chore(deps): bump the version-updates group across 1 directory with 12 updates

.github/workflows/chaos-regression.yml

@@ -40,6 +40,6 @@ jobs:
        github.event.pull_request.head.repo.full_name == github.repository)
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Reboot/chaos self-heal regression probe
         run: bash scripts/ops/chaos_probe.sh

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind + dev deps
@@ -48,7 +48,7 @@ jobs:
   public-checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — no dependency on a pre-provisioned runner)
         run: |
           curl -LsSf https://astral.sh/uv/install.sh | sh
@@ -98,7 +98,7 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run forbidden-pattern audit
         run: python3 scripts/checks/audit_forbidden.py --fail --json audit-report.json
       - if: always()
@@ -111,7 +111,7 @@ jobs:
   schema-validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Validate all service descriptors
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -150,7 +150,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -166,7 +166,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -181,15 +181,15 @@ jobs:
   constraints-validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Validate dependency constraint planes
         run: python3 scripts/checks/constraints_check.py
 
   # ---- Documentation mirror validation ----
   docs-mirror-validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Validate README language mirrors
         run: python3 scripts/checks/docs_mirror_check.py
 
@@ -198,7 +198,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -214,7 +214,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -234,7 +234,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate, deploy-target-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -250,7 +250,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [deploy-target-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -266,7 +266,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [docs-mirror-validate, component-validate, deploy-target-validate, tool-candidate-validate, constraints-validate, topology-validate, healthcheck-tool-validate, kubernetes-render-validate, kubernetes-proof-workflow-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -283,7 +283,7 @@ jobs:
     needs: [audit, schema-validate, component-validate, deploy-target-validate, tool-candidate-validate, constraints-validate, topology-validate, healthcheck-tool-validate, kubernetes-render-validate]
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind + dev
@@ -315,7 +315,7 @@ jobs:
     needs: [audit, constraints-validate]
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Build base image
         run: docker build -f docker/Dockerfile.base -t agmind-base:ci .
 
@@ -328,7 +328,7 @@ jobs:
       matrix:
         backend: [cpu, vulkan, rocm]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build base + ${{ matrix.backend }} image (self-contained — GitHub-hosted runners do not share local images)
         run: |
@@ -345,7 +345,7 @@ jobs:
     needs: [schema-validate, component-validate, deploy-target-validate, tool-candidate-validate, constraints-validate]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -404,7 +404,7 @@ jobs:
     needs: [docker-build, compose-validate]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install agmind + dev
         run: |
           "$HOME/.local/bin/uv" --version
@@ -458,7 +458,7 @@ jobs:
     needs: [schema-validate]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind + dev
@@ -500,7 +500,7 @@ jobs:
       matrix:
         backend: [vulkan, rocm]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Build base + ${{ matrix.backend }} image (self-contained on this runner)
         run: |
           docker build -f docker/Dockerfile.base -t agmind-base:ci .

.github/workflows/kubernetes-proof.yml

@@ -36,7 +36,7 @@ jobs:
        github.event.pull_request.head.repo.full_name == github.repository)
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install agmind + dev deps
         run: |

.github/workflows/perf-nightly.yml

@@ -39,7 +39,7 @@ jobs:
     runs-on: [self-hosted, linux, x64, strix-halo]
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — no dependency on a pre-provisioned runner)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind + dev deps

.github/workflows/promote.yml

@@ -48,7 +48,7 @@ jobs:
       checks: read       # read check-runs for the target SHA
       actions: read      # read workflow runs (for check-run context)
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           # Do NOT set `ref:` to the input SHA. actions/checkout@v6 resolves `ref` as a

.github/workflows/release-drafter.yml

@@ -28,6 +28,6 @@ jobs:
       # SHA-pinned (review LOW ci-actions-mutable-tag-pins): this job runs on
       # pull_request_target with contents+pull-requests write — a force-moved tag would inject
       # code into a token-bearing job. Dependabot (github-actions) bumps the pin via the # v7.
-      - uses: release-drafter/release-drafter@693d20e7c1ce1a81d3a41962f85914253b518449 # v7
+      - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -49,7 +49,7 @@ jobs:
       version: ${{ steps.v.outputs.version }}
       tag: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install package (version check only)
         run: |
           python -m pip install --quiet --no-deps -e .
@@ -130,16 +130,16 @@ jobs:
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: build
         name: Build (and push if PUBLISH)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile.base
@@ -154,7 +154,7 @@ jobs:
 
       - name: Generate SPDX SBOM for base
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v0.22.0.
-        uses: anchore/sbom-action@62ad5284b8ced813296287a0b63906cb364b73ee # v0.22.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ env.IMAGE_NS }}-base@${{ steps.build.outputs.digest }}
           format: spdx-json
@@ -168,7 +168,7 @@ jobs:
         # transitive critical CVE. Tightening to fail-build later is a deliberate follow-up, not a
         # silent default.
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v7.4.0.
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
         with:
           sbom: sbom-base.spdx.json
           fail-build: false
@@ -177,7 +177,7 @@ jobs:
 
       - name: Attest base image provenance (SLSA)
         if: vars.PUBLISH == 'true'
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.IMAGE_NS }}-base
           subject-digest: ${{ steps.build.outputs.digest }}
@@ -211,16 +211,16 @@ jobs:
       matrix:
         backend: [cpu, vulkan, rocm]
     steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: build
         name: Build ${{ matrix.backend }} (and push if PUBLISH)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile.${{ matrix.backend }}
@@ -236,7 +236,7 @@ jobs:
 
       - name: Generate SPDX SBOM for ${{ matrix.backend }}
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v0.22.0.
-        uses: anchore/sbom-action@62ad5284b8ced813296287a0b63906cb364b73ee # v0.22.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ env.IMAGE_NS }}-${{ matrix.backend }}@${{ steps.build.outputs.digest }}
           format: spdx-json
@@ -250,7 +250,7 @@ jobs:
         # transitive critical CVE. Tightening to fail-build later is a deliberate follow-up, not a
         # silent default.
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v7.4.0.
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
         with:
           sbom: sbom-${{ matrix.backend }}.spdx.json
           fail-build: false
@@ -259,7 +259,7 @@ jobs:
 
       - name: Attest ${{ matrix.backend }} image provenance (SLSA)
         if: vars.PUBLISH == 'true'
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.IMAGE_NS }}-${{ matrix.backend }}
           subject-digest: ${{ steps.build.outputs.digest }}
@@ -289,8 +289,8 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Build wheel + sdist
@@ -306,7 +306,7 @@ jobs:
             -p . agmind/__main__.py
           mv dist/agmind dist/agmind-linux-amd64
       - name: Attest wheel + binary provenance (SLSA)
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: |
             dist/*.whl
@@ -329,14 +329,14 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Install agmind
         run: pip install -e .
       - name: Download backend digest + SBOM artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: backend-*
           path: backends
@@ -366,7 +366,7 @@ jobs:
           sha256sum * > checksums-${VER}.txt
 
       - name: Attest catalog provenance (SLSA)
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: release/catalog-${{ needs.meta.outputs.version }}.json
 
@@ -387,12 +387,12 @@ jobs:
       contents: write    # create the GitHub Release
     steps:
       - name: Download all release artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: all
       - name: Publish GitHub Release
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v2.
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: ${{ needs.meta.outputs.tag }}
           generate_release_notes: true