chore(deps): bump the github-actions group across 1 directory with 4 updates

.github/workflows/ai-agent.yml

@@ -93,7 +93,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -206,7 +206,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -299,7 +299,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/auto-fix-security.yml

@@ -23,11 +23,11 @@
   analyze-and-fix:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     if: github.event_name == 'workflow_dispatch' || (github.event_name == 'workflow_call' && inputs.alert_count > 0)
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         fetch-depth: 0
 
@@ -57,7 +57,7 @@
         uv venv
 
         # Install only the linting/formatting tools needed for auto-fixing
         # We don't sync the full project to avoid platform-specific deps like triton-windows (Windows-only)
         uv pip install autoflake isort ruff
 
     - name: Fetch CodeQL alerts
@@ -73,7 +73,7 @@
 
         # Get alert details
         gh api repos/${{ github.repository }}/code-scanning/alerts \
           --jq '.[] | select(.state == "open") | {severity: .rule.severity, rule: .rule.description}' \
           > alerts.json || echo "[]" > alerts.json
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -88,7 +88,7 @@
 
         # 1. Remove unused imports with autoflake
         echo "→ Removing unused imports..."
         if uv run autoflake --remove-all-unused-imports --in-place --recursive src/ test/ scripts/; then
           if ! git diff --quiet; then
             CHANGES_MADE=true
             echo "  ✓ Removed unused imports"
@@ -106,7 +106,7 @@
 
         # 3. Apply ruff fixes (safe auto-fixes only)
         echo "→ Applying ruff auto-fixes..."
         if uv run ruff check src/ test/ scripts/ --fix --unsafe-fixes=false; then
           if ! git diff --quiet; then
             CHANGES_MADE=true
             echo "  ✓ Applied ruff fixes"
@@ -132,24 +132,24 @@
 
         echo "## 🔒 Security Auto-Fix Summary" >> $GITHUB_STEP_SUMMARY
         echo "" >> $GITHUB_STEP_SUMMARY
         echo "**Alerts Found:** $ALERT_COUNT open issues" >> $GITHUB_STEP_SUMMARY
         echo "**Changes Applied:** $CHANGES_MADE" >> $GITHUB_STEP_SUMMARY
         echo "" >> $GITHUB_STEP_SUMMARY
 
         if [ "$CHANGES_MADE" = "true" ]; then
           echo "### ✅ Automatic Fixes Applied" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "The following automated fixes were applied:" >> $GITHUB_STEP_SUMMARY
           echo "- Removed unused imports (autoflake)" >> $GITHUB_STEP_SUMMARY
           echo "- Sorted imports (isort)" >> $GITHUB_STEP_SUMMARY
           echo "- Applied safe code fixes (ruff)" >> $GITHUB_STEP_SUMMARY
           echo "- Formatted code (ruff format)" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "A pull request will be created with these changes." >> $GITHUB_STEP_SUMMARY
         else
           echo "### ℹ️ No Automatic Fixes Available" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "The security alerts require manual review and fixes." >> $GITHUB_STEP_SUMMARY
         fi
 
     - name: Create Pull Request
@@ -182,7 +182,7 @@
           - ✅ Formatted code (ruff format)
 
           ### CodeQL Alerts
           Found **${{ steps.fetch-alerts.outputs.alert_count }}** open alerts that triggered this auto-fix workflow.
 
           ### Review Checklist
           - [ ] All CI checks pass

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -72,7 +72,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -110,7 +110,7 @@ jobs:
         python-version: ['3.11', '3.12']
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
@@ -140,7 +140,7 @@ jobs:
           uv run pytest test/ -v --cov=src/astro_lab --cov-report=xml --cov-report=term-missing
 
       - name: Upload coverage reports
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         if: matrix.python-version == '3.11'
         with:
           files: ./coverage.xml

.github/workflows/data-pipeline.yml

@@ -73,7 +73,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/dependabot-auto-merge.yml

@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/docs.yml

@@ -28,7 +28,7 @@
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         fetch-depth: 0  # Full history for git operations
 
@@ -51,19 +51,19 @@
         key: ${{ runner.os }}-uv-docs-${{ hashFiles('**/uv.lock') }}
         restore-keys: |
           ${{ runner.os }}-uv-docs-
 
     - name: Install dependencies
       run: |
         uv sync --frozen
 
     - name: Generate API documentation
       run: |
         uv run python docs/generate_docs.py update
 
     - name: Build documentation
       run: |
         uv run mkdocs build --clean
 
     - name: Deploy to GitHub Pages
       uses: peaceiris/actions-gh-pages@v4
       if: github.ref == 'refs/heads/main'
@@ -74,7 +74,7 @@
         user_name: 'github-actions[bot]'
         user_email: 'github-actions[bot]@users.noreply.github.com'
         commit_message: 'docs: auto-generate and deploy documentation'
 
     - name: Create deployment summary
       if: always()
       run: |
@@ -96,3 +96,3 @@
           echo "- 📖 Available at: https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/" >> $GITHUB_STEP_SUMMARY
         else
           echo "- ℹ️ Documentation built but not deployed (not on main branch)" >> $GITHUB_STEP_SUMMARY

.github/workflows/publish-pypi.yml

@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/security.yml

@@ -41,7 +41,7 @@ jobs:
       image: semgrep/semgrep
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Run Semgrep
         run: semgrep ci --sarif --output=semgrep-results.sarif
@@ -71,7 +71,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
@@ -94,10 +94,10 @@ jobs:
     if: github.event_name == 'pull_request'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
           allow-licenses: >-

.github/workflows/train-model.yml

@@ -90,7 +90,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/validate-workflows.yml

@@ -23,7 +23,7 @@
     timeout-minutes: 5
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download actionlint
         id: get_actionlint
@@ -36,7 +36,7 @@
         run: |
           echo "## Workflow Validation Results" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
           # Run actionlint on all workflows
           if actionlint -verbose .github/workflows/*.yml 2>&1 | tee /tmp/actionlint.log; then
             echo "✅ All workflows are valid!" >> $GITHUB_STEP_SUMMARY
@@ -56,7 +56,7 @@
           pip install yamllint
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### YAML Syntax Check" >> $GITHUB_STEP_SUMMARY
 
           if yamllint -d relaxed .github/workflows/ 2>&1 | tee /tmp/yamllint.log; then
             echo "✅ YAML syntax is valid" >> $GITHUB_STEP_SUMMARY
           else