ci: update pinned GitHub Actions via ratchet (checkout, aws-creds, mise-action)

[cursor]

Summary

Routine ratchet update run: bumps the pinned commit SHAs of three GitHub Actions to the newest release within their existing major-version constraints. No # ratchet: constraint comments changed, so no major-version upgrades are involved. Generated with mise run //:ratchet:update.

Action	From	To	Type
actions/checkout	v7.0.0 (9c091bb)	v7.0.1 (3d3c42e)	patch
aws-actions/configure-aws-credentials	v6.2.2 (517a711)	v6.2.3 (e6de054)	patch
jdx/mise-action	v4.2.1 (dad1bfd)	v4.2.3 (9e7f763)	patch

Files touched: .github/workflows/{go,docker,eif-build,ratchet}.yml (11 line changes, SHA-only).

What changed in each update

actions/checkout v7.0.0 → v7.0.1

Bug fixes / hardening plus dependency bumps:

• Skip the "unsafe PR" check when the ref input is the default (#2518).
• Trim only ASCII whitespace when parsing a branch name (#2521).
• Escape values passed to git config --unset (#2530).

aws-actions/configure-aws-credentials v6.2.2 → v6.2.3

Two bug fixes:

• Attach git credentials before the "Tag Major Version" push (#1877) — internal to the action's own release tooling.
• Correctly detect PackedPolicyTooLarge when passing STS session tags (#1899).

jdx/mise-action v4.2.1 → v4.2.3 (spans v4.2.2 + v4.2.3)

• v4.2.2: verify tar actually supports Zstd (tar --zstd --version) before selecting the .tar.zst mise archive; falls back to .tar.gz otherwise. Fixes install failures on RHEL 8-style runners (old GNU tar). Docs-only README default fix.
• v4.2.3: restore mise's PATH propagation to subsequent workflow steps. v4.2.1 stopped snapshotting the runner's full PATH into GITHUB_ENV (good) but accidentally dropped mise-produced PATH entries (tool shims, [env] _.path). v4.2.3 now forwards only the mise-prepended prefix via GITHUB_PATH. Adds an opt-out export_path input (default true).

Risk assessment

Overall risk: Low. All three are patch releases confined to their current majors; ratchet only rewrote the pinned SHAs.

• Runtime unchanged: action.yml runs.using is node24 on both the old and new ref for all three actions — no node20→node24 style runtime migration.
• No input/output/API changes that these workflows depend on. mise-action adds a new optional export_path input (default true), which is backward compatible and unused here.
• checkout v7.0.1: security/robustness fixes only; the workflows use plain checkout (with ref/token), all unaffected by the changed edge cases. Negligible risk.
• configure-aws-credentials v6.2.3: the PackedPolicyTooLarge fix is the only behavioral change reachable here, and only surfaces when STS session tags overflow — not applicable to the current OIDC role-to-assume usage. The other fix is release-tooling internal. Negligible risk.
• mise-action v4.2.3: most behaviorally relevant change. The PATH-propagation fix is a net positive — it restores tool-shim visibility to later steps (e.g. the mise run //:... steps), which these workflows rely on. Watch that mise run steps still resolve tools correctly (they should now be more reliable). Low risk.
• Supply-chain: SHAs were resolved from upstream tag refs; ratchet keeps everything pinned to immutable commit SHAs with # ratchet: constraint comments intact.

Verification checklist

• mise run //:ratchet:update produced only SHA changes (no constraint-comment changes).
• Each new SHA maps to a real upstream tag within the pinned major (checkout v7.0.1, aws-creds v6.2.3, mise-action v4.2.3).
• action.yml runs.using verified node24 on both old and new refs for all three actions (no runtime migration).
• mise run //:ratchet:lint passes.
• mise run //:ratchet:pin leaves no additional diff (pinning is stable).
• git diff limited to the four workflow files; 11 SHA-only line changes.
• CI (Go, Ratchet Lint) green on this PR.
• Post-merge: confirm the Docker Build / EIF Build workflows still authenticate to AWS and build as expected (they consume checkout + configure-aws-credentials).