From 4d6fd3a018d20aee6472e996bde126b62730c7de Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 19:03:11 +0000
Subject: [PATCH] ci: bump gradle/actions from 4 to 6

Bumps [gradle/actions](https://github.com/gradle/actions) from 4 to 6.
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](https://github.com/gradle/actions/compare/v4...v6)

---
updated-dependencies:
- dependency-name: gradle/actions
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ci.yml      | 10 +++++-----
 .github/workflows/fuzz.yml    |  2 +-
 .github/workflows/release.yml |  2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 86d3087..cc03b64 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ jobs:
           java-version: ${{ matrix.java }}
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       # `build` runs, in one command: compilation on the Java 25 baseline, the
       # tests, the JaCoCo floor on core (R-T16), the ArchUnit module rules
@@ -64,7 +64,7 @@ jobs:
         with:
           distribution: temurin
           java-version: '25'
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@v6
 
       # R-DOC6: an example that does not run is documentation of something that
       # used to work.
@@ -83,7 +83,7 @@ jobs:
         with:
           distribution: temurin
           java-version: '25'
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@v6
 
       # The unit tests drive the command objects in-process, which is right for
       # covering edge cases and cannot catch the things that only go wrong once
@@ -190,7 +190,7 @@ jobs:
         with:
           distribution: temurin
           java-version: '25'
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@v6
 
       # R-P2. The constrained heap is the assertion: a 1 GB file is roughly nine
       # million records, and anything on the read path retaining per-record
@@ -221,7 +221,7 @@ jobs:
         with:
           distribution: temurin
           java-version: '25'
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@v6
 
       # R-0.1, risk R2: the descriptor loader refuses `verified: true` below two
       # cited sources, and this task exercises every bundled descriptor through
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 590a617..0696db9 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -31,7 +31,7 @@ jobs:
           distribution: temurin
           java-version: '25'
 
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@v6
 
       # A fuzzer that starts from nothing every night re-derives the same
       # shallow inputs every night. Restoring the corpus is what lets each run
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7fa23de..3a80122 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,7 +72,7 @@ jobs:
           distribution: temurin
           java-version: '25'
 
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@v6
 
       # The full gate, on the release artefacts themselves. A release that
       # skipped the checks would be a release nobody had checked.