From 27559174edded86e8228d0d480015422221c709e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 15 Aug 2026 12:54:24 +0000
Subject: [PATCH] chore(deps): update github-actions

---
 .github/actions/ai-pr-review/action.yml               | 8 ++++----
 .github/actions/ci-notify-nightly-tests/action.yml    | 2 +-
 .github/actions/ci-test-notify/action.yml             | 2 +-
 .github/actions/cve-scan/action.yml                   | 4 ++--
 .github/actions/go-licenses/action.yml                | 2 +-
 .github/actions/govulncheck/action.yml                | 4 ++--
 .github/actions/linear-pr-commenter/action.yml        | 4 ++--
 .github/actions/link-backport-prs/action.yml          | 2 +-
 .github/actions/prerelease-setup/action.yml           | 8 ++++----
 .github/actions/promote-release/action.yml            | 4 ++--
 .github/actions/publish-helm-chart/action.yml         | 2 +-
 .github/actions/release-notification/action.yml       | 4 ++--
 .github/workflows/actionlint.yaml                     | 6 +++---
 .github/workflows/ai-pr-review.yaml                   | 2 +-
 .github/workflows/auto-approve-bot-prs.yaml           | 2 +-
 .github/workflows/backport.yaml                       | 8 ++++----
 .github/workflows/check-docs.yaml                     | 2 +-
 .github/workflows/ci.yaml                             | 6 +++---
 .github/workflows/claude-code-review.yaml             | 4 ++--
 .github/workflows/claude.yaml                         | 4 ++--
 .github/workflows/claude.yml                          | 4 ++--
 .github/workflows/cleanup-head-charts.yaml            | 2 +-
 .github/workflows/conflict-check.yaml                 | 2 +-
 .github/workflows/detect-changes.yaml                 | 4 ++--
 .github/workflows/notify-release.yaml                 | 2 +-
 .github/workflows/release-linear-release-sync.yaml    | 4 ++--
 .github/workflows/test-ai-pr-review.yaml              | 2 +-
 .github/workflows/test-ai-step.yaml                   | 4 ++--
 .github/workflows/test-auto-approve-bot-prs.yaml      | 4 ++--
 .github/workflows/test-aws-test-infra.yaml            | 6 +++---
 .github/workflows/test-backport-legacy-allowlist.yaml | 2 +-
 .github/workflows/test-backport-legacy-split.yaml     | 2 +-
 .github/workflows/test-ci-test-notify.yaml            | 2 +-
 .github/workflows/test-cleanup-head-charts.yaml       | 2 +-
 .github/workflows/test-commitlint.yaml                | 4 ++--
 .github/workflows/test-cve-scan.yaml                  | 4 ++--
 .github/workflows/test-go-licenses.yaml               | 2 +-
 .github/workflows/test-govulncheck.yaml               | 2 +-
 .github/workflows/test-linear-pr-commenter.yaml       | 4 ++--
 .github/workflows/test-linear-release-sync.yaml       | 4 ++--
 .github/workflows/test-link-backport-prs.yaml         | 4 ++--
 .github/workflows/test-oss-commit-sync.yaml           | 2 +-
 .github/workflows/test-parse-label-filter.yaml        | 4 ++--
 .github/workflows/test-prerelease-setup.yaml          | 2 +-
 .github/workflows/test-promote-release.yaml           | 4 ++--
 .github/workflows/test-publish-helm-chart.yaml        | 2 +-
 .github/workflows/test-release-branch-freeze.yaml     | 2 +-
 .github/workflows/test-release-notification.yaml      | 4 ++--
 .github/workflows/test-repository-dispatch.yaml       | 2 +-
 .github/workflows/test-run-ginkgo.yaml                | 6 +++---
 .github/workflows/test-semver-validation.yaml         | 4 ++--
 .github/workflows/test-sticky-pr-comment.yaml         | 4 ++--
 .github/workflows/test-subtree-mirror.yaml            | 2 +-
 .github/workflows/test-vcluster-release.yaml          | 2 +-
 .github/workflows/test-wait-for-release.yaml          | 2 +-
 .github/workflows/validate-renovate.yaml              | 4 ++--
 56 files changed, 96 insertions(+), 96 deletions(-)

diff --git a/.github/actions/ai-pr-review/action.yml b/.github/actions/ai-pr-review/action.yml
index 4bb0fbfe..e333b2e5 100644
--- a/.github/actions/ai-pr-review/action.yml
+++ b/.github/actions/ai-pr-review/action.yml
@@ -72,7 +72,7 @@ runs:
     # (script 2>/dev/null || rm -f CLAUDE.md) on every run.
     - name: Checkout PR head
       if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'anthropic'
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 0
@@ -95,7 +95,7 @@ runs:
 
     - name: Claude PR review
       if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'anthropic'
-      uses: anthropics/claude-code-action@f4fb5c6cdccc1ee7af63692f5d08d56efaa64cc8 # v1.0.121
+      uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c # v1.0.193
       with:
         anthropic_api_key: ${{ inputs.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret
         github_token: ${{ inputs.github-token }}
@@ -131,7 +131,7 @@ runs:
     # root, and clobbering it breaks GitHub's late-stage action resolution.
     - name: Checkout PR head (openai)
       if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'openai'
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 0
@@ -144,7 +144,7 @@ runs:
     - name: Codex PR review
       id: codex
       if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'openai'
-      uses: openai/codex-action@e0fdf01220eb9a88167c4898839d273e3f2609d1 # v1.8
+      uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11
       with:
         openai-api-key: ${{ inputs.openai-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret
         model: ${{ steps.cfg.outputs.model }}
diff --git a/.github/actions/ci-notify-nightly-tests/action.yml b/.github/actions/ci-notify-nightly-tests/action.yml
index cbfa7bf4..10eabd37 100644
--- a/.github/actions/ci-notify-nightly-tests/action.yml
+++ b/.github/actions/ci-notify-nightly-tests/action.yml
@@ -31,7 +31,7 @@ runs:
   using: "composite"
   steps:
     - name: Post E2E test results notification
-      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c  # v3.0.3
+      uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc  # v3.0.5
       with:
         errors: true
         webhook-type: incoming-webhook
diff --git a/.github/actions/ci-test-notify/action.yml b/.github/actions/ci-test-notify/action.yml
index 4f40dd6e..c138d402 100644
--- a/.github/actions/ci-test-notify/action.yml
+++ b/.github/actions/ci-test-notify/action.yml
@@ -44,7 +44,7 @@ runs:
 
     - name: Send Slack notification
       if: steps.gate.outputs.notify == 'true'
-      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+      uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
       with:
         errors: true
         webhook-type: incoming-webhook
diff --git a/.github/actions/cve-scan/action.yml b/.github/actions/cve-scan/action.yml
index d2ee34cc..61152f87 100644
--- a/.github/actions/cve-scan/action.yml
+++ b/.github/actions/cve-scan/action.yml
@@ -104,7 +104,7 @@ runs:
 
     - name: Log in to the image registry
       if: inputs.registry-password != '' && !contains(fromJSON('["false","no","0","off"]'), inputs.enabled)
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       # A registry that can't be reached is inconclusive, not a finding, so this
       # must not fail the caller's job — run.sh classifies the pull failure that
       # follows. See README, "Three failure modes".
@@ -162,7 +162,7 @@ runs:
          steps.scan.outputs.scanner-error == 'true' ||
          steps.scan.outcome == 'failure' ||
          steps.scan.outcome == 'cancelled')
-      uses: loft-sh/github-actions/.github/actions/ci-test-notify@85d7023c5749421d369f59430c7849f2d00ad694 # ci-test-notify/v1
+      uses: loft-sh/github-actions/.github/actions/ci-test-notify@5bee69a81632d51d940c19d849f628479e55f3da # ci-test-notify/v1
       with:
         test-name: "cve-scan: ${{ inputs.image-ref }}"
         # Every branch of the `if:` above is a failure, so the status is a
diff --git a/.github/actions/go-licenses/action.yml b/.github/actions/go-licenses/action.yml
index aacc85de..0815186c 100644
--- a/.github/actions/go-licenses/action.yml
+++ b/.github/actions/go-licenses/action.yml
@@ -90,7 +90,7 @@ runs:
       run: git config --global "url.https://${GH_ACCESS_TOKEN}@github.com/.insteadOf" https://github.com/
 
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version-file: ${{ inputs.go-version-file }}
 
diff --git a/.github/actions/govulncheck/action.yml b/.github/actions/govulncheck/action.yml
index 8186ca44..49ef74ce 100644
--- a/.github/actions/govulncheck/action.yml
+++ b/.github/actions/govulncheck/action.yml
@@ -63,7 +63,7 @@ runs:
         git config --global url."https://${GH_ACCESS_TOKEN}@github.com/".insteadOf "https://github.com/"
 
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version-file: ${{ inputs.go-version-file }}
 
@@ -88,7 +88,7 @@ runs:
         steps.govulncheck.conclusion == 'failure' &&
         inputs.notify == 'true' &&
         github.event_name == 'schedule'
-      uses: loft-sh/github-actions/.github/actions/ci-test-notify@85d7023c5749421d369f59430c7849f2d00ad694 # ci-test-notify/v1
+      uses: loft-sh/github-actions/.github/actions/ci-test-notify@5bee69a81632d51d940c19d849f628479e55f3da # ci-test-notify/v1
       with:
         test-name: ${{ inputs.test-name }}
         status: failure
diff --git a/.github/actions/linear-pr-commenter/action.yml b/.github/actions/linear-pr-commenter/action.yml
index 1f91bca7..4ebeb8ad 100644
--- a/.github/actions/linear-pr-commenter/action.yml
+++ b/.github/actions/linear-pr-commenter/action.yml
@@ -22,12 +22,12 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         persist-credentials: false
 
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
       with:
         go-version-file: ${{ github.action_path }}/src/go.mod
 
diff --git a/.github/actions/link-backport-prs/action.yml b/.github/actions/link-backport-prs/action.yml
index 1e0c0338..1f1da78c 100644
--- a/.github/actions/link-backport-prs/action.yml
+++ b/.github/actions/link-backport-prs/action.yml
@@ -36,7 +36,7 @@ runs:
   using: 'composite'
   steps:
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version-file: ${{ github.action_path }}/src/go.mod
 
diff --git a/.github/actions/prerelease-setup/action.yml b/.github/actions/prerelease-setup/action.yml
index e3bbb410..cfa7c385 100644
--- a/.github/actions/prerelease-setup/action.yml
+++ b/.github/actions/prerelease-setup/action.yml
@@ -48,7 +48,7 @@ runs:
         tool-cache: false
 
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         # The test code only reads from the working tree (go build, ginkgo
         # discovery). No subsequent push/fetch needs the embedded token, so
@@ -56,7 +56,7 @@ runs:
         persist-credentials: false
 
     - name: Setup Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version-file: go.mod
         cache: true
@@ -65,10 +65,10 @@ runs:
       uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
 
     - name: Setup helm
-      uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
     - name: AWS Login
-      uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         role-to-assume: arn:aws:iam::084374023943:role/e2e-test-executor
         role-session-name: ${{ inputs.role-session-name }}
diff --git a/.github/actions/promote-release/action.yml b/.github/actions/promote-release/action.yml
index 2edc73ef..1cff8963 100644
--- a/.github/actions/promote-release/action.yml
+++ b/.github/actions/promote-release/action.yml
@@ -133,7 +133,7 @@ runs:
     # two modes get their own step.
     - name: Log in to GHCR
       if: inputs.dry-run != 'true'
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: ghcr.io
         username: ${{ inputs.docker-username }}
@@ -146,7 +146,7 @@ runs:
       id: ghcr-login-rehearsal
       if: inputs.dry-run == 'true'
       continue-on-error: true
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: ghcr.io
         username: ${{ inputs.docker-username }}
diff --git a/.github/actions/publish-helm-chart/action.yml b/.github/actions/publish-helm-chart/action.yml
index 19165e19..18909d0c 100644
--- a/.github/actions/publish-helm-chart/action.yml
+++ b/.github/actions/publish-helm-chart/action.yml
@@ -51,7 +51,7 @@ runs:
   using: "composite"
   steps:
     - name: Set up Helm
-      uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
         version: ${{ inputs.helm-version }}
 
diff --git a/.github/actions/release-notification/action.yml b/.github/actions/release-notification/action.yml
index ba4555d5..a3542b72 100644
--- a/.github/actions/release-notification/action.yml
+++ b/.github/actions/release-notification/action.yml
@@ -108,7 +108,7 @@ runs:
       run: bash "${{ github.action_path }}/resolve-release-text.sh"
     - name: Post release notification
       if: inputs.status == 'success' && inputs.dry-run != 'true'
-      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c  # v3.0.3
+      uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc  # v3.0.5
       with:
         errors: true
         webhook-type: incoming-webhook
@@ -166,7 +166,7 @@ runs:
         esac
     - name: Post release failure notification
       if: inputs.status != 'success' && inputs.dry-run != 'true'
-      uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c  # v3.0.3
+      uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc  # v3.0.5
       with:
         errors: true
         webhook-type: incoming-webhook
diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index ec4f7b92..85f8bff5 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -20,13 +20,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout # zizmor: ignore[artipacked] -- reviewdog needs git credentials for local diff fallback on large PRs
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
 
       - name: Get changed workflow files
         id: changed-files
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           filters: |
             workflows:
@@ -35,7 +35,7 @@ jobs:
 
       - name: Run actionlint with reviewdog
         if: steps.changed-files.outputs.workflows == 'true'
-        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0
+        uses: reviewdog/action-actionlint@dbe5299849118fd6f099ba563d263d770955a64a # v1.73.2
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           reporter: ${{ inputs.reporter }}
diff --git a/.github/workflows/ai-pr-review.yaml b/.github/workflows/ai-pr-review.yaml
index 0234c4a6..ebeba73b 100644
--- a/.github/workflows/ai-pr-review.yaml
+++ b/.github/workflows/ai-pr-review.yaml
@@ -51,7 +51,7 @@ jobs:
       issues: write
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: loft-sh/github-actions
           ref: main
diff --git a/.github/workflows/auto-approve-bot-prs.yaml b/.github/workflows/auto-approve-bot-prs.yaml
index 52aa26d5..96325d5d 100644
--- a/.github/workflows/auto-approve-bot-prs.yaml
+++ b/.github/workflows/auto-approve-bot-prs.yaml
@@ -57,7 +57,7 @@ jobs:
     # reporting a hard red check on caller CI.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: loft-sh/github-actions
           ref: main
diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml
index ef8e8a34..a55914ed 100644
--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -63,13 +63,13 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
 
       - name: Backport Action
         uses: sorenlouv/backport-github-action@9460b7102fea25466026ce806c9ebf873ac48721 # v11.0.0
@@ -164,7 +164,7 @@ jobs:
         target: ${{ fromJSON(needs.legacy-classify.outputs.targets) }}
     steps:
       - name: Checkout monorepo at the merged commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # Pin to the merge commit so it AND its parent (the diff base) are
           # present locally; on a pull_request_target closed event the default
@@ -174,7 +174,7 @@ jobs:
           persist-credentials: false
 
       - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
 
       - name: Backport to ${{ matrix.target }}
         id: backport
diff --git a/.github/workflows/check-docs.yaml b/.github/workflows/check-docs.yaml
index 79dda4a7..62f66b9e 100644
--- a/.github/workflows/check-docs.yaml
+++ b/.github/workflows/check-docs.yaml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - run: make check-docs
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index ab65c907..efb0006c 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -13,12 +13,12 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: loft-sh/github-actions/.github/workflows/validate-renovate.yaml@53686d2452bc48398252887a37ad248c38a7f1eb # validate-renovate/v1
+    uses: loft-sh/github-actions/.github/workflows/validate-renovate.yaml@c40c1db6d6d24f1b75f6db794efe3a1bbf7cfb1a # validate-renovate/v1
 
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca  # v1.7.12
@@ -26,7 +26,7 @@ jobs:
   zizmor:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - run: pip install zizmor==1.24.1 && zizmor .github/
diff --git a/.github/workflows/claude-code-review.yaml b/.github/workflows/claude-code-review.yaml
index d76b64e0..aafe99c9 100644
--- a/.github/workflows/claude-code-review.yaml
+++ b/.github/workflows/claude-code-review.yaml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
@@ -51,7 +51,7 @@ jobs:
           git checkout -B "${PR_HEAD_REF}" "origin/${PR_HEAD_REF}"
 
       - name: Claude Code Review
-        uses: anthropics/claude-code-action@f4fb5c6cdccc1ee7af63692f5d08d56efaa64cc8 # v1
+        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c # v1
         with:
           anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/claude.yaml b/.github/workflows/claude.yaml
index a19dbcb9..edcf5ddd 100644
--- a/.github/workflows/claude.yaml
+++ b/.github/workflows/claude.yaml
@@ -20,13 +20,13 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 1
           persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@f4fb5c6cdccc1ee7af63692f5d08d56efaa64cc8 # v1
+        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c # v1
         with:
           anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 790362f4..c4ad70e6 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -26,14 +26,14 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 1
           persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@f4fb5c6cdccc1ee7af63692f5d08d56efaa64cc8 # v1
+        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # zizmor: ignore[secrets-outside-env] -- OAuth token for Claude, no dedicated environment needed
 
diff --git a/.github/workflows/cleanup-head-charts.yaml b/.github/workflows/cleanup-head-charts.yaml
index 7484c70b..d384ea52 100644
--- a/.github/workflows/cleanup-head-charts.yaml
+++ b/.github/workflows/cleanup-head-charts.yaml
@@ -46,7 +46,7 @@ jobs:
           # checkout against loft-sh/github-actions fails with `upload-pack:
           # not our ref`. Parse workflow_ref (owner/repo/path@ref) instead.
           echo "ref=${WORKFLOW_REF##*@}" >> "${GITHUB_OUTPUT}"
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: loft-sh/github-actions
           ref: ${{ steps.wref.outputs.ref }}
diff --git a/.github/workflows/conflict-check.yaml b/.github/workflows/conflict-check.yaml
index 2fbe10db..d3f95a3e 100644
--- a/.github/workflows/conflict-check.yaml
+++ b/.github/workflows/conflict-check.yaml
@@ -21,7 +21,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/detect-changes.yaml b/.github/workflows/detect-changes.yaml
index a236d139..8e73330e 100644
--- a/.github/workflows/detect-changes.yaml
+++ b/.github/workflows/detect-changes.yaml
@@ -22,13 +22,13 @@ jobs:
       has_changed: ${{ steps.set-output.outputs.has_changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: true # paths-filter needs credentials to fetch the base commit on push events
 
       - name: Filter paths
         id: filter
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d  # v4.0.3
         with:
           base: ${{ github.event_name == 'push' && github.event.before || '' }}
           filters: |
diff --git a/.github/workflows/notify-release.yaml b/.github/workflows/notify-release.yaml
index 2f776098..cee13c58 100644
--- a/.github/workflows/notify-release.yaml
+++ b/.github/workflows/notify-release.yaml
@@ -94,7 +94,7 @@ jobs:
           echo "All required inputs are valid"
       - name: Checkout repository
         if: ${{ !inputs.dry-run && inputs.status == 'success' }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: ${{ inputs.target_repo }}
           ref: ${{ inputs.ref || github.ref }}
diff --git a/.github/workflows/release-linear-release-sync.yaml b/.github/workflows/release-linear-release-sync.yaml
index 55b12a61..6c9cb6cb 100644
--- a/.github/workflows/release-linear-release-sync.yaml
+++ b/.github/workflows/release-linear-release-sync.yaml
@@ -17,11 +17,11 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
           go-version-file: .github/actions/linear-release-sync/src/go.mod
           cache: false
diff --git a/.github/workflows/test-ai-pr-review.yaml b/.github/workflows/test-ai-pr-review.yaml
index 9caf053b..acc7042d 100644
--- a/.github/workflows/test-ai-pr-review.yaml
+++ b/.github/workflows/test-ai-pr-review.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-ai-step.yaml b/.github/workflows/test-ai-step.yaml
index be4ad338..fdfbca9c 100644
--- a/.github/workflows/test-ai-step.yaml
+++ b/.github/workflows/test-ai-step.yaml
@@ -26,7 +26,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
@@ -43,7 +43,7 @@ jobs:
     name: Live smoke (${{ inputs.provider }}, ${{ inputs.effort }})
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/test-auto-approve-bot-prs.yaml b/.github/workflows/test-auto-approve-bot-prs.yaml
index 6e69a2ca..c1ca82f9 100644
--- a/.github/workflows/test-auto-approve-bot-prs.yaml
+++ b/.github/workflows/test-auto-approve-bot-prs.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
@@ -37,7 +37,7 @@ jobs:
       checks: read
       statuses: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: ./.github/actions/auto-approve-bot-prs
diff --git a/.github/workflows/test-aws-test-infra.yaml b/.github/workflows/test-aws-test-infra.yaml
index ac9349cd..ee27f801 100644
--- a/.github/workflows/test-aws-test-infra.yaml
+++ b/.github/workflows/test-aws-test-infra.yaml
@@ -15,10 +15,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
           go-version-file: .github/actions/aws-test-infra/src/go.mod
       - name: Run tests
@@ -34,7 +34,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-backport-legacy-allowlist.yaml b/.github/workflows/test-backport-legacy-allowlist.yaml
index 42cb36d0..11df4d29 100644
--- a/.github/workflows/test-backport-legacy-allowlist.yaml
+++ b/.github/workflows/test-backport-legacy-allowlist.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-backport-legacy-split.yaml b/.github/workflows/test-backport-legacy-split.yaml
index eaad1883..88acb512 100644
--- a/.github/workflows/test-backport-legacy-split.yaml
+++ b/.github/workflows/test-backport-legacy-split.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-ci-test-notify.yaml b/.github/workflows/test-ci-test-notify.yaml
index b7cb6547..f4ef0406 100644
--- a/.github/workflows/test-ci-test-notify.yaml
+++ b/.github/workflows/test-ci-test-notify.yaml
@@ -12,7 +12,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-cleanup-head-charts.yaml b/.github/workflows/test-cleanup-head-charts.yaml
index c533d834..3e310ae5 100644
--- a/.github/workflows/test-cleanup-head-charts.yaml
+++ b/.github/workflows/test-cleanup-head-charts.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-commitlint.yaml b/.github/workflows/test-commitlint.yaml
index b00d117b..7ba57ef4 100644
--- a/.github/workflows/test-commitlint.yaml
+++ b/.github/workflows/test-commitlint.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       # This action installs bats, it does not run anything. It has no `tests`
@@ -33,7 +33,7 @@ jobs:
     name: Exercise the composite wiring
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # The range scenario below resolves HEAD~1, which the default
           # single-commit checkout does not have.
diff --git a/.github/workflows/test-cve-scan.yaml b/.github/workflows/test-cve-scan.yaml
index 2ace2dc5..1321a547 100644
--- a/.github/workflows/test-cve-scan.yaml
+++ b/.github/workflows/test-cve-scan.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
@@ -36,7 +36,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/test-go-licenses.yaml b/.github/workflows/test-go-licenses.yaml
index dd65dc7f..2ac4c7e8 100644
--- a/.github/workflows/test-go-licenses.yaml
+++ b/.github/workflows/test-go-licenses.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-govulncheck.yaml b/.github/workflows/test-govulncheck.yaml
index 828ae5c5..05cc5963 100644
--- a/.github/workflows/test-govulncheck.yaml
+++ b/.github/workflows/test-govulncheck.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-linear-pr-commenter.yaml b/.github/workflows/test-linear-pr-commenter.yaml
index f84e16c2..111642cd 100644
--- a/.github/workflows/test-linear-pr-commenter.yaml
+++ b/.github/workflows/test-linear-pr-commenter.yaml
@@ -15,10 +15,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
           go-version-file: .github/actions/linear-pr-commenter/src/go.mod
       - run: go test ./...
diff --git a/.github/workflows/test-linear-release-sync.yaml b/.github/workflows/test-linear-release-sync.yaml
index ad209480..c71f96d1 100644
--- a/.github/workflows/test-linear-release-sync.yaml
+++ b/.github/workflows/test-linear-release-sync.yaml
@@ -15,10 +15,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
           go-version-file: .github/actions/linear-release-sync/src/go.mod
       - name: Run tests
diff --git a/.github/workflows/test-link-backport-prs.yaml b/.github/workflows/test-link-backport-prs.yaml
index 689dae1c..d23a358e 100644
--- a/.github/workflows/test-link-backport-prs.yaml
+++ b/.github/workflows/test-link-backport-prs.yaml
@@ -18,10 +18,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: .github/actions/link-backport-prs/src/go.mod
       - run: go test ./...
diff --git a/.github/workflows/test-oss-commit-sync.yaml b/.github/workflows/test-oss-commit-sync.yaml
index 63e4a262..bf283ca8 100644
--- a/.github/workflows/test-oss-commit-sync.yaml
+++ b/.github/workflows/test-oss-commit-sync.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-parse-label-filter.yaml b/.github/workflows/test-parse-label-filter.yaml
index 443acbc2..86878089 100644
--- a/.github/workflows/test-parse-label-filter.yaml
+++ b/.github/workflows/test-parse-label-filter.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
@@ -25,7 +25,7 @@ jobs:
     name: Composite smoke (parse + skip decision)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/test-prerelease-setup.yaml b/.github/workflows/test-prerelease-setup.yaml
index 7851c758..2c3cf0da 100644
--- a/.github/workflows/test-prerelease-setup.yaml
+++ b/.github/workflows/test-prerelease-setup.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-promote-release.yaml b/.github/workflows/test-promote-release.yaml
index e4790f8b..62471350 100644
--- a/.github/workflows/test-promote-release.yaml
+++ b/.github/workflows/test-promote-release.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
@@ -24,7 +24,7 @@ jobs:
   smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - name: Exercise local composite promote-self wiring
diff --git a/.github/workflows/test-publish-helm-chart.yaml b/.github/workflows/test-publish-helm-chart.yaml
index 811ddf24..50f5b24a 100644
--- a/.github/workflows/test-publish-helm-chart.yaml
+++ b/.github/workflows/test-publish-helm-chart.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
diff --git a/.github/workflows/test-release-branch-freeze.yaml b/.github/workflows/test-release-branch-freeze.yaml
index 81c3774f..dd56bca0 100644
--- a/.github/workflows/test-release-branch-freeze.yaml
+++ b/.github/workflows/test-release-branch-freeze.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-release-notification.yaml b/.github/workflows/test-release-notification.yaml
index 4fc52c05..64debc84 100644
--- a/.github/workflows/test-release-notification.yaml
+++ b/.github/workflows/test-release-notification.yaml
@@ -18,7 +18,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
@@ -33,7 +33,7 @@ jobs:
   smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - name: Exercise local composite input wiring
diff --git a/.github/workflows/test-repository-dispatch.yaml b/.github/workflows/test-repository-dispatch.yaml
index 625b6b67..a4ed6186 100644
--- a/.github/workflows/test-repository-dispatch.yaml
+++ b/.github/workflows/test-repository-dispatch.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-run-ginkgo.yaml b/.github/workflows/test-run-ginkgo.yaml
index 868dbc48..1ab526e5 100644
--- a/.github/workflows/test-run-ginkgo.yaml
+++ b/.github/workflows/test-run-ginkgo.yaml
@@ -12,7 +12,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
@@ -23,10 +23,10 @@ jobs:
     name: Run focus selection tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: .github/actions/run-ginkgo/test/focus/go.mod
       - run: go test -count=1 ./...
diff --git a/.github/workflows/test-semver-validation.yaml b/.github/workflows/test-semver-validation.yaml
index 93ad14a1..be68e7ec 100644
--- a/.github/workflows/test-semver-validation.yaml
+++ b/.github/workflows/test-semver-validation.yaml
@@ -15,10 +15,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38  # v6.5.0
         with:
           node-version: '24'
       - run: npm ci
diff --git a/.github/workflows/test-sticky-pr-comment.yaml b/.github/workflows/test-sticky-pr-comment.yaml
index ecb35cf0..af715cca 100644
--- a/.github/workflows/test-sticky-pr-comment.yaml
+++ b/.github/workflows/test-sticky-pr-comment.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
@@ -28,7 +28,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/test-subtree-mirror.yaml b/.github/workflows/test-subtree-mirror.yaml
index 1518c297..4117494e 100644
--- a/.github/workflows/test-subtree-mirror.yaml
+++ b/.github/workflows/test-subtree-mirror.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-vcluster-release.yaml b/.github/workflows/test-vcluster-release.yaml
index 66259cd2..90ba1e21 100644
--- a/.github/workflows/test-vcluster-release.yaml
+++ b/.github/workflows/test-vcluster-release.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/test-wait-for-release.yaml b/.github/workflows/test-wait-for-release.yaml
index 7dabde28..c3a2e1f6 100644
--- a/.github/workflows/test-wait-for-release.yaml
+++ b/.github/workflows/test-wait-for-release.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
diff --git a/.github/workflows/validate-renovate.yaml b/.github/workflows/validate-renovate.yaml
index cffac812..3c3ae66e 100644
--- a/.github/workflows/validate-renovate.yaml
+++ b/.github/workflows/validate-renovate.yaml
@@ -12,13 +12,13 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Get changed Renovate config files
         id: changed-files
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           filters: |
             renovate: