chore(deps): bump the actions group across 1 directory with 13 updates

.github/workflows/actionlint.yml

@@ -35,7 +35,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Run actionlint
         uses: raven-actions/actionlint@v2

.github/workflows/anomaly-to-issue.yml

@@ -40,10 +40,10 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         env:
           ANOMALY_DIR: ${{ inputs.anomaly-dir }}
           README_NAME: ${{ inputs.readme-filename }}

.github/workflows/anomaly-triage.yml

@@ -65,13 +65,13 @@ jobs:
       issues: write
     steps:
       - name: Checkout PR head
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
       - name: Triage anomalies
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           ANOMALIES_PATH: ${{ inputs.anomalies-path }}
           DEFAULT_DOWNSTREAM: ${{ inputs.default-downstream-repo }}
@@ -316,7 +316,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Run actionlint
         uses: raven-actions/actionlint@v2
         with:

.github/workflows/auto-merge-dependabot.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/branch-naming.yml

@@ -33,7 +33,7 @@ jobs:
     permissions:
       pull-requests: read
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         env:
           BRANCH_PATTERN: ${{ inputs.pattern }}
           ENFORCE: ${{ inputs.enforce }}

.github/workflows/changelog-fragment.yml

@@ -35,7 +35,7 @@ jobs:
       pull-requests: read
       contents: read
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         env:
           SRC_PREFIX: ${{ inputs.src-path-prefix }}
           FRAGMENT_DIR: ${{ inputs.fragment-dir }}

.github/workflows/dependency-review.yml

@@ -35,8 +35,8 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/dependency-review-action@v4
+      - uses: actions/checkout@v7
+      - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: ${{ inputs.fail-on-severity }}
           fail-on-scopes: ${{ inputs.fail-on-scopes }}

.github/workflows/doc-orphan-detector.yml

@@ -43,13 +43,13 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Full history + all branches so `origin/main...<branch>` diffs and
           # per-path commit timestamps are available for every branch.
           fetch-depth: 0
 
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         env:
           STALE_HOURS: ${{ inputs.stale-hours }}
           BASE_LABEL: ${{ inputs.base-label }}

.github/workflows/doc-policy-lint.yml

@@ -47,12 +47,12 @@ jobs:
       contents: read
     steps:
       - name: Check out caller repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Check out github-workflows for doc-policy helper scripts
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ArchonVII/github-workflows
           ref: ${{ inputs.workflow-library-ref }}

.github/workflows/go-ci.yml

@@ -89,9 +89,9 @@ jobs:
         os: ${{ fromJSON(inputs.os-matrix) }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go }}
           cache: ${{ inputs.cache }}

.github/workflows/labeler.yml

@@ -24,7 +24,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v6
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           sync-labels: ${{ inputs.sync-labels }}

.github/workflows/lock-threads.yml

@@ -33,7 +33,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@v6
         with:
           issue-inactive-days: ${{ inputs.issue-inactive-days }}
           pr-inactive-days: ${{ inputs.pr-inactive-days }}

.github/workflows/node-ci.yml

@@ -66,7 +66,7 @@ jobs:
         os: ${{ fromJSON(inputs.os-matrix) }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Detect package manager
         id: pm
@@ -163,12 +163,12 @@ jobs:
 
       - name: Set up pnpm
         if: steps.pm.outputs.manager == 'pnpm'
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: ${{ inputs.pnpm-version }}
           run_install: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: ${{ steps.pm.outputs.cache }}

.github/workflows/pr-body-autoinject.yml

@@ -29,7 +29,7 @@ jobs:
       pull-requests: write
       contents: read
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         env:
           DOC_EXT_LIST: ${{ inputs.doc-only-extensions }}
           DOC_PREFIXES: ${{ inputs.doc-only-path-prefixes }}

.github/workflows/pr-policy.yml

@@ -147,14 +147,14 @@ jobs:
       # (2026-05-20), finding M1.
       - name: Check out github-workflows for policy helper scripts
         if: github.event.pull_request.draft == false
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ArchonVII/github-workflows
           ref: ${{ inputs.workflow-library-ref }}
           path: __github-workflows__
 
       - name: Enforce ready-for-review PR policy
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           REQUIRE_LINKED_ISSUE: ${{ inputs.require-linked-issue }}
           REQUIRE_VERIFICATION_SECTION: ${{ inputs.require-verification-section }}
@@ -246,7 +246,7 @@ jobs:
       # ----------------------------------------------------------------------
       - name: Role separation check
         if: inputs.role-separation-warnings || inputs.enforce-role-separation
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           ENFORCE_ROLE_SEPARATION: ${{ inputs.enforce-role-separation }}
           ROLE_PROTECTED_PATHS: ${{ inputs.role-protected-paths }}
@@ -360,7 +360,7 @@ jobs:
       # update. The exemption lives upstream in the commit path.
       # ----------------------------------------------------------------------
       - name: Evidence check (warning-only by default)
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           DOC_EXT_LIST: ${{ inputs.doc-only-extensions }}
           DOC_PREFIXES: ${{ inputs.doc-only-path-prefixes }}
@@ -494,7 +494,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Run actionlint
         uses: raven-actions/actionlint@v2
         with:

.github/workflows/python-ci.yml

@@ -68,15 +68,15 @@ jobs:
         os: ${{ fromJSON(inputs.os-matrix) }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
 
       - name: Install uv
         if: inputs.use-uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
 
       - name: Install dependencies
         shell: bash

.github/workflows/repo-required-gate.yml

@@ -239,15 +239,15 @@ jobs:
       # `workflow-library-ref` (default v1) so parser+workflow are versioned
       # together.
       - name: Check out github-workflows for classifier script
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ArchonVII/github-workflows
           ref: ${{ inputs.workflow-library-ref }}
           path: __github-workflows__
 
       - name: Classify changed files
         id: detect
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           STACK: ${{ inputs.stack }}
           NODE_PATHS: ${{ inputs.node-paths }}
@@ -370,14 +370,14 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out github-workflows for PR contract validator
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ArchonVII/github-workflows
           ref: ${{ inputs.workflow-library-ref }}
           path: __github-workflows__
 
       - name: Enforce PR policy
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           BRANCH_PATTERN: ${{ inputs.branch-pattern }}
           REQUIRE_LINKED_ISSUE: ${{ inputs.require-linked-issue }}
@@ -505,7 +505,7 @@ jobs:
       # 2026-06-07 (ArchonVII/hudson-bend#43; #53).
       - name: Warn if the repo PR template can't pass the contract
         if: ${{ !cancelled() && github.event.pull_request.draft == false }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           WORKFLOW_LIBRARY_REF: ${{ inputs.workflow-library-ref }}
         with:
@@ -572,7 +572,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Run actionlint
         if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}
         uses: raven-actions/actionlint@v2
@@ -603,7 +603,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Validate check map
         shell: bash
         run: |
@@ -623,9 +623,9 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Dependency review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
           fail-on-scopes: runtime
@@ -690,9 +690,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ fromJSON(inputs.node-versions)[0] }}
 

.github/workflows/repo-update-log-fragment.yml

@@ -63,14 +63,14 @@ jobs:
       contents: read
     steps:
       - name: Check out github-workflows for ledger validator
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ArchonVII/github-workflows
           ref: ${{ inputs.workflow-library-ref }}
           path: __github-workflows__
 
       - name: Enforce repo update log fragment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           FRAGMENT_DIR: ${{ inputs.fragment-dir }}
           WORKFLOW_LIBRARY_REF: ${{ inputs.workflow-library-ref }}

.github/workflows/self-test.yml

@@ -29,9 +29,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/semantic-pr-title.yml

@@ -49,7 +49,7 @@ jobs:
     permissions:
       pull-requests: read
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/stale.yml

@@ -1,6 +1,6 @@
 name: Stale (reusable)
 
-# Auto-mark and auto-close stale issues and PRs. Wraps actions/stale@v9 so
+# Auto-mark and auto-close stale issues and PRs. Wraps actions/stale@v10 so
 # every consumer repo gets the same versioning and a consistent tone.
 #
 # Defaults are conservative: 60 days idle → marked stale, another 14 days
@@ -48,7 +48,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           days-before-stale: ${{ inputs.days-before-stale }}
           days-before-close: ${{ inputs.days-before-close }}