From 3e233f13fd12292973e7ed2dec627fc0c7f149ba Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 21:16:20 +0000
Subject: [PATCH] chore(deps): bump the actions group across 1 directory with 3
 updates

Bumps the actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v7...v7.0.1)

Updates `ruby/setup-ruby` from 1.316.0 to 1.320.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](https://github.com/ruby/setup-ruby/compare/d45b1a4e94b71acab930e56e79c6aa188764e7f9...a30dfa457ad68707b8b910ac3a244714b61c0626)

Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.1
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/cef221092ed1bacb1cc03d23a2d87d1d172e277b...ba38be9e461d3875417946c167d0b5f3d385a247)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: ruby/setup-ruby
  dependency-version: 1.320.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/bench.yml               |  2 +-
 .github/workflows/ci.yml                  | 16 ++++++++--------
 .github/workflows/codeql.yml              |  2 +-
 .github/workflows/dco.yml                 |  2 +-
 .github/workflows/dependency-audit.yml    |  4 ++--
 .github/workflows/docs.yml                |  2 +-
 .github/workflows/perf-gate.yml           |  6 +++---
 .github/workflows/publish-node.yml        |  6 +++---
 .github/workflows/publish-ruby.yml        |  8 ++++----
 .github/workflows/publish-translit-rs.yml |  4 ++--
 .github/workflows/publish.yml             | 14 +++++++-------
 .github/workflows/secret-scan.yml         |  2 +-
 .github/workflows/tier3.yml               |  2 +-
 13 files changed, 35 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 280acde8..9b5656f3 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -25,7 +25,7 @@ jobs:
     name: Benchmarks (smoke test)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7e3aff22..a6c69e6c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
       ruby: ${{ steps.filter.outputs.ruby }}
       node: ${{ steps.filter.outputs.node }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706  # v4.0.2
         id: filter
         with:
@@ -77,7 +77,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
         with:
@@ -178,7 +178,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-python@v6
         with:
@@ -225,7 +225,7 @@ jobs:
     if: needs.changes.outputs.code == 'true' || needs.changes.outputs.docs == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-python@v6
         with:
@@ -280,7 +280,7 @@ jobs:
       BUNDLE_GEMFILE: ${{ github.workspace }}/bindings/ruby/Gemfile
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Build the binding against the in-repo core (#374 drift gate)
         # The ext pins the core as a REGISTRY dep (version = "0.10") so the
@@ -350,7 +350,7 @@ jobs:
       run:
         working-directory: bindings/node
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Build the binding against the in-repo core (#374 drift gate)
         # Never committed: a relative-path patch would break the napi prebuild
@@ -406,7 +406,7 @@ jobs:
     name: Cargo audit (RustSec)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
 
@@ -427,7 +427,7 @@ jobs:
     name: Cargo deny (supply-chain)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index eb70bea4..f59596b1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,7 +32,7 @@ jobs:
         # Rust analysis excluded: CodeQL's Rust support is limited and
         # cargo clippy (in ci.yml) catches more issues with zero false positives.
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index 2f4c9687..85170cd8 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -18,7 +18,7 @@ jobs:
     name: DCO sign-off
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index 655edf5e..f226c488 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -19,7 +19,7 @@ jobs:
     name: Audit every manifest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-python@v6
         with:
@@ -46,7 +46,7 @@ jobs:
         working-directory: bindings/node
         run: npm ci --ignore-scripts
 
-      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1
+      - uses: ruby/setup-ruby@a30dfa457ad68707b8b910ac3a244714b61c0626 # v1
         with:
           ruby-version: "3.3"
       - name: Install Ruby binding deps
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 0843f543..e78a76e5 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -37,7 +37,7 @@ jobs:
       deployments: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
diff --git a/.github/workflows/perf-gate.yml b/.github/workflows/perf-gate.yml
index 889f9bce..f0862b99 100644
--- a/.github/workflows/perf-gate.yml
+++ b/.github/workflows/perf-gate.yml
@@ -42,7 +42,7 @@ jobs:
     outputs:
       perf: ${{ steps.f.outputs.perf }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - id: f
@@ -75,7 +75,7 @@ jobs:
             echo "::notice::No perf-relevant changes — gate trivially satisfied (required-check shim)."
           fi
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         if: needs.changes.outputs.perf == 'true'
         with:
           fetch-depth: 0 # need the merge-base and both code versions (V12)
@@ -134,7 +134,7 @@ jobs:
     permissions:
       contents: write # append to the perf-results branch (V19)
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/publish-node.yml b/.github/workflows/publish-node.yml
index 23bb293a..1df1bb5f 100644
--- a/.github/workflows/publish-node.yml
+++ b/.github/workflows/publish-node.yml
@@ -40,7 +40,7 @@ jobs:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Poll the crates.io sparse index for the target core version
         # `working-directory: bindings/node` comes from the workflow-level defaults,
         # so `Cargo.toml` is the node binding's manifest.
@@ -87,7 +87,7 @@ jobs:
           - host: windows-latest
             target: x86_64-pc-windows-msvc
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Build against the in-repo core on non-publish events (#374 drift gate)
         # On a push to main, the PUBLISHED core can lag the binding: a pre-release
@@ -161,7 +161,7 @@ jobs:
       # OIDC for npm provenance / trusted publishing — no long-lived token.
       id-token: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
diff --git a/.github/workflows/publish-ruby.yml b/.github/workflows/publish-ruby.yml
index d454b723..3b4c4b74 100644
--- a/.github/workflows/publish-ruby.yml
+++ b/.github/workflows/publish-ruby.yml
@@ -45,7 +45,7 @@ jobs:
       run:
         working-directory: bindings/ruby
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Build against the in-repo core on non-publish events (#374 drift gate)
         # On a PR or a push to main, the PUBLISHED core can lag the binding: a
@@ -93,7 +93,7 @@ jobs:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Poll the crates.io sparse index for the target core version
         # This job has no working-directory default, so the manifest is referenced
         # by full path — the extension crate's, not the gem-root workspace.
@@ -129,7 +129,7 @@ jobs:
           - arm64-darwin
           - x64-mingw-ucrt
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: oxidize-rb/actions/setup-ruby-and-rust@e5f9a49a7812a078584072f6e3f657ad247c8771 # v1
         with:
           ruby-version: "3.3"
@@ -179,7 +179,7 @@ jobs:
           pattern: cross-gem-*
           merge-multiple: true
           path: pkg
-      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1
+      - uses: ruby/setup-ruby@a30dfa457ad68707b8b910ac3a244714b61c0626 # v1
         with:
           ruby-version: "3.3"
       - name: Configure RubyGems credentials (OIDC trusted publishing)
diff --git a/.github/workflows/publish-translit-rs.yml b/.github/workflows/publish-translit-rs.yml
index f95a79a9..22c88696 100644
--- a/.github/workflows/publish-translit-rs.yml
+++ b/.github/workflows/publish-translit-rs.yml
@@ -28,7 +28,7 @@ jobs:
       contents: read   # job-level perms replace workflow-level; checkout needs this
       id-token: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -39,6 +39,6 @@ jobs:
       - name: List artifacts
         run: ls -lh dist/
       - name: Publish to PyPI (translit-rs)
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # release/v1
         with:
           skip-existing: true
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 33dfe03e..5840a447 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: tier3
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -53,7 +53,7 @@ jobs:
       matrix:
         target: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -87,7 +87,7 @@ jobs:
           - target: aarch64-apple-darwin
             runner: macos-14
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -106,7 +106,7 @@ jobs:
     runs-on: windows-latest
     needs: tier3
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -156,7 +156,7 @@ jobs:
           fi
           echo "OK: Linux wheels are abi3 (cp3XX-abi3), no version-specific CPython wheels."
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # release/v1
         with:
           skip-existing: true
           # PEP 740 provenance: generate + upload a signed attestation for every
@@ -177,7 +177,7 @@ jobs:
     # environment-scoped job, so this needs no per-environment secret setup.
     environment: crates-io
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
 
@@ -212,7 +212,7 @@ jobs:
       # SHA-pin every action in the provenance path (a supply-chain job must not
       # trust mutable tags) and pin the SBOM generator version for reproducible,
       # non-breaking release output.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
       - name: Generate Cargo.lock
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index cf999ea8..ed983f3f 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -16,7 +16,7 @@ jobs:
     name: Detect secrets
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/tier3.yml b/.github/workflows/tier3.yml
index 6433ae7c..5a63a18b 100644
--- a/.github/workflows/tier3.yml
+++ b/.github/workflows/tier3.yml
@@ -29,7 +29,7 @@ jobs:
     name: Tier 3 (exhaustive + formal)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: actions/setup-python@v6
         with: