ci: update github action runtimes

Author: squaeragent

.github/workflows/ci.yml

@@ -13,8 +13,8 @@ jobs:
   engine:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: "3.12"
           cache: pip
@@ -31,7 +31,7 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - name: Check required launch docs
         run: |
           test -f README.md
@@ -56,7 +56,7 @@ jobs:
   cli:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - name: Rust toolchain
         run: rustup show
       - name: Format
@@ -72,8 +72,8 @@ jobs:
   paper-example:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: "3.12"
           cache: pip
@@ -87,8 +87,8 @@ jobs:
   paper-api-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: "3.12"
           cache: pip
@@ -103,8 +103,8 @@ jobs:
   package-dry-run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: "3.12"
           cache: pip
@@ -119,7 +119,7 @@ jobs:
   container-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - name: Build paper image
         run: docker build -t zero-public:ci .
       - name: Run paper demo

.github/workflows/codeql.yml

@@ -22,11 +22,11 @@ jobs:
       matrix:
         language: [python]
     steps:
-      - uses: actions/checkout@v4
-      - uses: github/codeql-action/init@v3
+      - uses: actions/checkout@v6.0.2
+      - uses: github/codeql-action/init@v4.35.3
         with:
           languages: ${{ matrix.language }}
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@v4.35.3
         with:
           category: "/language:${{ matrix.language }}"
 

.github/workflows/release.yml

@@ -12,8 +12,8 @@ jobs:
   python-package:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6.0.2
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: "3.12"
           cache: pip
@@ -24,7 +24,7 @@ jobs:
           python -m build
       - name: Generate checksums
         run: python3 scripts/write_sha256s.py engine/dist/SHA256SUMS engine/dist/*
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: zero-engine-python
           path: engine/dist/*
@@ -40,7 +40,7 @@ jobs:
             artifact: zero-macos
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - name: Build CLI
         working-directory: cli
         run: cargo build -p zero --profile release-small
@@ -49,15 +49,15 @@ jobs:
           mkdir -p dist
           cp cli/target/release-small/zero dist/${{ matrix.artifact }}
           python3 scripts/write_sha256s.py dist/SHA256SUMS dist/${{ matrix.artifact }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: ${{ matrix.artifact }}
           path: dist/*
 
   container-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - name: Build paper image
         run: docker build -t zero-public:${{ github.ref_name }} .
       - name: Run paper demo
@@ -69,7 +69,7 @@ jobs:
           mkdir -p dist
           docker save zero-public:${{ github.ref_name }} -o dist/zero-paper-image.tar
           python3 scripts/write_sha256s.py dist/SHA256SUMS dist/zero-paper-image.tar
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: zero-paper-image
           path: dist/*
@@ -84,7 +84,7 @@ jobs:
       attestations: write
       artifact-metadata: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
       - uses: actions/download-artifact@v4
         with:
           path: release-artifacts

.github/workflows/scorecard.yml

@@ -17,11 +17,13 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - uses: ossf/scorecard-action@v2.4.3
         with:
+          results_file: results.sarif
+          results_format: sarif
           publish_results: true
 
   scorecard-sarif:
@@ -30,14 +32,14 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - uses: ossf/scorecard-action@v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: false
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4.35.3
         with:
           sarif_file: results.sarif

.github/workflows/secret-scan.yml

@@ -13,7 +13,7 @@ jobs:
   trufflehog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
       - uses: trufflesecurity/trufflehog@v3.95.2