ci: bump the github-actions group across 2 directories with 15 updates

.github/actions/napi-addon/action.yml

@@ -22,7 +22,7 @@ runs:
     # we care about; including `lts/*` patch versions busted the cache.
     - name: Restore NAPI addon cache
       id: napi-cache
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@v6
       with:
         path: |
           target/debug/libtreq_lib.so
@@ -49,7 +49,7 @@ runs:
     # mold links the cdylib several times faster than ld.
     - name: Use mold linker
       if: (steps.napi-cache.outputs.cache-hit != 'true' || (inputs.warm == 'true' && steps.rust-cache.outputs.cache-hit != 'true')) && runner.os == 'Linux'
-      uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1
+      uses: rui314/setup-mold@da13e0b42e392e3a45d1215033a2270b849d7d36 # v1
 
     # Warm mode builds on a dependency-cache miss so rust-cache's post step
     # saves a full target/, not just what a partial restore left.
@@ -64,7 +64,7 @@ runs:
     - name: Save NAPI addon cache
       if: steps.napi-cache.outputs.cache-hit != 'true'
       continue-on-error: true
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@v6
       with:
         path: |
           target/debug/libtreq_lib.so

.github/workflows/ci.yml

@@ -81,10 +81,10 @@ jobs:
       JS: ${{ needs.detect-changes.outputs.js_changed }}
       RUST: ${{ needs.detect-changes.outputs.rust_changed }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -151,13 +151,13 @@ jobs:
       # Matrix entries flagged rust: true also run on Rust-only changes.
       RUN_TASK: ${{ needs.detect-changes.outputs.js_changed == 'true' || matrix.rust == true }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         if: env.RUN_TASK == 'true'
 
       - name: Setup Node.js
         if: env.RUN_TASK == 'true'
         id: setup-node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           # Pin major so NAPI cache keys stay stable across LTS patch bumps.
           node-version: "24"
@@ -171,7 +171,7 @@ jobs:
         # WebKit/GTK is needed to *dlopen* libtreq_lib.so in integration tests
         # even on a NAPI cache hit.
         if: env.RUN_TASK == 'true' && (matrix.platform == 'ubuntu-22.04' && matrix.task == 'test:integration')
-        uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
           version: webkit-4.1-1
@@ -194,7 +194,7 @@ jobs:
       - name: Restore jj CLI cache
         id: jj-cache
         if: env.RUN_TASK == 'true' && (matrix.task == 'test:integration')
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: .ci-bin
           key: jj-${{ runner.os }}-${{ runner.arch }}-${{ steps.jj.outputs.tag }}
@@ -244,7 +244,7 @@ jobs:
       - name: Save jj CLI cache
         if: env.RUN_TASK == 'true' && (matrix.task == 'test:integration' && steps.jj-cache.outputs.cache-hit != 'true')
         continue-on-error: true
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: .ci-bin
           key: ${{ steps.jj-cache.outputs.cache-primary-key }}
@@ -280,7 +280,7 @@ jobs:
       # older commit is safe to reuse; the key only picks the newest one.
       - name: Vitest module cache
         if: env.RUN_TASK == 'true' && (matrix.task == 'test:integration')
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: node_modules/.experimental-vitest-cache
           key: vitest-fsmc-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
@@ -312,7 +312,7 @@ jobs:
     name: test-rust / clippy + test / ubuntu-22.04
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1
@@ -327,15 +327,15 @@ jobs:
 
       # mold links the large test binaries several times faster than ld.
       - name: Use mold linker
-        uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1
+        uses: rui314/setup-mold@da13e0b42e392e3a45d1215033a2270b849d7d36 # v1
 
       # Cold apt install of WebKit/GTK is ~30–60s per job; restore from Actions
       # cache on subsequent runs. execute_install_scripts is required so dpkg
       # postinst (ldconfig, alternatives) still runs on restore.
       - name: install dependencies (ubuntu only)
         # WebKit/GTK is needed to *link* treq/tauri and to *dlopen*
         # libtreq_lib.so in tests.
-        uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
           version: webkit-4.1-1
@@ -356,7 +356,7 @@ jobs:
 
       - name: Restore jj CLI cache
         id: jj-cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: .ci-bin
           key: jj-${{ runner.os }}-${{ runner.arch }}-${{ steps.jj.outputs.tag }}
@@ -406,7 +406,7 @@ jobs:
       - name: Save jj CLI cache
         if: steps.jj-cache.outputs.cache-hit != 'true'
         continue-on-error: true
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: .ci-bin
           key: ${{ steps.jj-cache.outputs.cache-primary-key }}

.github/workflows/clean-pr-description.yml

@@ -23,7 +23,7 @@ jobs:
           labels: codex
 
       - name: Remove chatgpt.com link and divider
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const pr = context.payload.pull_request;
@@ -43,7 +43,7 @@ jobs:
             }
 
       - name: Add docs prefix if only web/ changes
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const pr = context.payload.pull_request;
@@ -69,7 +69,7 @@ jobs:
             });
 
       - name: Enforce conventional commit title
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             // Re-fetch the PR so we see any title edits made by earlier jobs

.github/workflows/cli-binary.yml

@@ -24,7 +24,7 @@ jobs:
     outputs:
       rust_changed: ${{ steps.filter.outputs.rust }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Check for src-tauri changes
         id: filter
         uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
@@ -42,10 +42,10 @@ jobs:
     # room for a cold release build (over 20 minutes).
     timeout-minutes: 35
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 35
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1

.github/workflows/deploy-supabase.yml

@@ -38,9 +38,9 @@ jobs:
       SUPABASE_PROJECT_REF: ${{ vars.SUPABASE_PROJECT_REF }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
-      - uses: supabase/setup-cli@1dedf2c611547ede7232d26866dd3c56ab903bbb # v1.7.3
+      - uses: supabase/setup-cli@45a513f8c64c0bc8e0e3dfe572b5c95be85f6359 # v3.0.1
         with:
           version: latest
 

.github/workflows/deploy-web.yml

@@ -44,22 +44,22 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # A release event checks out the tag; deploy main instead so an older
           # tag never rolls the site back.
           ref: ${{ github.event_name == 'release' && github.event.repository.default_branch || '' }}
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
           cache-dependency-path: package-lock.json
 
       - name: Restore NAPI addon cache
         id: napi-cache
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: crates/treq-napi/treq-napi.linux-x64-gnu.node
           key: napi-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'Cargo.toml', 'src-tauri/Cargo.toml', 'src-tauri/build.rs', 'src-tauri/src/**', 'src-tauri/tests/**', 'crates/treq-napi/Cargo.toml', 'crates/treq-napi/build.rs', 'crates/treq-napi/src/**', 'crates/treq-napi/package.json', 'crates/treq-napi/package-lock.json') }}
@@ -72,7 +72,7 @@ jobs:
 
       - name: Install WebKit GTK headers
         if: steps.napi-cache.outputs.cache-hit != 'true'
-        uses: awalsh128/cache-apt-pkgs-action@681749ae568c81c2037cb9185e38b709b261bd2f # v1.6.1
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
           version: webkit-4.1-1
@@ -101,7 +101,7 @@ jobs:
       - name: Save NAPI addon cache
         if: steps.napi-cache.outputs.cache-hit != 'true'
         continue-on-error: true
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: crates/treq-napi/treq-napi.linux-x64-gnu.node
           key: ${{ steps.napi-cache.outputs.cache-primary-key }}
@@ -128,7 +128,7 @@ jobs:
         run: node web/scripts/assert-landing-screenshots.mjs
 
       - name: Upload landing screenshots
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: landing-screenshots
           path: |
@@ -151,19 +151,19 @@ jobs:
       url: ${{ (github.event_name == 'release' || github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) && 'https://treq.dev' || format('https://preview-{0}.treq-9zy.pages.dev', github.event.pull_request.number) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # A release event checks out the tag; deploy main instead so an older
           # tag never rolls the site back.
           ref: ${{ github.event_name == 'release' && github.event.repository.default_branch || '' }}
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24.3"
           cache: npm
           cache-dependency-path: 'web/package-lock.json'
       - name: Restore node_modules cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: node_modules
           key: ${{ runner.os }}-docs-build-${{ hashFiles('web/package-lock.json') }}
@@ -176,7 +176,7 @@ jobs:
         run: npm run typecheck
       - name: Install uv
         if: ${{ !cancelled() && github.event_name == 'pull_request' }}
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - name: Lint e2e tests (ast-grep)
         if: ${{ !cancelled() && github.event_name == 'pull_request' }}
         working-directory: ${{ github.workspace }}
@@ -201,7 +201,7 @@ jobs:
           echo "run-id=$run_id" >> "$GITHUB_OUTPUT"
       - name: Download landing screenshots
         continue-on-error: true
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: landing-screenshots
           path: /tmp/landing-screenshots
@@ -216,7 +216,7 @@ jobs:
         run: bash scripts/ci-deploy-web-build.sh /tmp/landing-screenshots
       - name: Publish to Production
         if: github.event_name == 'release' || github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
-        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -225,7 +225,7 @@ jobs:
           gitHubToken: ${{ secrets.GITHUB_TOKEN }}
       - name: Publish Preview
         if: github.event_name == 'pull_request'
-        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -253,13 +253,13 @@ jobs:
             --quiet
       - name: Upload Lighthouse report
         id: upload
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: lighthouse-report
           path: /tmp/lighthouse-report.html
           retention-days: 30
       - name: Comment preview and Lighthouse links on PR
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const previewUrl = `https://preview-${context.issue.number}.treq-9zy.pages.dev`;