deps: clear all 14 Dependabot PRs

.github/dependabot.yml

@@ -11,6 +11,18 @@ updates:
     schedule:
       interval: monthly
     open-pull-requests-limit: 5
+    # Every action in these workflows is referenced by its floating major
+    # tag (`@v7`), so patch and minor releases already arrive without a PR
+    # and a PR for one is pure noise. It is not free noise either: left on,
+    # Dependabot proposes replacing a floating `@v2` with an exact patch —
+    # taiki-e/install-action#16 did exactly that — and then opens a fresh PR
+    # for every subsequent patch, of which that action publishes several a
+    # week. Major bumps are the ones that need a human, and still get one.
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-patch
+          - version-update:semver-minor
 
   - package-ecosystem: pip
     directory: /samkhya-py

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -70,7 +70,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -114,7 +114,7 @@ jobs:
             feature_args: --features puffin-cross-engine --test puffin_cross_engine
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -141,15 +141,15 @@ jobs:
         python-version: ["3.9", "3.12", "3.13"]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -194,12 +194,12 @@ jobs:
         working-directory: samkhya-gpudb/scripts
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: npm
@@ -233,7 +233,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 

.github/workflows/release-candidate.yml

@@ -18,15 +18,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -83,7 +83,7 @@ jobs:
         run: sha256sum *.crate *.whl cargo-metadata.json sbom.cdx.json > SHA256SUMS
 
       - name: Upload candidate bundle
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: samkhya-1.1.0-local-candidate
           path: target/release-candidate/