build(deps): bump the actions group across 1 directory with 13 updates

.github/workflows/audit.yml

@@ -36,11 +36,11 @@ jobs:
     pip-audit:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
 
-            - uses: actions/setup-python@v5
+            - uses: actions/setup-python@v7
               with:
                   python-version: "3.13"
                   cache: pip

.github/workflows/docker-publish.yml

@@ -79,7 +79,7 @@ jobs:
             # all tags. Default shallow clone hides everything but HEAD.
             # ref: a dispatch with a tag input builds THAT tag's tree; a tag
             # push or bare dispatch checks out the triggering ref as before.
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
                   ref: ${{ inputs.tag || github.ref }}
@@ -106,7 +106,7 @@ jobs:
                   echo "→ release tag: '${tag:-<none — edge build>}' (prerelease: $prerelease)"
 
             - name: Set up Python
-              uses: actions/setup-python@v5
+              uses: actions/setup-python@v7
               with:
                   python-version: "3.12"
 
@@ -140,13 +140,13 @@ jobs:
                   fi
 
             - name: Set up QEMU
-              uses: docker/setup-qemu-action@v3
+              uses: docker/setup-qemu-action@v4
 
             - name: Set up Buildx
-              uses: docker/setup-buildx-action@v3
+              uses: docker/setup-buildx-action@v4
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@v3
+              uses: docker/login-action@v4
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -161,7 +161,7 @@ jobs:
             # this workflow may assign :latest except promote.
             - name: Derive staging tag + OCI labels
               id: meta
-              uses: docker/metadata-action@v5
+              uses: docker/metadata-action@v6
               with:
                   images: ${{ env.IMAGE }}
                   flavor: |
@@ -187,7 +187,7 @@ jobs:
             # static/dist/ ships. Doing it here also keeps it out of the
             # per-architecture builds — the bundle is plain JS, arch-agnostic.
             - name: Set up Node
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v7
               with:
                   node-version: "20"
 
@@ -198,7 +198,7 @@ jobs:
 
             - name: Build and push
               id: build
-              uses: docker/build-push-action@v6
+              uses: docker/build-push-action@v7
               with:
                   context: .
                   platforms: linux/amd64,linux/arm64
@@ -284,7 +284,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Log in to Docker Hub
-              uses: docker/login-action@v3
+              uses: docker/login-action@v4
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/dockerhub-readme.yml

@@ -59,7 +59,7 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             # README.dockerhub.md is generated by docs-ai/readme/compose.sh
             # from gitignored section sources. If someone deletes it, the

.github/workflows/docs.yml

@@ -33,14 +33,14 @@ jobs:
     build:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Configure Pages
-              uses: actions/configure-pages@v5
+              uses: actions/configure-pages@v6
               with:
                   enablement: true
 
-            - uses: actions/setup-python@v5
+            - uses: actions/setup-python@v7
               with:
                   python-version: "3.12"
 
@@ -51,7 +51,7 @@ jobs:
               run: mkdocs build --strict
 
             - name: Upload Pages artifact
-              uses: actions/upload-pages-artifact@v3
+              uses: actions/upload-pages-artifact@v5
               with:
                   path: site/
 
@@ -64,4 +64,4 @@ jobs:
         steps:
             - name: Deploy to GitHub Pages
               id: deployment
-              uses: actions/deploy-pages@v4
+              uses: actions/deploy-pages@v5

.github/workflows/pypi-publish.yml

@@ -33,12 +33,12 @@ jobs:
         steps:
             # fetch-depth: 0 so setuptools-scm can `git describe` against
             # all tags. Default shallow clone hides everything but HEAD.
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
 
             - name: Set up Python
-              uses: actions/setup-python@v5
+              uses: actions/setup-python@v7
               with:
                   python-version: "3.12"
 
@@ -47,7 +47,7 @@ jobs:
             # gitignored, so it must be generated here — package-data globs the
             # filesystem, so a present static/dist/ lands in the wheel.
             - name: Set up Node
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v7
               with:
                   node-version: "20"
 
@@ -138,12 +138,12 @@ jobs:
                   echo
                   echo "✓ /health responded from the installed wheel"
 
-            - uses: actions/upload-artifact@v4
+            - uses: actions/upload-artifact@v7
               with:
                   name: dist
                   path: dist/
 
-            - uses: actions/upload-artifact@v4
+            - uses: actions/upload-artifact@v7
               with:
                   name: third-party-licenses
                   path: third-party-licenses.md
@@ -157,7 +157,7 @@ jobs:
         permissions:
             id-token: write # OIDC token for Trusted Publishing
         steps:
-            - uses: actions/download-artifact@v4
+            - uses: actions/download-artifact@v8
               with:
                   name: dist
                   path: dist/
@@ -178,7 +178,7 @@ jobs:
         permissions:
             contents: write
         steps:
-            - uses: actions/download-artifact@v4
+            - uses: actions/download-artifact@v8
               with:
                   name: dist
                   path: dist/

.github/workflows/release-features.yml

@@ -23,7 +23,7 @@ jobs:
             contents: read
             packages: write
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Bundle painapple source into Feature
               run: tools/bundle-feature-source.sh --feature-only

.github/workflows/test-features.yml

@@ -21,7 +21,7 @@ jobs:
                     - mcr.microsoft.com/devcontainers/base:ubuntu
                     - debian:bookworm-slim
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
             - name: Install devcontainers CLI
               run: npm install -g @devcontainers/cli
             - name: Test ${{ matrix.feature }} on ${{ matrix.baseImage }}

.github/workflows/tests.yml

@@ -67,12 +67,12 @@ jobs:
             # tags rather than falling back to 0.1.devN.
             # ref is empty for every trigger except a workflow_call that
             # passes one — checkout treats empty as "the triggering ref".
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
                   ref: ${{ inputs.ref }}
 
-            - uses: actions/setup-python@v5
+            - uses: actions/setup-python@v7
               with:
                   python-version: ${{ matrix.python-version }}
                   cache: pip

.github/workflows/windows-smoke.yml

@@ -29,11 +29,11 @@ jobs:
             # fetch-depth: 0 so setuptools-scm can resolve a version from
             # tags; without it the build falls back to 0.1.devN, which is
             # fine for a smoke test but noisy in logs.
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
 
-            - uses: actions/setup-python@v5
+            - uses: actions/setup-python@v7
               with:
                   python-version: ${{ matrix.python-version }}