ci(deps): bump the actions group across 1 directory with 19 updates

.github/workflows/ai-changeset.yml

@@ -37,12 +37,12 @@ jobs:
         id: app-token
         if: ${{ vars.CHANGELOG_APP_ID != '' }}
         continue-on-error: true
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.CHANGELOG_APP_ID }}
           private-key: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
@@ -51,10 +51,10 @@ jobs:
       - name: Ensure base ref is present
         run: git fetch --no-tags origin ${{ github.event.pull_request.base.ref }}
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
           version: '10.30.3'
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '23'
           cache: 'pnpm'
@@ -130,7 +130,7 @@ jobs:
       # For fork PRs (cannot push) surface the suggestion as a comment instead.
       - name: Suggest changeset on fork PRs
         if: ${{ steps.gate.outputs.covered != 'true' && github.event.pull_request.head.repo.full_name != github.repository }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('node:fs')

.github/workflows/changelog-check.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Require a changelog fragment (or skip-changelog label)
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const { owner, repo } = context.repo

.github/workflows/ci.yml

@@ -47,7 +47,7 @@ jobs:
       # the commit that introduced it. A shallow clone has no such commit, so
       # draft ages would be unreadable. Keep enough history for an honest report;
       # staleness itself is informational and never a merge gate.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup
@@ -187,10 +187,10 @@ jobs:
     # only move the silent pass one level down.
     if: github.event_name != 'push'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '23'
 
@@ -216,7 +216,7 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
 
       - name: Build & Type check
@@ -254,7 +254,7 @@ jobs:
       matrix:
         shard: [1/3, 2/3, 3/3]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup
@@ -304,7 +304,7 @@ jobs:
     # in this job reads PR context, so the unknown-event path is sound as-is.
     if: github.event_name != 'push'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
 
       - name: Build packages
@@ -317,7 +317,7 @@ jobs:
       # libraries present. (Exploration 0193.)
       - name: Cache Playwright browsers
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-1.58.1-chromium-webkit
@@ -358,7 +358,7 @@ jobs:
       # lives in the visual-capture workflow; this just keeps debug evidence.
       - name: Upload editor UX screenshots
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: editor-ux-screenshots
           # Playwright runs with cwd=tests/e2e, so screenshots land there; the
@@ -389,7 +389,7 @@ jobs:
     # PR context either (fetch-depth: 0 is for history, not for a base ref).
     if: github.event_name != 'push'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup
@@ -407,7 +407,7 @@ jobs:
 
       - name: Cache Playwright browser
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-1.58.1-chromium
@@ -447,7 +447,7 @@ jobs:
 
       - name: Upload Electron e2e artifacts
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: electron-e2e-artifacts
           path: |
@@ -464,9 +464,9 @@ jobs:
   conformance-rust:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry

.github/workflows/cloud-metrics.yml

@@ -27,8 +27,8 @@ jobs:
     if: ${{ vars.CLOUD_METRICS_ENABLED == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
 
@@ -43,7 +43,7 @@ jobs:
           rm -f company-metrics.json
 
       - name: Open a PR if the snapshot changed
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@v8
         with:
           commit-message: 'chore(open): refresh run-in-public metrics snapshot'
           title: 'chore(open): weekly run-in-public metrics refresh'

.github/workflows/dco.yml

@@ -17,7 +17,7 @@ jobs:
     name: Signed-off-by on every commit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/dependency-audit.yml

@@ -37,7 +37,7 @@ jobs:
     name: Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
 
       - name: Negative control

.github/workflows/deploy-branch-preview.yml

@@ -21,7 +21,7 @@ jobs:
     if: github.ref_name != 'main' && github.ref_name != 'gh-pages'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup
 

.github/workflows/deploy-cloud.yml

@@ -65,15 +65,15 @@ jobs:
       BASE_URL: https://cloud-staging.xnet.fyi
       HUB_IMAGE_TAG: '1.0.0' # plain image tag each provisioned hub is pinned to (repo:TAG; '@' is not a valid Docker tag)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - id: auth
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@v3
         with:
           workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
           service_account: ${{ secrets.DEPLOYER_SA }}
 
-      - uses: google-github-actions/setup-gcloud@v2
+      - uses: google-github-actions/setup-gcloud@v3
 
       - name: Build + push control-plane image
         run: |
@@ -167,15 +167,15 @@ jobs:
       BASE_URL: https://cloud.xnet.fyi
       HUB_IMAGE_TAG: '1.0.0'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - id: auth
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@v3
         with:
           workload_identity_provider: ${{ secrets.PROD_WIF_PROVIDER }}
           service_account: ${{ secrets.PROD_DEPLOYER_SA }}
 
-      - uses: google-github-actions/setup-gcloud@v2
+      - uses: google-github-actions/setup-gcloud@v3
 
       # A tenant whose payment lapses is emailed before their hub degrades and
       # again before its cloud replica is deleted. With no mail transport the

.github/workflows/deploy-pr-preview.yml

@@ -24,7 +24,7 @@ jobs:
       name: pr-${{ github.event.pull_request.number }}
       url: https://xnet.fyi/pr/${{ github.event.pull_request.number }}/app/
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -72,7 +72,7 @@ jobs:
           commit-message: 'deploy(preview): publish PR #${{ github.event.pull_request.number }} demos preview'
 
       - name: Comment preview link
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const body = [

.github/workflows/deploy-site.yml

@@ -26,7 +26,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Full history so resolve-prs can find each fragment's merge commit.
           fetch-depth: 0
@@ -56,7 +56,7 @@ jobs:
           VITE_BASE_PATH: '/play/'
 
       - name: Cache Astro build
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: site/.astro
           key: astro-${{ hashFiles('site/pnpm-lock.yaml', 'site/src/**', 'site/astro.config.mjs') }}

.github/workflows/electron-release.yml

@@ -50,7 +50,7 @@ jobs:
       should_release: ${{ steps.check.outputs.should_release }}
       should_build: ${{ steps.check.outputs.should_build }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Get version from package.json
         id: version
@@ -128,14 +128,14 @@ jobs:
     if: needs.version.outputs.should_build == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
 
       - name: Build packages
         run: pnpm build
 
       - name: Upload JS build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: js-build
           path: |
@@ -152,13 +152,13 @@ jobs:
       matrix:
         arch: [x64, arm64]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
         with:
           electron-cache: 'true'
 
       - name: Download JS build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: js-build
           path: .
@@ -285,7 +285,7 @@ jobs:
           xcrun stapler staple "$DMG_FILE"
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: macos-${{ matrix.arch }}
           path: |
@@ -303,13 +303,13 @@ jobs:
     # sharp). better-sqlite3 is unaffected — it ships an Electron prebuild.
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
         with:
           electron-cache: 'true'
 
       - name: Download JS build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: js-build
           path: .
@@ -334,7 +334,7 @@ jobs:
           pnpm electron-builder --win --x64 --publish never
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: windows-x64
           path: |
@@ -349,13 +349,13 @@ jobs:
       matrix:
         arch: [x64, arm64]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
         with:
           electron-cache: 'true'
 
       - name: Download JS build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: js-build
           path: .
@@ -407,7 +407,7 @@ jobs:
           exit $rc
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: linux-${{ matrix.arch }}
           path: |
@@ -423,10 +423,10 @@ jobs:
     if: needs.version.outputs.should_release == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts