build(deps): bump the actions-minor-patch group across 1 directory with 5 updates

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
       GOTOOLCHAIN: go1.26.5
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go
@@ -47,7 +47,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Node
@@ -75,7 +75,7 @@ jobs:
       GOTOOLCHAIN: go1.26.5
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go
@@ -103,7 +103,7 @@ jobs:
       GOTOOLCHAIN: go1.26.5
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Node
@@ -149,7 +149,7 @@ jobs:
       GOTOOLCHAIN: go1.26.5
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Go

.github/workflows/codeql.yml

@@ -25,16 +25,16 @@ jobs:
           - javascript-typescript
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       - name: Analyze
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: /language:${{ matrix.language }}

.github/workflows/dependency-review.yml

@@ -13,7 +13,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Dependency Review

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
       tag_object: ${{ steps.identity.outputs.tag_object }}
     steps:
       - name: Checkout exact tag
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -63,7 +63,7 @@ jobs:
       RELEASE_VERSION: ${{ needs.release-admission.outputs.version }}
     steps:
       - name: Checkout exact source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ needs.release-admission.outputs.source_commit }}
@@ -112,7 +112,7 @@ jobs:
       RELEASE_VERSION: ${{ needs.release-admission.outputs.version }}
     steps:
       - name: Checkout exact source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ needs.release-admission.outputs.source_commit }}
@@ -166,7 +166,7 @@ jobs:
       REBUILD_B_SHA256: ${{ needs.release-build-b.outputs.tree_tar_sha256 }}
     steps:
       - name: Checkout exact source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ needs.release-admission.outputs.source_commit }}
@@ -180,7 +180,7 @@ jobs:
         id: compare
         run: 'set -euo pipefail; test "$(sha256sum "$RUNNER_TEMP/rebuild-a/publication-tree.tar" | awk ''{print $1}'')" = "$REBUILD_A_SHA256"; test "$(sha256sum "$RUNNER_TEMP/rebuild-b/publication-tree.tar" | awk ''{print $1}'')" = "$REBUILD_B_SHA256"; test "$REBUILD_A_SHA256" = "$REBUILD_B_SHA256"; python3 -c "import pathlib,sys,tarfile; t=tarfile.open(sys.argv[1],''r:''); m=t.getmembers(); n=[x.name for x in m]; assert m and len(n)==len(set(n)); assert all(x.isfile() or x.isdir() for x in m); assert all(not pathlib.PurePosixPath(x).is_absolute() and ''..'' not in pathlib.PurePosixPath(x).parts for x in n)" "$RUNNER_TEMP/rebuild-a/publication-tree.tar"; python3 -c "import pathlib,sys,tarfile; t=tarfile.open(sys.argv[1],''r:''); m=t.getmembers(); n=[x.name for x in m]; assert m and len(n)==len(set(n)); assert all(x.isfile() or x.isdir() for x in m); assert all(not pathlib.PurePosixPath(x).is_absolute() and ''..'' not in pathlib.PurePosixPath(x).parts for x in n)" "$RUNNER_TEMP/rebuild-b/publication-tree.tar"; mkdir -m 700 "$RUNNER_TEMP/a" "$RUNNER_TEMP/b"; tar -xf "$RUNNER_TEMP/rebuild-a/publication-tree.tar" -C "$RUNNER_TEMP/a" --no-same-owner; tar -xf "$RUNNER_TEMP/rebuild-b/publication-tree.tar" -C "$RUNNER_TEMP/b" --no-same-owner; scripts/release/compare-runtime-rebuilds.sh "$RUNNER_TEMP/a" "$RUNNER_TEMP/b"; cp "$RUNNER_TEMP/rebuild-a/publication-tree.tar" "$RUNNER_TEMP/publication-bundle.tar"; test "$(sha256sum "$RUNNER_TEMP/publication-bundle.tar" | awk ''{print $1}'')" = "$REBUILD_A_SHA256"; (cd "$RUNNER_TEMP" && jq -r ''.subjects[] | "\(.sha256)  \(.path)"'' a/provenance-subjects.json >attestation-checksums.txt && printf "%s  provenance-subjects.json\n" "$(sha256sum a/provenance-subjects.json | awk ''{print $1}'')" >>attestation-checksums.txt && LC_ALL=C sort -k2,2 -o attestation-checksums.txt attestation-checksums.txt); printf "publication_bundle_sha256=%s\n" "$REBUILD_A_SHA256" >>"$GITHUB_OUTPUT"'
       - name: Attest exact runtime provenance subjects
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-checksums: ${{ runner.temp }}/attestation-checksums.txt
           show-summary: true
@@ -214,7 +214,7 @@ jobs:
       PUBLICATION_BUNDLE_SHA256: ${{ needs.release-compare-attest.outputs.publication_bundle_sha256 }}
     steps:
       - name: Checkout exact source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/runner-release-candidate.yml

@@ -31,7 +31,7 @@ jobs:
           PORTABLE_GHAR_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: 'set -euo pipefail; test -n "$PORTABLE_GHAR_RUNNER_OBSERVER_ACTOR"; test "$GITHUB_ACTOR" = "$PORTABLE_GHAR_RUNNER_OBSERVER_ACTOR"; test -n "$PORTABLE_GHAR_DEFAULT_BRANCH"; test "$GITHUB_REF" = "refs/heads/$PORTABLE_GHAR_DEFAULT_BRANCH"; python3 -B -c ''import json,os,pathlib,stat; fail=lambda:(_ for _ in ()).throw(ValueError("event")); path=pathlib.Path(os.environ["GITHUB_EVENT_PATH"]); info=path.lstat(); raw=path.read_bytes(); (stat.S_ISREG(info.st_mode) and not path.is_symlink() and info.st_nlink == 1 and 0 < len(raw) <= 1048576) or fail(); hook=lambda pairs:dict(pairs) if len(pairs) == len({key for key,_value in pairs}) else fail(); event=json.loads(raw.decode("utf-8","strict"),object_pairs_hook=hook,parse_constant=lambda _value:fail()); type(event) is dict or fail(); name=os.environ["GITHUB_EVENT_NAME"]; repository_dispatch=name == "repository_dispatch" and event.get("action") == "observe-runner-release" and type(event.get("client_payload")) is dict and len(event["client_payload"]) == 0; workflow_dispatch=name == "workflow_dispatch" and "action" not in event and "client_payload" not in event and ("inputs" not in event or event["inputs"] is None or type(event["inputs"]) is dict and len(event["inputs"]) == 0); (repository_dispatch or workflow_dispatch) or fail()'''
       - name: Checkout exact default-branch source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.sha }}
@@ -70,7 +70,7 @@ jobs:
       ARTIFACT_VERSION: ${{ needs.runner-candidate-admission.outputs.artifact_version }}
     steps:
       - name: Checkout exact source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ needs.runner-candidate-admission.outputs.source_commit }}
@@ -120,7 +120,7 @@ jobs:
       ARTIFACT_VERSION: ${{ needs.runner-candidate-admission.outputs.artifact_version }}
     steps:
       - name: Checkout exact source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ needs.runner-candidate-admission.outputs.source_commit }}
@@ -175,7 +175,7 @@ jobs:
       REBUILD_B_SHA256: ${{ needs.runner-candidate-build-b.outputs.tree_tar_sha256 }}
     steps:
       - name: Checkout exact source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ needs.runner-candidate-admission.outputs.source_commit }}
@@ -189,7 +189,7 @@ jobs:
         id: compare
         run: 'set -euo pipefail; test "$(sha256sum "$RUNNER_TEMP/rebuild-a/publication-tree.tar" | awk ''{print $1}'')" = "$REBUILD_A_SHA256"; test "$(sha256sum "$RUNNER_TEMP/rebuild-b/publication-tree.tar" | awk ''{print $1}'')" = "$REBUILD_B_SHA256"; test "$REBUILD_A_SHA256" = "$REBUILD_B_SHA256"; python3 -c "import pathlib,sys,tarfile; t=tarfile.open(sys.argv[1],''r:''); m=t.getmembers(); n=[x.name for x in m]; assert m and len(n)==len(set(n)); assert all(x.isfile() or x.isdir() for x in m); assert all(not pathlib.PurePosixPath(x).is_absolute() and ''..'' not in pathlib.PurePosixPath(x).parts for x in n)" "$RUNNER_TEMP/rebuild-a/publication-tree.tar"; python3 -c "import pathlib,sys,tarfile; t=tarfile.open(sys.argv[1],''r:''); m=t.getmembers(); n=[x.name for x in m]; assert m and len(n)==len(set(n)); assert all(x.isfile() or x.isdir() for x in m); assert all(not pathlib.PurePosixPath(x).is_absolute() and ''..'' not in pathlib.PurePosixPath(x).parts for x in n)" "$RUNNER_TEMP/rebuild-b/publication-tree.tar"; mkdir -m 700 "$RUNNER_TEMP/a" "$RUNNER_TEMP/b"; tar -xf "$RUNNER_TEMP/rebuild-a/publication-tree.tar" -C "$RUNNER_TEMP/a" --no-same-owner; tar -xf "$RUNNER_TEMP/rebuild-b/publication-tree.tar" -C "$RUNNER_TEMP/b" --no-same-owner; scripts/release/compare-runtime-rebuilds.sh "$RUNNER_TEMP/a" "$RUNNER_TEMP/b"; cp "$RUNNER_TEMP/rebuild-a/publication-tree.tar" "$RUNNER_TEMP/publication-bundle.tar"; test "$(sha256sum "$RUNNER_TEMP/publication-bundle.tar" | awk ''{print $1}'')" = "$REBUILD_A_SHA256"; (cd "$RUNNER_TEMP" && jq -r ''.subjects[] | "\(.sha256)  \(.path)"'' a/provenance-subjects.json >attestation-checksums.txt && printf "%s  provenance-subjects.json\n" "$(sha256sum a/provenance-subjects.json | awk ''{print $1}'')" >>attestation-checksums.txt && LC_ALL=C sort -k2,2 -o attestation-checksums.txt attestation-checksums.txt); printf "publication_bundle_sha256=%s\n" "$REBUILD_A_SHA256" >>"$GITHUB_OUTPUT"'
       - name: Attest exact candidate provenance subjects
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-checksums: ${{ runner.temp }}/attestation-checksums.txt
           show-summary: true
@@ -225,7 +225,7 @@ jobs:
       PUBLICATION_BUNDLE_SHA256: ${{ needs.runner-candidate-compare-attest.outputs.publication_bundle_sha256 }}
     steps:
       - name: Checkout exact source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ needs.runner-candidate-admission.outputs.source_commit }}

.github/workflows/sanitization.yml

@@ -17,7 +17,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false