chore(ci): bump the github-actions group across 1 directory with 5 updates

.github/workflows/ci-attest-gc.yml

@@ -20,5 +20,5 @@ jobs:
     name: Prune
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: scripts/ci/ci.sh gc "${{ github.event.inputs.days || 30 }}"

.github/workflows/claude-code-review.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 

.github/workflows/claude.yml

@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 

.github/workflows/cli-release.yml

@@ -43,10 +43,10 @@ jobs:
       env:
         CABAL_DIR: /root/.cabal
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Cache dist-newstyle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: dist-newstyle
           key: cli-linux-${{ matrix.arch }}-${{ hashFiles('cli/*.cabal', 'shared/*.cabal', 'cabal.project*') }}-${{ github.sha }}
@@ -89,7 +89,7 @@ jobs:
           - arch: x86_64
             runner: macos-15-intel
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Read GHC version from cabal.project
         id: ghc
@@ -102,14 +102,14 @@ jobs:
           cabal-version: '3.14'
 
       - name: Cache Cabal
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cabal
           key: cli-macos-${{ matrix.arch }}-cabal-${{ hashFiles('cli/*.cabal', 'shared/*.cabal', 'cabal.project*') }}
           restore-keys: cli-macos-${{ matrix.arch }}-cabal-
 
       - name: Cache dist-newstyle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: dist-newstyle
           key: cli-macos-${{ matrix.arch }}-dist-${{ hashFiles('cli/*.cabal', 'shared/*.cabal', 'cabal.project*') }}
@@ -156,7 +156,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Download all artifacts
         uses: actions/download-artifact@v8

.github/workflows/deps-image.yml

@@ -29,7 +29,7 @@ jobs:
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Free Disk Space
         run: |
@@ -40,7 +40,7 @@ jobs:
           sudo docker image prune --all --force
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Container Registry
         uses: docker/login-action@v4
@@ -50,7 +50,7 @@ jobs:
           password: ${{ secrets.GH_TOKEN }}
 
       - name: Build and push platform image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.deps

.github/workflows/fourmolu.yml

@@ -14,13 +14,13 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       # `make fmt` downloads the version the Makefile pins, so laptops and this bot agree.
       - name: Cache fourmolu
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .ci/fourmolu-*
           key: fourmolu-${{ hashFiles('Makefile') }}

.github/workflows/haskell.yml

@@ -34,7 +34,7 @@ jobs:
       skip_e2e: ${{ steps.checks.outputs.skip_e2e }}
       skip_haskell: ${{ steps.haskell.outputs.skip_all }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: checks
         run: scripts/ci/ci.sh gate
       # Whether the whole container job (image pull + service containers + cabal
@@ -49,10 +49,10 @@ jobs:
     if: needs.gate.outputs.skip_haskell != 'true'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -179,10 +179,10 @@ jobs:
       CI_SHARDS: '4'
       CI_FINGERPRINTS: .ci/fingerprints.tsv
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Cache dist-newstyle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: dist-newstyle
           key: ${{ runner.os }}-container-cabal-${{ hashFiles('**/*.cabal', '**/cabal.project*') }}-${{ github.sha }}
@@ -302,8 +302,8 @@ jobs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-buildx-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
       - uses: docker/login-action@v4
         with:
           registry: ghcr.io
@@ -372,8 +372,8 @@ jobs:
     name: Release regression tests
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
       - run: scripts/ci/ci.sh run release-tests

.github/workflows/production-image.yml

@@ -24,25 +24,25 @@ jobs:
     outputs:
       digest: ${{ steps.image.outputs.digest }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.revision }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
       # The Dockerfile's dist-newstyle cache mount dies with each fresh runner, so every
       # build recompiled all of monoscope (~57 min). Carry it in the Actions cache: master
       # saves, PRs restore master's and stay read-only so they can't evict it. Paths sit
       # outside the checkout because release.sh refuses a dirty tree.
       - if: github.ref == 'refs/heads/master'
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ${{ runner.temp }}/dist-newstyle
           key: prod-dist-${{ inputs.revision }}
           restore-keys: prod-dist-
       - if: github.ref != 'refs/heads/master'
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: ${{ runner.temp }}/dist-newstyle
           key: prod-dist-${{ inputs.revision }}

.github/workflows/pullrequest.yml

@@ -36,7 +36,7 @@ jobs:
       skip_e2e: ${{ steps.checks.outputs.skip_e2e }}
       skip_haskell: ${{ steps.haskell.outputs.skip_all }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - id: checks
@@ -53,12 +53,12 @@ jobs:
     if: needs.gate.outputs.skip_haskell != 'true'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -189,12 +189,12 @@ jobs:
       CI_SHARDS: '4'
       CI_FINGERPRINTS: .ci/fingerprints.tsv
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Cache dist-newstyle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: dist-newstyle
           key: ${{ runner.os }}-container-cabal-${{ hashFiles('**/*.cabal', '**/cabal.project*') }}-${{ github.sha }}
@@ -282,7 +282,7 @@ jobs:
       # Pin to the PR head SHA instead of head_ref: head_ref is the branch name,
       # which checkout fetches with a glob refspec that 404s on deleted or fork
       # branches (see i18n-yaml PR fetch failure).
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -329,11 +329,11 @@ jobs:
     if: needs.gate.outputs.skip_ui_tests != 'true'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -362,10 +362,10 @@ jobs:
     name: Release regression tests
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
       - run: scripts/ci/ci.sh run release-tests