chore(deps): bump the github-actions group with 4 updates

.github/workflows/ai-review.yml

@@ -63,7 +63,7 @@ jobs:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -138,7 +138,7 @@ jobs:
         # Don't fail the check if Claude errors — including hitting the --max-turns cap.
         # A cut-off review writes no verdict line, so the gate step skips it silently.
         continue-on-error: true
-        uses: anthropics/claude-code-action@12531344451323133b0493233c759991ac61da12 # v1
+        uses: anthropics/claude-code-action@fa7e2f0a29a126f0b81cdcf360561b36e44cf608 # v1
         with:
           # OAuth token (Pro/Max subscription) is preferred; the API key also works.
           # Whichever secret is unset resolves to an empty string and is ignored.

.github/workflows/auto-assign.yml

@@ -38,7 +38,7 @@ jobs:
     if: github.event.pull_request.head.repo.full_name == github.repository
     steps:
       # Only the CODEOWNERS file is needed; sparse-checkout keeps it cheap.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: |
             .github/CODEOWNERS

.github/workflows/ci-sdk-python.yml

@@ -33,7 +33,7 @@ jobs:
       run:
         working-directory: sdks/python
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"

.github/workflows/ci.yml

@@ -22,15 +22,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
 
   go-sdk-spec-sync:
     name: webhook-go vendored spec is current
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # The Go SDK lives in a separate repo, so its route-coverage ratchet validates against a VENDORED copy
       # of this spec (webhook-go testdata/openapi.json). A derived artifact whose guard is not triggered by
       # its SOURCE rots silently — exactly how the Python SDK's generated models fell 12 schemas behind
@@ -58,7 +58,7 @@ jobs:
     timeout-minutes: 20
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # The unit suite imports from src/. That proves the CODE works and NOTHING about what users install:
       # a broken `exports` map, a file missing from `files:`, or a bad `types` path all ship green because no
@@ -73,7 +73,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # CLIENT_LATEST (packages/shared/src/client-advisory.ts) is what the API compares a client's
       # User-Agent against to decide whether to advise an update. It is a DERIVED fact — the truth lives in
@@ -90,7 +90,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # `wbhk` ships via npm AND Homebrew, and they can silently diverge: release-cli publishes npm
       # immediately but leaves the GitHub release as a DRAFT (a deliberate human gate), while homebrew-bump
@@ -105,7 +105,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm lint
 
@@ -115,7 +115,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm format:check
 
@@ -125,7 +125,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm typecheck
 
@@ -135,7 +135,7 @@ jobs:
     timeout-minutes: 30
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Coverage thresholds are enforced inside the Vitest config (see packages/shared).
       - run: pnpm test
@@ -166,7 +166,7 @@ jobs:
     env:
       TEST_DATABASE_URL: postgres://postgres@localhost:5432/postgres
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Install dbmate
         env:
@@ -200,7 +200,7 @@ jobs:
     timeout-minutes: 20
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm build
 
@@ -216,7 +216,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Version-pinned, NOT SHA-pinned (unlike the dbmate install above): bun's official installer
       # fetches the version-tagged release, and we don't carry a per-platform archive hash. Deliberate
@@ -278,7 +278,7 @@ jobs:
     timeout-minutes: 20
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm exec turbo run build --filter=@webhook-co/auth
       - run: pnpm -C apps/auth deploy:dry
@@ -293,7 +293,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Unit-test the pure gate helpers (dead-link regex, SEO head rules, sitemap parsing) against
       # fixtures BEFORE the build — a fast fail if the gate logic itself regressed. These node:test
@@ -349,7 +349,7 @@ jobs:
     env:
       TEST_DATABASE_URL: postgres://postgres@localhost:5432/postgres
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Install dbmate
         env:
@@ -373,7 +373,7 @@ jobs:
     timeout-minutes: 30
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm --filter @webhook-co/www build
       - run: pnpm --filter @webhook-co/www exec playwright install --with-deps chromium
@@ -389,7 +389,7 @@ jobs:
     timeout-minutes: 30
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm --filter @webhook-co/www build
       - run: pnpm --filter @webhook-co/www test:lighthouse
@@ -400,7 +400,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm run no-skipped-tests
 
@@ -413,7 +413,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm run tsconfig-boundary
 
@@ -427,7 +427,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm run dal-gate-guard
 
@@ -440,7 +440,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # npm RETIRED the legacy quick-audit endpoint `pnpm audit` posts to
       # (`/-/npm/v1/security/audits` → HTTP 410), so `pnpm audit` fails every run regardless of

.github/workflows/claude.yml

@@ -64,14 +64,14 @@ jobs:
             echo "::notice title=Claude not configured::Add CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY in repo Settings to enable @claude mentions."
           fi
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.gate.outputs.enabled == 'true'
         with:
           fetch-depth: 0
 
       - name: Claude
         if: steps.gate.outputs.enabled == 'true'
-        uses: anthropics/claude-code-action@12531344451323133b0493233c759991ac61da12 # v1
+        uses: anthropics/claude-code-action@fa7e2f0a29a126f0b81cdcf360561b36e44cf608 # v1
         with:
           # OAuth token (Pro/Max subscription) is preferred; the API key also works.
           # Whichever secret is unset resolves to an empty string and is ignored.

.github/workflows/codeql.yml

@@ -23,16 +23,16 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
           languages: javascript-typescript
           build-mode: none
           queries: security-extended
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
           category: "/language:javascript-typescript"

.github/workflows/deploy-auth.yml

@@ -74,7 +74,7 @@ jobs:
       AUTH_DEVICE_KV_ID: ${{ vars.AUTH_DEVICE_KV_ID }}
       AUTH_RATELIMIT_KV_ID: ${{ vars.AUTH_RATELIMIT_KV_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # apps/auth reads the identity DB, so it must not auto-deploy past an un-applied migration either.
       # Blocks when HEAD is ahead of the global prod-schema tag by a migration; recovery is applying the

.github/workflows/deploy-get.yml

@@ -44,7 +44,7 @@ jobs:
       CLOUDFLARE_API_TOKEN: ${{ github.event_name != 'pull_request' && secrets.CLOUDFLARE_API_TOKEN || '' }}
       CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Deploy production (get.webhook.co)
         if: github.event_name == 'push'

.github/workflows/deploy-play.yml

@@ -35,7 +35,7 @@ jobs:
     # Same-repo only: fork PRs don't receive secrets.
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Dry-run needs no credentials — it validates config locally.
       - name: Validate deploy (dry-run)

.github/workflows/deploy-telemetry.yml

@@ -41,7 +41,7 @@ jobs:
       CLOUDFLARE_API_TOKEN: ${{ github.event_name != 'pull_request' && secrets.CLOUDFLARE_API_TOKEN || '' }}
       CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Deploy production (telemetry.wbhk.my)
         if: github.event_name == 'push'

.github/workflows/deploy-web.yml

@@ -92,7 +92,7 @@ jobs:
       AUTH_DEVICE_KV_ID: ${{ vars.AUTH_DEVICE_KV_ID }}
       AUTH_RATELIMIT_KV_ID: ${{ vars.AUTH_RATELIMIT_KV_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # apps/web reads the tenant DB, so it must not auto-deploy past an un-applied migration either. Blocks
       # when HEAD is ahead of the global prod-schema tag by a migration; recovery is applying the migration

.github/workflows/deploy-www.yml

@@ -49,7 +49,7 @@ jobs:
       CLOUDFLARE_API_TOKEN: ${{ github.event_name != 'pull_request' && secrets.CLOUDFLARE_API_TOKEN || '' }}
       CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Build static export
         run: pnpm --filter @webhook-co/www build

.github/workflows/deploy.yml

@@ -98,7 +98,7 @@ jobs:
       AUTH_DEVICE_KV_ID: ${{ vars.AUTH_DEVICE_KV_ID }}
       AUTH_RATELIMIT_KV_ID: ${{ vars.AUTH_RATELIMIT_KV_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Blocks the auto-deploy when a migration was added since prod's schema was last brought current — i.e.
       # HEAD is ahead of the global `prod-schema` tag by a migration. NOT just this push's diff, so a later

.github/workflows/homebrew-bump.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Bump the Homebrew formula
         env:

.github/workflows/nightly-rls.yml

@@ -80,7 +80,7 @@ jobs:
             exit 1
           fi
           echo "enabled=true" >> "$GITHUB_OUTPUT"
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.guard.outputs.enabled == 'true'
       - uses: ./.github/actions/setup
         if: steps.guard.outputs.enabled == 'true'

.github/workflows/release-cli.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
 
       # Version-pinned (not SHA-pinned) bun installer — same rationale as ci.yml's completion-smoke job.

.github/workflows/release-sdk-python.yml

@@ -30,7 +30,7 @@ jobs:
       run:
         working-directory: sdks/python
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"

.github/workflows/release-sdk-ts.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
 
       # User-controlled values (the dispatch input) flow through env, never `${{ }}`-interpolated into the

.github/workflows/secret-scan.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0