chore(deps)(deps): bump the github-actions group across 1 directory with 11 updates

.github/workflows/rhiza_benchmark.yml

@@ -20,7 +20,7 @@ on:
 
 jobs:
   benchmark:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml@v1.9.0
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml@v1.11.0
     # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the
     # caller's own organisation or enterprise (#1689). A secret this repository has not
     # defined arrives empty and the workflow falls back to `github.token`.

.github/workflows/rhiza_book.yml

@@ -29,7 +29,7 @@ permissions:
 
 jobs:
   book:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_book.yml@v1.9.0
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_book.yml@v1.11.0
     # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the
     # caller's own organisation or enterprise (#1689). A secret this repository has not
     # defined arrives empty and the workflow falls back to `github.token`.

.github/workflows/rhiza_ci.yml

@@ -26,7 +26,7 @@ on:
 
 jobs:
   ci:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_ci.yml@v1.9.0
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_ci.yml@v1.11.0
     # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the
     # caller's own organisation or enterprise (#1689). A secret this repository has not
     # defined arrives empty and the workflow falls back to `github.token`.

.github/workflows/rhiza_codeql.yml

@@ -26,7 +26,7 @@ on:
 
 jobs:
   codeql:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_codeql.yml@v1.9.0
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_codeql.yml@v1.11.0
     # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the
     # caller's own organisation or enterprise (#1689). A secret this repository has not
     # defined arrives empty and the workflow falls back to `github.token`.

.github/workflows/rhiza_marimo.yml

@@ -28,7 +28,7 @@ on:
 
 jobs:
   marimo:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_marimo.yml@v1.9.0
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_marimo.yml@v1.11.0
     # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the
     # caller's own organisation or enterprise (#1689). A secret this repository has not
     # defined arrives empty and the workflow falls back to `github.token`.

.github/workflows/rhiza_release.yml

@@ -425,7 +425,7 @@ jobs:
 
       - name: Upload SBOM artifacts
         if: hashFiles('pyproject.toml') != ''
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: sbom
           path: |
@@ -449,7 +449,7 @@ jobs:
 
       - name: Upload dist artifact
         if: steps.buildable.outputs.buildable == 'true'
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: dist
           path: dist
@@ -476,7 +476,7 @@ jobs:
 
       - name: Download SBOM artifact
         # Downloads sbom.cdx.json and sbom.cdx.xml into sbom/ directory
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: sbom
           path: sbom
@@ -485,7 +485,7 @@ jobs:
       - name: Download dist artifact
         # Brings in provenance.intoto.jsonl (and the built distributions) staged
         # by the build job, so the SLSA provenance ships as a release asset.
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: dist
           path: dist
@@ -520,7 +520,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download dist artifact
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: dist
           path: dist
@@ -553,7 +553,7 @@ jobs:
       # repository-url and password only used for custom feeds, not for PyPI with OIDC
       - name: Publish to PyPI
         if: ${{ steps.check_dist.outputs.should_publish == 'true' }}
-        uses: pypa/gh-action-pypi-publish@v1.14.2
+        uses: pypa/gh-action-pypi-publish@v1.14.3
         with:
           packages-dir: dist/
           skip-existing: true
@@ -650,7 +650,7 @@ jobs:
 
       - name: Upload conda recipe artifact
         if: steps.check_conda.outputs.should_generate == 'true'
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: conda-recipe
           path: conda-recipe/meta.yaml
@@ -697,7 +697,7 @@ jobs:
 
       - name: Login to Container Registry
         if: steps.check_publish.outputs.should_publish == 'true'
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.7.0
         with:
           registry: ${{ steps.registry.outputs.registry }}
           username: ${{ github.repository_owner }}

.github/workflows/rhiza_scorecard.yml

@@ -36,7 +36,7 @@ permissions: read-all
 
 jobs:
   scorecard:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_scorecard.yml@v1.9.0
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_scorecard.yml@v1.11.0
     permissions:
       security-events: write   # Upload the SARIF results to code scanning
       id-token: write          # Publish results to the OpenSSF REST API (badge)

.github/workflows/rhiza_weekly.yml

@@ -28,7 +28,7 @@ on:
 
 jobs:
   weekly:
-    uses: jebel-quant/rhiza/.github/workflows/rhiza_weekly.yml@v1.9.0
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_weekly.yml@v1.11.0
     # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the
     # caller's own organisation or enterprise (#1689). A secret this repository has not
     # defined arrives empty and the workflow falls back to `github.token`.