ci(deps): update actions

.github/workflows/auto-bot-land.yml

@@ -290,7 +290,7 @@ jobs:
         if: steps.target.outputs.num != ''
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         if: steps.target.outputs.num != ''
       # THE LANE NEEDS THE ENGINE NOW, AND NOTHING WAS PROVIDING IT (CLOUD-1143's
       # consequence). `checks-green` was retired onto the engine, so `mise.toml`'s

.github/workflows/auto-release-land.yml

@@ -209,7 +209,7 @@ jobs:
         if: steps.target.outputs.num != ''
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         if: steps.target.outputs.num != ''
       # THE LANE NEEDS THE ENGINE NOW, AND NOTHING WAS PROVIDING IT (CLOUD-1143's
       # consequence). `checks-green` was retired onto the engine, so `mise.toml`'s

.github/workflows/branch-hygiene.yml

@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # `gh` for both readings, `jq` for the GraphQL projection. Narrow, for
           # the reason ci.yml states: the whole toolchain is ~10s a job that

.github/workflows/ci-drift.yml

@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # THE FETCH, one step before the gate. It lives here rather than in a
       # `mise-tasks/` program because a credentialed read is the one thing the
       # engine may not do (house-style §5), and this is where the job token

.github/workflows/ci.yml

@@ -201,7 +201,7 @@ jobs:
           if [ "$BASE_REF" != main ]; then
             git fetch origin "$BASE_REF:refs/remotes/origin/$BASE_REF"
           fi
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # Install only what this job's gates actually invoke, not the whole
           # 18-tool dev set. Every job used to install everything, and `zig`
@@ -512,7 +512,7 @@ jobs:
           fetch-depth: 0
       - name: Fetch the comparison base refs
         run: git fetch origin main:refs/remotes/origin/main
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # One line, for the reason the `ci` job's list states: `ci-tools-check`
           # parses these as a scalar and several names begin with `aqua:`, which
@@ -628,7 +628,7 @@ jobs:
           # merge base, and an unresolvable base is exit 2 by design rather than
           # a pass, so this would fail loudly rather than measure nothing.
           fetch-depth: 0
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # rust builds the two binaries under measurement, hyperfine samples
           # them, jq reads the ratio out. See the ci job for why these lists are

.github/workflows/commit-lint.yml

@@ -93,7 +93,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # `rust`, and nothing else. `commit-lint` depends on `commit-check` and
           # `commit-attribution`, both of which are `cargo run --quiet -p batten`,

.github/workflows/coverage.yml

@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # cargo-llvm-cov drives cargo; rust supplies the compiler and the
           # rustup that fetches llvm-tools-preview. Nothing else is invoked.

.github/workflows/fuzz.yml

@@ -65,7 +65,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # `rust` alone: it supplies cargo and the rustup that `mise run fuzz`
           # uses to fetch the nightly libFuzzer's `-Z sanitizer` requires, and

.github/workflows/hook-latency-drift.yml

@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       - name: Report a fast tier that no longer matches its budget
         shell: bash
         env:

.github/workflows/land-divergence.yml

@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # Measure to a FILE, then read it back — never `measure | assert`. A
       # pipeline hands the step's exit status to its last stage, so a measurement
       # that died would be judged as a clean empty window rather than reported

.github/workflows/linear-release-backfill.yml

@@ -149,14 +149,14 @@ jobs:
       # `github_token` is deliberately not passed — the action defaults it to
       # `${{ github.token }}`, which the job's `contents: read` covers.
       - name: Record the release in Linear
-        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: sync
           version: ${{ inputs.tag }}
           base_ref: ${{ steps.base.outputs.ref }}
       - name: Complete the Linear release
-        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: complete

.github/workflows/lock-currency.yml

@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # The lockfile rewrite this performs is fine here and only here: the
       # checkout is disposable, and no commit is being judged by it.
       - run: mise run lock-check

.github/workflows/mutant.yml

@@ -95,7 +95,7 @@ jobs:
           # committed bytes, so it needs the work tree rather than history — and
           # it writes nothing, so no credential is persisted.
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # THE PAIR IS THE VERDICT, never either alone. `mutant` asks whether each
       # declared mutation is caught; `mutant-census` asks whether every gate in
       # the tree is declared or carries a filed exemption. A change that dropped a

.github/workflows/nonverdict-rate.yml

@@ -60,7 +60,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # Measure to a FILE, then read it back — never `scan | assert`. A pipeline
       # hands the step's exit status to its last stage, so a scan that died would
       # be judged as an empty window rather than reported (perf.yml:84-92).

.github/workflows/perf.yml

@@ -93,7 +93,7 @@ jobs:
       # and a missing ref is the empty series rather than a failure.
       - name: Fetch the existing series
         run: git fetch origin "refs/notes/perf:refs/notes/perf" || true
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # rust builds the binary under measurement, hyperfine samples it, jq
           # reads the sampler's JSON back out. Nothing else is invoked.

.github/workflows/release-artifacts.yml

@@ -125,7 +125,7 @@ jobs:
       # flags cache-poisoning as high severity precisely on artifact-publishing
       # workflows: a poisoned cache entry would end up inside a signed binary,
       # and the attestation would faithfully attest to the compromised build.
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       - name: Install cross
@@ -263,7 +263,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       - name: Derive both schemas from the tagged config types
@@ -337,7 +337,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       # `checksums` emits a sums= KEY=VALUE line, so the asset path is decided in

.github/workflows/release-assets.yml

@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # TAG goes through env, never interpolated into the run block: a `${{ }}`
       # expansion is textual substitution into the shell script, so a tag naming
       # shell metacharacters would execute. Same posture as every other run block

.github/workflows/release-plz.yml

@@ -152,7 +152,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # Exactly what the `ci` job needs to compile the workspace, minus the
           # tools only its assertions use: the cache being filled is a cargo
@@ -186,7 +186,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # Exactly what the `windows` job installs, minus the tools only its
           # assertions need: the cache being filled is a cargo target dir.
@@ -249,7 +249,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PLZ_TOKEN || secrets.GITHUB_TOKEN }}
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # release-plz clones the repo into a temp dir; `git fetch origin main` there
       # has no credentials (actions/checkout's auth lives only on the main clone),
       # so it cannot rebase the release branch onto main — the PR is then re-opened
@@ -339,14 +339,14 @@ jobs:
       # silently shipping an untracked release.
       - name: Record the release in Linear
         if: steps.release-tag.outputs.tag != ''
-        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: sync
           version: ${{ steps.release-tag.outputs.tag }}
       - name: Complete the Linear release
         if: steps.release-tag.outputs.tag != ''
-        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
+        uses: linear/linear-release-action@3f31fcf14c110cc53579fcc3575a26d469c413b4 # v0.17.1
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: complete

.github/workflows/rust.yml

@@ -121,7 +121,7 @@ jobs:
           # tests/bats — the shell test runner. Without it `mise run test:bats`
           # has no bats to run.
           submodules: true
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # cross-check is `rustup target add` + `cargo check`; rust is the only
           # tool it touches. See the ci job for why these lists are narrow.
@@ -202,7 +202,7 @@ jobs:
           bash -c "$body" || exit 0
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # zig supplies the Darwin linker and cargo-zigbuild drives cargo
           # through it; rust is the compiler. Nothing else is invoked here —
@@ -279,7 +279,7 @@ jobs:
           # task passes `--baseline-rev origin/main`, and a shallow clone has no
           # such ref to build the baseline rustdoc from.
           fetch-depth: 0
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # cargo-semver-checks does the comparison; rust supplies the cargo and
           # the rustup that fetches the newer toolchain the tool requires — see
@@ -422,7 +422,7 @@ jobs:
           # carries a suite about that path — and it would read as a Windows
           # finding, which is the misattribution this job exists to avoid.
           submodules: true
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # NOT rust alone, which is what this job shipped with and what the
           # sixth Windows run disproved. `cargo test` is the command, but the

.github/workflows/scorecard.yml

@@ -66,7 +66,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # scorecard reads the repository over the API and the checkout from
           # disk; nothing else is invoked. `mise run ci-tools-check` fails if a

.github/workflows/timeout-drift.yml

@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
       # GH_TOKEN goes through env, never interpolated into the run block: a
       # `${{ }}` expansion is textual substitution into the shell script, and
       # zizmor gates that at high severity. All logic is in the task; nothing

.github/workflows/zizmor-advisories.yml

@@ -54,7 +54,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           install_args: zizmor
       - run: mise run zizmor-advisories

.github/workflows/zizmor.yml

@@ -115,7 +115,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 (CLOUD-404 retry fix, now a release)
         with:
           # The analyzer, plus the `jq` its receipt check needs: the task body is
           # `step-receipt check zizmor` first, and `step-receipt` reads