chore: upgrade GitHub Actions runtimes

[arnabnandy7]

Summary

Upgrade GitHub Actions that target the deprecated Node.js 20 runtime.

Changes

• Upgrade actions/checkout from v4 to v7.
• Upgrade actions/setup-java from v4 to v6.
• Upgrade actions/github-script from v7 to v9.
• Upgrade peter-evans/repository-dispatch from v3 to v4.
• Apply the upgrades consistently across all affected workflows.

Existing workflow conditions, inputs, secrets, and behavior remain unchanged.

Validation

• YAML lint passed.
• git diff --check passed.
• Confirmed no affected deprecated action versions remain under .github/workflows.
• No heavy build or test suite was run because the changes only update GitHub Action versions.

Additional context

The remaining actions/github-script warning comes from the reusable notify-recovery workflow in the separate embabel/embabel-build repository and must be addressed there.

Closes #1999.

[igordayen]

Validation

@arnabnandy7 - Has any testing been done for the Dependabot Insights action? Thanks

[arnabnandy7]

Validation

@arnabnandy7 - Has any testing been done for the Dependabot Insights action? Thanks

no @igordayen

[igordayen]

@arnabnandy7, usually GitHub workflows require testing in GitHub prior to commits; this is a special case. All scripts were debugged in GitHub prior to pushing to PRs. Please advise how you would like to proceed with testing. Thanks
looping @alexheifetz

[arnabnandy7]

@arnabnandy7, usually GitHub workflows require testing in GitHub prior to commits; this is a special case. All scripts were debugged in GitHub prior to pushing to PRs. Please advise how you would like to proceed with testing. Thanks
looping @alexheifetz

Also, we need to start with other linked PRs first

[arnabnandy7]

Please advise how you would like to proceed with testing. Thanks looping @alexheifetz

@igordayen the PR branch is in a fork, so it is unavailable in the upstream repository’s Actions → Dependabot Insights branch selector. Please validate it using a temporary branch in embabel/embabel-agent.

1. Fetch the PR commit

From a clean checkout of embabel/embabel-agent:

git fetch origin main
git fetch https://github.com/arnabnandy7/embabel-agent.git chore/upgradeGithubActions

2. Create an upstream validation branch

git switch --create chore/validateGithubActions origin/main
git cherry-pick e0c3a1a0ca6f7b51edfc7f86306ebd7aee91b8cb
git push origin chore/validateGithubActions

This temporary upstream branch contains the same changes as PR #2000.

3. Run the Dependabot Insights workflow

1. Open embabel/embabel-agent on GitHub.
2. Go to Actions.
3. Select Dependabot Insights.
4. Select Run workflow.
5. Choose chore/validateGithubActions.
6. Run the workflow.

The upstream repository will use its configured DEPENDABOT_SECRET; the credential does not need to be shared.

4. Verify the run

Confirm that:

• actions/checkout@v7 completes successfully.
• The GitHub CLI installation completes successfully.
• dependabot-group-alerts.sh executes.
• Dependabot alerts are retrieved without 401, 403, or 404 errors.
• The workflow completes successfully.
• No Node.js 20 deprecation warning is emitted for actions/checkout.

5. Delete the temporary branch

After validation:

git push origin --delete chore/validateGithubActions