ci(deps): bump the actions group across 1 directory with 7 updates

.github/workflows/ci.yml

@@ -47,10 +47,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node.js with npm cache
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           # Pin to 24.15.x — Node 24.16.0 has a zip-extraction regression
           # (nodejs/node#63487) that hangs `playwright install` for Playwright
@@ -204,7 +204,7 @@ jobs:
 
       - name: Set up Node.js
         if: steps.pr_context.outputs.is_fork != 'true' && steps.latest_commit.outputs.pr_artifact_only != 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           # Pin to 24.15.x — Node 24.16.0 has a zip-extraction regression
           # (nodejs/node#63487) that hangs `playwright install` for Playwright
@@ -247,7 +247,7 @@ jobs:
       - name: Cache Playwright browsers
         if: steps.live_credential.outputs.has_key == 'true' && steps.pr_context.outputs.is_fork != 'true' && steps.latest_commit.outputs.pr_artifact_only != 'true'
         id: pw_cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ steps.pw_version.outputs.version }}

.github/workflows/desktop-macos.yml

@@ -41,10 +41,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node.js with npm cache
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: npm

.github/workflows/docker.yml

@@ -69,15 +69,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha || '' }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -187,7 +187,7 @@ jobs:
 
       - name: Build & Push (${{ matrix.arch }})
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile
@@ -277,7 +277,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -540,7 +540,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Update PR description with docker image details
-        uses: nefrob/pr-description@v1.2.0
+        uses: nefrob/pr-description@v1.3.0
         with:
           content: ${{ steps.generate_description.outputs.pr_content }}
           regex: "<!-- AGENT_CANVAS_DOCKER_START -->.*?<!-- AGENT_CANVAS_DOCKER_END -->"

.github/workflows/mock-llm-docker-e2e.yml

@@ -130,7 +130,7 @@ jobs:
           fi
 
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ steps.ctx.outputs.ref }}
 
@@ -237,7 +237,7 @@ jobs:
           fi
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -252,7 +252,7 @@ jobs:
 
       # ── Test infrastructure setup ──────────────────────────────────────
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           # Pin to 24.15.x — Node 24.16.0 has a zip-extraction regression
           # (nodejs/node#63487) that hangs `playwright install` for Playwright
@@ -269,7 +269,7 @@ jobs:
 
       - name: Cache Playwright browsers
         id: pw_cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ steps.pw_version.outputs.version }}

.github/workflows/mock-llm-e2e-comment.yml

@@ -30,10 +30,10 @@ jobs:
       github.event.workflow_run.head_repository.full_name != github.repository
     steps:
       - name: Check out base repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download PR comment payload
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         id: download
         with:
           name: mock-llm-pr-comment-payload

.github/workflows/mock-llm-e2e.yml

@@ -61,7 +61,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Read defaults from config/defaults.json
         id: defaults
@@ -71,7 +71,7 @@ jobs:
           echo "acp_constraint=$(node -p "require('./config/defaults.json').constraints.agentClientProtocol")" >> "$GITHUB_OUTPUT"
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           # Pin to 24.15.x — Node 24.16.0 has a zip-extraction regression
           # (nodejs/node#63487) that hangs `playwright install` for Playwright
@@ -88,7 +88,7 @@ jobs:
 
       - name: Cache Playwright browsers
         id: pw_cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ steps.pw_version.outputs.version }}

.github/workflows/npm-publish.yml

@@ -27,14 +27,14 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       # Trusted publishing requires Node 22.14.0+ and npm 11.5.1+
       # See: https://docs.npmjs.com/trusted-publishers/
       - name: Set up Node.js for npm trusted publishing
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: npm

.github/workflows/pr-artifacts.yml

@@ -161,7 +161,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Check for .pr directory
         id: check

.github/workflows/pr-description-check.yml

@@ -24,7 +24,7 @@ jobs:
         runs-on: ubuntu-24.04
         steps:
             - name: Checkout trusted workflow scripts
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
               with:
                   ref: ${{ github.event.pull_request.base.sha }}
 

.github/workflows/sdk-version-sync.yml

@@ -52,10 +52,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'