build(deps): bump the github-actions group across 1 directory with 11 updates

.github/workflows/agent-ci.yml

@@ -17,7 +17,7 @@ jobs:
     # Pinned to an immutable core commit SHA, not @main (see release.yml): core's
     # v0.19.4, the release go.mod requires. Bump the two together, which
     # TestCorePinsAreOneImmutableCommitMatchingGoMod holds.
-    uses: codefly-dev/core/.github/workflows/agent-ci.yml@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4
+    uses: codefly-dev/core/.github/workflows/agent-ci.yml@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8
     with:
       # The CLI release the gate runs with. agent.codefly.yaml selects the
       # source-packager version (0.0.69); go.mod selects Go 1.27.3.

.github/workflows/ci.yml

@@ -9,10 +9,10 @@ jobs:
   build-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -27,10 +27,10 @@ jobs:
   agent-runtime-e2e:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -47,18 +47,18 @@ jobs:
   image-sbom:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
       - name: build gateway image
         run: docker build -t service-warehouse:e2e .
       # The daemon holds this image and no registry serves it, so the scan needs
       # syft on PATH: the managed containerized scanner has no Docker access.
-      - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
       - name: assert the image contract against a real image
         env:
           SWH_GATEWAY_IMAGE: service-warehouse:e2e
@@ -85,7 +85,7 @@ jobs:
             exit 0
           fi
           go run ./cmd/image-sbom -image "$(jq -er '.name + "@" + .digest' gateway-image.json)" -out sbom-published
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: gateway-image-sbom
           path: |

.github/workflows/publish-gateway-image.yml

@@ -33,7 +33,7 @@ jobs:
       # Full history and the triggering commit, with no `ref`: the action proves
       # that commit is reachable from the remote's own default branch, and a
       # shallow clone or a caller-selected ref would decide that question for it.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -44,9 +44,9 @@ jobs:
       # before the action, it runs no code from this repository and writes
       # nothing into the checkout, so the action's guard — a dirty tree, stored
       # Git credentials, an unmerged commit — still runs before login and build.
-      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
-      - uses: codefly-dev/core/.github/actions/publish-service-image@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4
+      - uses: codefly-dev/core/.github/actions/publish-service-image@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8
         id: publish
         with:
           version: ${{ inputs.version }}

.github/workflows/release.yml

@@ -34,8 +34,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -48,9 +48,9 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -107,11 +107,11 @@ jobs:
             exit 1
           fi
           echo "digest=$digest" >> "$GITHUB_OUTPUT"
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
-      - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
       # Evidence for every platform the image ships, generated by the same code
       # path the agent's Builder.SBOM uses, so each document is bound to the child
       # manifest digest inside the document itself. It scans the recorded digest
@@ -121,7 +121,7 @@ jobs:
         env:
           DIGEST: ${{ steps.locked.outputs.digest }}
         run: go run ./cmd/image-sbom -image "$IMAGE@$DIGEST" -out sbom
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: gateway-image-sbom-${{ steps.version.outputs.version }}
           path: sbom/
@@ -157,7 +157,7 @@ jobs:
     # requires; bump the two together. This version of the workflow keeps the
     # release PAT out of jobs that run unreviewed code and refuses a tag not
     # reachable from the default branch.
-    uses: codefly-dev/core/.github/workflows/go-service-release.yml@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4
+    uses: codefly-dev/core/.github/workflows/go-service-release.yml@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8
     secrets: inherit
 
   # Workflow artifacts expire. Copy the digest-bound documents and index onto
@@ -168,7 +168,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: gateway-image-sbom-*
           merge-multiple: true