ci: update pinned GitHub Actions via ratchet

[cursor]

Summary

• Refreshes SHA pins for GitHub Actions to the latest patch releases within existing major-version constraints, via mise run //:ratchet:update. Every pinned action keeps its current # ratchet:owner/action@vX constraint; only the commit SHA moves forward. No workflow logic changed.
• Pins: actions/checkout v7.0.0→v7.0.1 (9c091bb→3d3c42e), aws-actions/configure-aws-credentials v6.2.2→v6.2.3 (517a711→e6de054), jdx/mise-action v4.2.1→v4.2.4 (dad1bfd→7e36c90). Files: go.yml, docker.yml, eif-build.yml, ratchet.yml.
• Risk: Low. Patch-level, backward-compatible; no runtime migration; no new majors. Rollback is a trivial revert. actions/setup-go major (v6→v7) intentionally excluded for a separate opt-in upgrade.

Notable release notes

• checkout v7.0.1: safer unsafe-PR skip default, ASCII-only branch trim, escape values for git config --unset.
• configure-aws-credentials v6.2.3: git credentials before tag-major push; correct PackedPolicyTooLarge STS detection.
• mise-action v4.2.2–v4.2.4: zstd/tar fallback; restore PATH propagation via GITHUB_PATH (net positive for mise run //:... steps); NO_COLOR=1 for --locked probe.

Pre-merge checklist

• Build / CI passes (Go test + lint, Ratchet Lint — all green)
• Lint passes (Go lint + Ratchet Lint)
• Tests pass (mise run //:test / Go workflow)
• Plan / render reviewed — N/A (CI pin refresh only; not terraform/helmfile)
• Diff contains no unintended changes (SHA pins only; @vN constraints unchanged; target SHAs confirmed via git/refs/tags for v7.0.1 / v6.2.3 / v4.2.4)
• Docs / config updated if behavior or interface changed — N/A (CI pin refresh only)
• Cross-repo dependencies noted and ordered — N/A (openarbiter-only)

Post-deploy/apply verification

• Deploy or apply completed successfully — N/A for runtime deploy; merge landed on main as bc9e5ebb46e447c620d5578cf891c086c07cdf24 (2026-08-05T15:41:40Z); post-merge workflows exercised the new pins
• Target resource / workload reached the intended state — post-merge on main @ bc9e5eb: Go success (31021588464), Ratchet success (31021588453), Docker Build success (31021654671), Build EIF success (31021981575); runs used actions/checkout@3d3c42e…, configure-aws-credentials@e6de054…, mise-action@7e36c90…
• Dependent service(s) healthy — N/A (no runtime deploy)
• Metrics / synthetics green after the change — N/A (CI tooling only)

  

[Copilot]

Pull request overview

This PR refreshes pinned commit SHAs for several GitHub Actions in existing workflows, keeping the existing major-version (# ratchet:...@vX) constraints intact and making no workflow-logic changes.

Changes:

• Updated actions/checkout pins to the latest v7 patch release SHA across workflows.
• Updated aws-actions/configure-aws-credentials pins to the latest v6 patch release SHA where used.
• Updated jdx/mise-action pins to the latest v4 patch release SHA in CI workflows that use mise.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/ratchet.yml	Refreshes pinned SHAs for actions/checkout and jdx/mise-action used by Ratchet lint workflow.
.github/workflows/go.yml	Refreshes pinned SHAs for actions/checkout and jdx/mise-action in Go test/lint jobs.
.github/workflows/eif-build.yml	Refreshes pinned SHAs for actions/checkout and aws-actions/configure-aws-credentials in EIF build/update jobs.
.github/workflows/docker.yml	Refreshes pinned SHAs for actions/checkout and aws-actions/configure-aws-credentials in Docker build job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.