ci: bump the actions group across 1 directory with 15 updates

.github/workflows/arm64-build-smoke.yml

@@ -60,7 +60,7 @@ jobs:
         run: go test -tags hostload ./pkg/bpfcompat/...
 
       - name: Upload arm64 validator (for multi-arch embed / release)
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: bpfcompat-validator-arm64
           path: pkg/bpfcompat/validators/bpfcompat-validator-arm64

.github/workflows/bpfcompat-example-hosted.yml

@@ -121,7 +121,7 @@ jobs:
 
       - name: Upload reports
         if: always() && steps.changes.outputs.required == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: bpfcompat-reports-${{ github.run_id }}
           if-no-files-found: warn

.github/workflows/bpfcompat-example.yml

@@ -55,7 +55,7 @@ jobs:
 
       - name: Upload reports
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: bpfcompat-reports-${{ github.run_id }}
           if-no-files-found: warn

.github/workflows/ci.yml

@@ -195,7 +195,7 @@ jobs:
       - name: Enforce coverage floor
         run: bash scripts/check-coverage.sh coverage.out 50.0
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: coverage-${{ github.run_id }}

.github/workflows/codeql.yml

@@ -43,7 +43,7 @@ jobs:
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: go
           # Go does not support build-mode: none; autobuild runs `go build`,
@@ -53,7 +53,7 @@ jobs:
           queries: security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: "/language:go"
 

.github/workflows/compatibility-matrix-publish.yml

@@ -178,7 +178,7 @@ jobs:
 
       - name: Upload compatibility evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: bpfcompat-compatibility-matrix-${{ github.run_id }}
           if-no-files-found: warn
@@ -237,4 +237,4 @@ jobs:
 
       - name: Deploy Pages
         if: always() && steps.evidence.outputs.publishable == 'true' && (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.deploy_pages == 'true'))
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5

.github/workflows/consumer-canary.yml

@@ -135,7 +135,7 @@ jobs:
 
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: canary-stable-${{ github.run_id }}
           if-no-files-found: warn
@@ -211,7 +211,7 @@ jobs:
 
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: canary-prebuilt-${{ github.run_id }}
           if-no-files-found: warn
@@ -279,7 +279,7 @@ jobs:
 
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: canary-source-${{ github.run_id }}
           if-no-files-found: warn

.github/workflows/external-consumer-canary.yml

@@ -62,7 +62,7 @@ jobs:
           concurrency: "2"
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: canary-inspektor-gadget-${{ github.run_id }}
           path: reports/
@@ -129,7 +129,7 @@ jobs:
           concurrency: "2"
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: canary-kubearmor-${{ github.run_id }}
           path: reports/
@@ -189,7 +189,7 @@ jobs:
           test "$actual" = "$expected"
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: canary-falco-${{ github.run_id }}
           path: reports/

.github/workflows/ghcr-image.yml

@@ -44,10 +44,10 @@ jobs:
             echo "date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
           } >> "$GITHUB_OUTPUT"
 
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -63,7 +63,7 @@ jobs:
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64

.github/workflows/kernel-freshness.yml

@@ -95,7 +95,7 @@ jobs:
 
       - name: Upload freshness report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: kernel-freshness-${{ github.run_id }}
           if-no-files-found: warn

.github/workflows/latest-kernel-compatibility.yml

@@ -246,7 +246,7 @@ jobs:
             }' >reports/production-campaign.json
 
       - name: Attest campaign evidence
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: reports/production-campaign.json
 
@@ -260,7 +260,7 @@ jobs:
 
       - name: Upload latest-kernel evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: bpfcompat-latest-kernel-${{ github.run_id }}
           if-no-files-found: warn

.github/workflows/maintenance-evidence.yml

@@ -101,7 +101,7 @@ jobs:
             .checksums_sha256 == $checksums
           ' "$evidence" >/dev/null || { echo "::error::candidate evidence does not match the dispatch"; exit 1; }
           cp "$RUNNER_TEMP/maintenance-scope.json" "$candidate/"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: maintenance-candidate-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/candidate/
@@ -114,7 +114,7 @@ jobs:
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: maintenance-candidate-${{ github.run_id }}-${{ github.run_attempt }}
           path: dist
@@ -136,7 +136,7 @@ jobs:
           mkdir -p reports
           cp "$work"/reports/release-positive.json "$work"/reports/release-negative.json \
             "$work"/reports/release-artifact-identity.json reports/
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: maintenance-vm-${{ github.run_id }}-${{ github.run_attempt }}
           path: reports/
@@ -152,7 +152,7 @@ jobs:
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: "v2.6.3"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: maintenance-candidate-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/candidate
@@ -175,7 +175,7 @@ jobs:
           cmp "$root/libexec/bpfcompat-validator" "$RUNNER_TEMP/candidate/bpfcompat-validator-static-linux-amd64"
           jq -n --arg tag "$TAG" --arg commit "$GITHUB_SHA" \
             '{check: "clean-install", status: "pass", version: $tag, commit: $commit}' >canary/clean-install.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: maintenance-canary-clean-install-${{ github.run_id }}-${{ github.run_attempt }}
           path: canary/clean-install.json
@@ -188,7 +188,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: maintenance-candidate-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/candidate
@@ -228,7 +228,7 @@ jobs:
           mkdir -p canary
           jq -n --arg tag "$TAG" --arg commit "$GITHUB_SHA" \
             '{check: "candidate-action", status: "pass", version: $tag, commit: $commit}' >canary/candidate-action.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: maintenance-canary-candidate-action-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -265,7 +265,7 @@ jobs:
           mkdir -p canary
           jq -n --arg tag "$TAG" --arg commit "$GITHUB_SHA" --arg digest "$DIGEST" \
             '{check: "container", status: "pass", version: $tag, commit: $commit, digest: $digest}' >canary/container.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: maintenance-canary-container-${{ github.run_id }}-${{ github.run_attempt }}
           path: canary/container.json
@@ -282,7 +282,7 @@ jobs:
       attestations: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: maintenance-*-${{ github.run_id }}-${{ github.run_attempt }}
           path: in
@@ -324,14 +324,14 @@ jobs:
             evidence/maintenance-evidence-input.json evidence/maintenance-evidence.json
           cp "$v"/release-positive.json "$v"/release-negative.json "$c/maintenance-scope.json" evidence/
       - name: Attest maintenance evidence
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             evidence/maintenance-evidence.json
             evidence/release-positive.json
             evidence/release-negative.json
             evidence/maintenance-scope.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: maintenance-evidence-${{ inputs.milestone }}-${{ needs.bind.outputs.tag }}
           path: evidence/

.github/workflows/multiarch-compatibility.yml

@@ -79,7 +79,7 @@ jobs:
 
       - name: Upload multiarch evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: bpfcompat-${{ matrix.arch }}-${{ github.run_id }}
           if-no-files-found: warn

.github/workflows/preprint-v1.yml

@@ -39,7 +39,7 @@ jobs:
           test "$pages" -ge 1
 
       - name: Upload preprint artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: bpfcompat-preprint-v1-${{ github.run_id }}
           path: |

.github/workflows/profile-catalog-maintenance.yml

@@ -40,7 +40,7 @@ jobs:
 
       - name: Upload catalog evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: bpfcompat-profile-catalog-${{ github.run_id }}
           if-no-files-found: warn

.github/workflows/promote-release.yml

@@ -201,8 +201,8 @@ jobs:
               .isPrerelease == ($channel == "prerelease")
             ' <<<"$release_json" >/dev/null
 
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}