chore(deps): bump the actions group across 1 directory with 3 updates

.github/workflows/bench.yml

@@ -25,7 +25,7 @@ jobs:
     name: Benchmarks (smoke test)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
       ruby: ${{ steps.filter.outputs.ruby }}
       node: ${{ steps.filter.outputs.node }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706  # v4.0.2
         id: filter
         with:
@@ -77,7 +77,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
         with:
@@ -178,7 +178,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-python@v6
         with:
@@ -225,7 +225,7 @@ jobs:
     if: needs.changes.outputs.code == 'true' || needs.changes.outputs.docs == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-python@v6
         with:
@@ -280,7 +280,7 @@ jobs:
       BUNDLE_GEMFILE: ${{ github.workspace }}/bindings/ruby/Gemfile
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Build the binding against the in-repo core (#374 drift gate)
         # The ext pins the core as a REGISTRY dep (version = "0.10") so the
@@ -350,7 +350,7 @@ jobs:
       run:
         working-directory: bindings/node
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Build the binding against the in-repo core (#374 drift gate)
         # Never committed: a relative-path patch would break the napi prebuild
@@ -406,7 +406,7 @@ jobs:
     name: Cargo audit (RustSec)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
 
@@ -427,7 +427,7 @@ jobs:
     name: Cargo deny (supply-chain)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
 

.github/workflows/codeql.yml

@@ -32,7 +32,7 @@ jobs:
         # Rust analysis excluded: CodeQL's Rust support is limited and
         # cargo clippy (in ci.yml) catches more issues with zero false positives.
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/dco.yml

@@ -18,7 +18,7 @@ jobs:
     name: DCO sign-off
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/dependency-audit.yml

@@ -19,7 +19,7 @@ jobs:
     name: Audit every manifest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-python@v6
         with:
@@ -46,7 +46,7 @@ jobs:
         working-directory: bindings/node
         run: npm ci --ignore-scripts
 
-      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1
+      - uses: ruby/setup-ruby@a30dfa457ad68707b8b910ac3a244714b61c0626 # v1
         with:
           ruby-version: "3.3"
       - name: Install Ruby binding deps

.github/workflows/docs.yml

@@ -37,7 +37,7 @@ jobs:
       deployments: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"

.github/workflows/perf-gate.yml

@@ -42,7 +42,7 @@ jobs:
     outputs:
       perf: ${{ steps.f.outputs.perf }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - id: f
@@ -75,7 +75,7 @@ jobs:
             echo "::notice::No perf-relevant changes — gate trivially satisfied (required-check shim)."
           fi
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         if: needs.changes.outputs.perf == 'true'
         with:
           fetch-depth: 0 # need the merge-base and both code versions (V12)
@@ -134,7 +134,7 @@ jobs:
     permissions:
       contents: write # append to the perf-results branch (V19)
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/publish-node.yml

@@ -40,7 +40,7 @@ jobs:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Poll the crates.io sparse index for the target core version
         # `working-directory: bindings/node` comes from the workflow-level defaults,
         # so `Cargo.toml` is the node binding's manifest.
@@ -87,7 +87,7 @@ jobs:
           - host: windows-latest
             target: x86_64-pc-windows-msvc
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Build against the in-repo core on non-publish events (#374 drift gate)
         # On a push to main, the PUBLISHED core can lag the binding: a pre-release
@@ -161,7 +161,7 @@ jobs:
       # OIDC for npm provenance / trusted publishing — no long-lived token.
       id-token: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:

.github/workflows/publish-ruby.yml

@@ -45,7 +45,7 @@ jobs:
       run:
         working-directory: bindings/ruby
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Build against the in-repo core on non-publish events (#374 drift gate)
         # On a PR or a push to main, the PUBLISHED core can lag the binding: a
@@ -93,7 +93,7 @@ jobs:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Poll the crates.io sparse index for the target core version
         # This job has no working-directory default, so the manifest is referenced
         # by full path — the extension crate's, not the gem-root workspace.
@@ -129,7 +129,7 @@ jobs:
           - arm64-darwin
           - x64-mingw-ucrt
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: oxidize-rb/actions/setup-ruby-and-rust@e5f9a49a7812a078584072f6e3f657ad247c8771 # v1
         with:
           ruby-version: "3.3"
@@ -179,7 +179,7 @@ jobs:
           pattern: cross-gem-*
           merge-multiple: true
           path: pkg
-      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1
+      - uses: ruby/setup-ruby@a30dfa457ad68707b8b910ac3a244714b61c0626 # v1
         with:
           ruby-version: "3.3"
       - name: Configure RubyGems credentials (OIDC trusted publishing)

.github/workflows/publish-translit-rs.yml

@@ -28,7 +28,7 @@ jobs:
       contents: read   # job-level perms replace workflow-level; checkout needs this
       id-token: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -39,6 +39,6 @@ jobs:
       - name: List artifacts
         run: ls -lh dist/
       - name: Publish to PyPI (translit-rs)
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # release/v1
         with:
           skip-existing: true

.github/workflows/publish.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: tier3
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -53,7 +53,7 @@ jobs:
       matrix:
         target: [x86_64, aarch64]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -87,7 +87,7 @@ jobs:
           - target: aarch64-apple-darwin
             runner: macos-14
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -106,7 +106,7 @@ jobs:
     runs-on: windows-latest
     needs: tier3
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -156,7 +156,7 @@ jobs:
           fi
           echo "OK: Linux wheels are abi3 (cp3XX-abi3), no version-specific CPython wheels."
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # release/v1
         with:
           skip-existing: true
           # PEP 740 provenance: generate + upload a signed attestation for every
@@ -177,7 +177,7 @@ jobs:
     # environment-scoped job, so this needs no per-environment secret setup.
     environment: crates-io
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
 
@@ -212,7 +212,7 @@ jobs:
       # SHA-pin every action in the provenance path (a supply-chain job must not
       # trust mutable tags) and pin the SBOM generator version for reproducible,
       # non-breaking release output.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
       - name: Generate Cargo.lock

.github/workflows/secret-scan.yml

@@ -16,7 +16,7 @@ jobs:
     name: Detect secrets
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 

.github/workflows/tier3.yml

@@ -29,7 +29,7 @@ jobs:
     name: Tier 3 (exhaustive + formal)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: actions/setup-python@v6
         with: