b/.github/workflows/benchmark-compare.yml
index 11da5a3..820cca7 100644
--- a/.github/workflows/benchmark-compare.yml
+++ b/.github/workflows/benchmark-compare.yml
@@ -72,13 +72,13 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
         if: ${{ inputs.language == 'python' }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ inputs.python_version }}
 
@@ -96,7 +96,7 @@ jobs:
 
       - name: Set up Go
         if: ${{ inputs.language == 'go' }}
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: ${{ inputs.go_version }}
 
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 8571ab0..bddfc10 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -73,13 +73,13 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
         if: ${{ inputs.language == 'python' }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ inputs.python_version }}
 
@@ -97,7 +97,7 @@ jobs:
 
       - name: Set up Go
         if: ${{ inputs.language == 'go' }}
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: ${{ inputs.go_version }}
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de98b6b..23a2dff 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,11 +45,11 @@ jobs:
             pypi.org:443
             files.pythonhosted.org:443
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
       - name: Set up uv
diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml
index 534b4f7..6236511 100644
--- a/.github/workflows/container-ci.yml
+++ b/.github/workflows/container-ci.yml
@@ -44,7 +44,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/coverage-gate.yml b/.github/workflows/coverage-gate.yml
index 0b6878a..0ac4393 100644
--- a/.github/workflows/coverage-gate.yml
+++ b/.github/workflows/coverage-gate.yml
@@ -63,7 +63,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/cpp-ci.yml b/.github/workflows/cpp-ci.yml
index 416fc86..c26a113 100644
--- a/.github/workflows/cpp-ci.yml
+++ b/.github/workflows/cpp-ci.yml
@@ -74,7 +74,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/cross-platform-smoke.yml b/.github/workflows/cross-platform-smoke.yml
index f8acb78..87d6754 100644
--- a/.github/workflows/cross-platform-smoke.yml
+++ b/.github/workflows/cross-platform-smoke.yml
@@ -63,7 +63,7 @@ jobs:
         os: ${{ fromJSON(inputs.os_list) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ inputs.checkout_ref }}
           fetch-depth: ${{ inputs.fetch_depth }}
@@ -72,7 +72,7 @@ jobs:
 
       - name: Set up Python
         if: ${{ inputs.setup_python }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ inputs.python_version }}
 
diff --git a/.github/workflows/dart-flutter-ci.yml b/.github/workflows/dart-flutter-ci.yml
index 6b4c76c..99197d7 100644
--- a/.github/workflows/dart-flutter-ci.yml
+++ b/.github/workflows/dart-flutter-ci.yml
@@ -59,7 +59,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/docs-ci.yml b/.github/workflows/docs-ci.yml
index ba62137..6bf99b9 100644
--- a/.github/workflows/docs-ci.yml
+++ b/.github/workflows/docs-ci.yml
@@ -30,7 +30,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml
index 6e38754..51d81e1 100644
--- a/.github/workflows/docs-quality.yml
+++ b/.github/workflows/docs-quality.yml
@@ -47,7 +47,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -68,6 +68,6 @@ jobs:
 
       - name: Markdown lint
         if: ${{ inputs.markdownlint }}
-        uses: DavidAnson/markdownlint-cli2-action@8de2aa07cae85fd17c0b35642db70cf5495f1d25  # v24.0.0
+        uses: DavidAnson/markdownlint-cli2-action@6bf21b07787794f89a243495939cd651942aeabe  # v24.1.0
         with:
           globs: ${{ inputs.markdownlint_globs }}
diff --git a/.github/workflows/dotnet-ci.yml b/.github/workflows/dotnet-ci.yml
index 924ed2d..4f0e3d9 100644
--- a/.github/workflows/dotnet-ci.yml
+++ b/.github/workflows/dotnet-ci.yml
@@ -46,12 +46,12 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68  # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet_version }}
 
diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml
index 9c566c3..f4b40a5 100644
--- a/.github/workflows/fuzzing.yml
+++ b/.github/workflows/fuzzing.yml
@@ -46,7 +46,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index dc3c271..1b89925 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -49,13 +49,13 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: ${{ inputs.fetch_depth }}
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: ${{ inputs.go_version }}
 
diff --git a/.github/workflows/grype-scan.yml b/.github/workflows/grype-scan.yml
index 3f42a5d..de8382d 100644
--- a/.github/workflows/grype-scan.yml
+++ b/.github/workflows/grype-scan.yml
@@ -39,7 +39,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/hadolint-ci.yml b/.github/workflows/hadolint-ci.yml
index f416caf..f8dc7ee 100644
--- a/.github/workflows/hadolint-ci.yml
+++ b/.github/workflows/hadolint-ci.yml
@@ -38,7 +38,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/iac-scan.yml b/.github/workflows/iac-scan.yml
index 99c20ad..60fca33 100644
--- a/.github/workflows/iac-scan.yml
+++ b/.github/workflows/iac-scan.yml
@@ -43,7 +43,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index 0c1d01d..afe54de 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -48,7 +48,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/kotlin-android-ci.yml b/.github/workflows/kotlin-android-ci.yml
index 4f4e6c7..7de6a9a 100644
--- a/.github/workflows/kotlin-android-ci.yml
+++ b/.github/workflows/kotlin-android-ci.yml
@@ -57,7 +57,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/monorepo-changed-paths.yml b/.github/workflows/monorepo-changed-paths.yml
index 337591d..4261745 100644
--- a/.github/workflows/monorepo-changed-paths.yml
+++ b/.github/workflows/monorepo-changed-paths.yml
@@ -61,7 +61,7 @@ jobs:
       result: ${{ steps.detect.outputs.result }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/mutation-testing.yml b/.github/workflows/mutation-testing.yml
index 433ab0d..f88038a 100644
--- a/.github/workflows/mutation-testing.yml
+++ b/.github/workflows/mutation-testing.yml
@@ -56,13 +56,13 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
         if: ${{ inputs.language == 'python' }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ inputs.python_version }}
 
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index c29077d..9c83062 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -47,7 +47,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/osv-scan.yml b/.github/workflows/osv-scan.yml
index bec912c..01e15d0 100644
--- a/.github/workflows/osv-scan.yml
+++ b/.github/workflows/osv-scan.yml
@@ -46,7 +46,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pr-hygiene.yml b/.github/workflows/pr-hygiene.yml
index 2c96245..bffed21 100644
--- a/.github/workflows/pr-hygiene.yml
+++ b/.github/workflows/pr-hygiene.yml
@@ -49,7 +49,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -81,7 +81,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Label pull request
-        uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d  # v6.2.0
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13  # v7.0.0
         with:
           configuration-path: ${{ inputs.labeler_config }}
 
diff --git a/.github/workflows/private-static.yml b/.github/workflows/private-static.yml
index e06236d..d61a6be 100644
--- a/.github/workflows/private-static.yml
+++ b/.github/workflows/private-static.yml
@@ -51,7 +51,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ inputs.checkout_ref }}
           fetch-depth: ${{ inputs.fetch_depth }}
@@ -60,7 +60,7 @@ jobs:
 
       - name: Set up Python
         if: ${{ inputs.setup_python }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ inputs.python_version }}
 
diff --git a/.github/workflows/public-codeql.yml b/.github/workflows/public-codeql.yml
index 171b66d..7867981 100644
--- a/.github/workflows/public-codeql.yml
+++ b/.github/workflows/public-codeql.yml
@@ -72,37 +72,37 @@ jobs:
           egress-policy: ${{ inputs.egress_policy }}
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
         if: ${{ inputs.config_file == '' }}
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a  # v4.37.1
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
 
       - name: Initialize CodeQL with config
         if: ${{ inputs.config_file != '' }}
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a  # v4.37.1
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ inputs.config_file }}
 
       - name: Autobuild
         if: ${{ inputs.autobuild }}
-        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a  # v4.37.1
 
       - name: Analyze
         if: ${{ inputs.output_directory == '' }}
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a  # v4.37.1
         with:
           category: "/language:${{ matrix.language }}"
 
       - name: Analyze with output directory
         if: ${{ inputs.output_directory != '' }}
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a  # v4.37.1
         with:
           category: "/language:${{ matrix.language }}"
           output: ${{ inputs.output_directory }}
diff --git a/.github/workflows/public-dependency-review.yml b/.github/workflows/public-dependency-review.yml
index b3554e2..beed222 100644
--- a/.github/workflows/public-dependency-review.yml
+++ b/.github/workflows/public-dependency-review.yml
@@ -41,7 +41,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/public-scorecard-json.yml b/.github/workflows/public-scorecard-json.yml
index 879a1f2..b65708f 100644
--- a/.github/workflows/public-scorecard-json.yml
+++ b/.github/workflows/public-scorecard-json.yml
@@ -44,7 +44,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/public-scorecard.yml b/.github/workflows/public-scorecard.yml
index f2fe4a1..ff041cc 100644
--- a/.github/workflows/public-scorecard.yml
+++ b/.github/workflows/public-scorecard.yml
@@ -34,7 +34,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -53,6 +53,6 @@ jobs:
           retention-days: 5
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a  # v4.37.1
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index cb728e0..06faa58 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -50,7 +50,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/qt-ci.yml b/.github/workflows/qt-ci.yml
index 33dca5b..d44ec7e 100644
--- a/.github/workflows/qt-ci.yml
+++ b/.github/workflows/qt-ci.yml
@@ -73,7 +73,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/r-ci.yml b/.github/workflows/r-ci.yml
index 53cb866..9acfc4a 100644
--- a/.github/workflows/r-ci.yml
+++ b/.github/workflows/r-ci.yml
@@ -53,7 +53,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release-supply-chain-free.yml b/.github/workflows/release-supply-chain-free.yml
index 96cced1..aad82db 100644
--- a/.github/workflows/release-supply-chain-free.yml
+++ b/.github/workflows/release-supply-chain-free.yml
@@ -106,7 +106,7 @@ jobs:
           PY
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           ref: refs/tags/${{ inputs.version }}
diff --git a/.github/workflows/release-supply-chain.yml b/.github/workflows/release-supply-chain.yml
index 6bb5bf0..ddc3de7 100644
--- a/.github/workflows/release-supply-chain.yml
+++ b/.github/workflows/release-supply-chain.yml
@@ -113,7 +113,7 @@ jobs:
           PY
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           ref: refs/tags/${{ inputs.version }}
@@ -855,7 +855,7 @@ jobs:
       - name: Attest SBOM (archive)
         # actions/attest native SBOM mode (sbom-path) replaces the deprecated
         # actions/attest-sbom; the SPDX predicate type is unchanged.
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6  # v4.2.0
         with:
           subject-path: ${{ runner.temp }}/release-dist/${{ inputs.package_name }}-${{ inputs.version }}.tar.gz
           sbom-path: ${{ runner.temp }}/release-dist/sbom.spdx.json
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 20e40f2..134adfe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
             github.com:443
             api.github.com:443
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Resolve and validate version
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 33c2aea..9d47033 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -49,7 +49,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 4cb5e95..65b2623 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -51,7 +51,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout full history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/semgrep-ci.yml b/.github/workflows/semgrep-ci.yml
index 946528e..d62aebe 100644
--- a/.github/workflows/semgrep-ci.yml
+++ b/.github/workflows/semgrep-ci.yml
@@ -46,7 +46,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/sql-ci.yml b/.github/workflows/sql-ci.yml
index 901817e..274967e 100644
--- a/.github/workflows/sql-ci.yml
+++ b/.github/workflows/sql-ci.yml
@@ -54,7 +54,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/swift-ci.yml b/.github/workflows/swift-ci.yml
index 02c2f4a..414c672 100644
--- a/.github/workflows/swift-ci.yml
+++ b/.github/workflows/swift-ci.yml
@@ -57,7 +57,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/terraform-ci.yml b/.github/workflows/terraform-ci.yml
index cdaf468..2524db1 100644
--- a/.github/workflows/terraform-ci.yml
+++ b/.github/workflows/terraform-ci.yml
@@ -38,7 +38,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/web-ci.yml b/.github/workflows/web-ci.yml
index 733e32f..0cbc009 100644
--- a/.github/workflows/web-ci.yml
+++ b/.github/workflows/web-ci.yml
@@ -52,7 +52,7 @@ jobs:
         working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/zizmor-no-sarif.yml b/.github/workflows/zizmor-no-sarif.yml
index 07a5b86..3a8cf78 100644
--- a/.github/workflows/zizmor-no-sarif.yml
+++ b/.github/workflows/zizmor-no-sarif.yml
@@ -42,7 +42,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/zizmor-sarif.yml b/.github/workflows/zizmor-sarif.yml
index 9b96fd3..9a5cf6b 100644
--- a/.github/workflows/zizmor-sarif.yml
+++ b/.github/workflows/zizmor-sarif.yml
@@ -49,7 +49,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -76,7 +76,7 @@ jobs:
             "${ZIZMOR_TARGET}" > zizmor.sarif
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a  # v4.37.1
         with:
           sarif_file: zizmor.sarif
           category: zizmor

From 279a1510858d93eaf5ab683facedb62308d9e776 Mon Sep 17 00:00:00 2001
From: Danil Silantyev <danilsilantyevwork@gmail.com>
Date: Mon, 27 Jul 2026 12:54:36 +0500
Subject: [PATCH 2/2] fix(catalog): sync the grouped action bump into the
 catalog and ledger

Dependabot updates `uses:` pins inside the workflows but knows nothing about
catalog/tools.yml or catalog/runtime-coverage.yml, so PR #47 could not go green
on its own.

Catalog pins and current_version synced for attest, checkout, setup-python,
setup-go, setup-dotnet, labeler, and markdownlint-cli2-action.

actionlint.yml is re-proven honestly: this repository's ci.yml calls it through
a relative ref, so run 30243258297 executed exactly these bytes.

release-supply-chain.yml is downgraded to static-only. Nothing in this
repository's CI calls it, so no run has executed the new bytes; the ledger's own
instruction for that case is to downgrade rather than carry a stale proof, and
scripts/check_release_supply_chain.py satisfies the static-only requirement. The
next real release re-proves it.

Signed-off-by: Danil Silantyev <danilsilantyevwork@gmail.com>
---
 CHANGELOG.md                 | 14 ++++++++++++++
 catalog/runtime-coverage.yml | 15 +++++++++------
 catalog/tools.yml            | 28 ++++++++++++++--------------
 3 files changed, 37 insertions(+), 20 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6521ddc..0d2d08b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,20 @@
 
 ### Fixed
 
+- **A grouped action bump could not land on its own.** Dependabot updates the
+  `uses:` pins inside the workflows but knows nothing about `catalog/tools.yml`,
+  so `validate_catalog.py` failed on seven tools whose catalog pin no longer
+  matched the workflow that used it, and `validate_runtime_coverage.py` failed
+  because two workflow files changed after the run that proved them. Catalog
+  pins and `current_version` synced for `attest`, `checkout`, `setup-python`,
+  `setup-go`, `setup-dotnet`, `labeler`, and `markdownlint-cli2-action`.
+  `actionlint.yml` is re-proven against the CI run that executed the new bytes —
+  this repository's own `ci.yml` calls it through a relative ref, so the proof is
+  real. `release-supply-chain.yml` is downgraded to `static-only`: nothing in
+  this repository's CI calls it, so no run has executed the new bytes, and the
+  ledger's rule is to downgrade rather than carry a stale proof. The next real
+  release re-proves it.
+
 - **The catalog recorded four action pins that no workflow used.** `setup-node`,
   `setup-java`, `setup-swift`, and `checkov-action` had drifted a version behind
   the SHA their `used_by` workflows actually reference — `setup-swift` by a full
diff --git a/catalog/runtime-coverage.yml b/catalog/runtime-coverage.yml
index 0797e15..cca00cd 100644
--- a/catalog/runtime-coverage.yml
+++ b/catalog/runtime-coverage.yml
@@ -15,8 +15,8 @@ entries:
   - workflow: .github/workflows/actionlint.yml
     status: runtime-proven
     evidence: "Called by this repo's ci.yml on every run; Linux X64 default-input lane executed live."
-    last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/29172553315
-    proven_digest: bbd3d7d2b010deb0e44ea47b655de77cac5fc3ad21869d7babe21547128139fd
+    last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/30243258297
+    proven_digest: 116c4af8c18861a7c94000e277c3a4e9f1d158bcfbda02a7e6510dfc9d9cf8ff
     waiver: null
   - workflow: .github/workflows/benchmark-compare.yml
     status: static-only
@@ -178,10 +178,13 @@ entries:
     last_run: null
     waiver: null
   - workflow: .github/workflows/release-supply-chain.yml
-    status: runtime-proven
-    evidence: "Dogfooded by this repo's release.yml on the 0.9.0 tag (e27d4e3); archive/SBOM/attest/publish lanes executed live and both attestations verify. The optional runtime_paths ⊆ archive_paths bundle path is covered by check_release_supply_chain.py fixtures."
-    last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/29173277373
-    proven_digest: 693e911833b3c20ddf53cba60a4215d2b56a15a473f6d65691592a10a0995e38
+    status: static-only
+    validator: scripts/check_release_supply_chain.py
+    evidence: 'Executable contract validator exercises the embedded program(s). The
+      runtime proof lapsed when actions/attest and actions/checkout were bumped: this
+      repository CI never calls this workflow, so nothing has run the new bytes. The
+      next real release re-proves it.'
+    last_run: null
     waiver: null
   - workflow: .github/workflows/rust-ci.yml
     status: unverified
diff --git a/catalog/tools.yml b/catalog/tools.yml
index e9a4e7f..77f0ae4 100644
--- a/catalog/tools.yml
+++ b/catalog/tools.yml
@@ -109,8 +109,8 @@ tools:
     name: actions/attest
     homepage: "https://github.com/actions/attest"
     kind: action
-    current_version: "v4.1.1"
-    pin: "actions/attest@a1948c3f048ba23858d222213b7c278aabede763"
+    current_version: "v4.2.0"
+    pin: "actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6"
     used_by:
       - .github/workflows/release-supply-chain.yml
     last_verified: "2026-07-08"
@@ -129,8 +129,8 @@ tools:
     name: actions/checkout
     homepage: "https://github.com/actions/checkout"
     kind: action
-    current_version: "v7.0.0"
-    pin: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"
+    current_version: "v7.0.1"
+    pin: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"
     used_by:
       - .github/workflows/public-codeql.yml
       - .github/workflows/public-dependency-review.yml
@@ -147,8 +147,8 @@ tools:
     name: actions/setup-python
     homepage: "https://github.com/actions/setup-python"
     kind: action
-    current_version: "v6.3.0"
-    pin: "actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1"
+    current_version: "v7.0.0"
+    pin: "actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97"
     used_by:
       - .github/workflows/ci.yml
       - .github/workflows/cross-platform-smoke.yml
@@ -280,8 +280,8 @@ tools:
     name: DavidAnson/markdownlint-cli2-action
     homepage: "https://github.com/DavidAnson/markdownlint-cli2-action"
     kind: action
-    current_version: "v24.0.0"
-    pin: "DavidAnson/markdownlint-cli2-action@8de2aa07cae85fd17c0b35642db70cf5495f1d25"
+    current_version: "v24.1.0"
+    pin: "DavidAnson/markdownlint-cli2-action@6bf21b07787794f89a243495939cd651942aeabe"
     used_by:
       - .github/workflows/docs-quality.yml
     last_verified: "2026-07-08"
@@ -310,8 +310,8 @@ tools:
     name: actions/labeler
     homepage: "https://github.com/actions/labeler"
     kind: action
-    current_version: "v6.2.0"
-    pin: "actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d"
+    current_version: "v7.0.0"
+    pin: "actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13"
     used_by:
       - .github/workflows/pr-hygiene.yml
     last_verified: "2026-07-12"
@@ -429,8 +429,8 @@ tools:
     name: actions/setup-go
     homepage: "https://github.com/actions/setup-go"
     kind: action
-    current_version: "v6.5.0"
-    pin: "actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16"
+    current_version: "v7.0.0"
+    pin: "actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e"
     used_by:
       - .github/workflows/benchmark.yml
       - .github/workflows/benchmark-compare.yml
@@ -455,8 +455,8 @@ tools:
     name: actions/setup-dotnet
     homepage: "https://github.com/actions/setup-dotnet"
     kind: action
-    current_version: "v5.4.0"
-    pin: "actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1"
+    current_version: "v6.0.0"
+    pin: "actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68"
     used_by:
       - .github/workflows/dotnet-ci.yml
     last_verified: "2026-07-12"