build(deps): bump the github-actions group across 1 directory with 4 updates

.github/workflows/ci.yml

@@ -29,10 +29,10 @@
       code-quality: write
     steps:
       - name: Check out the repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -41,10 +41,10 @@
         run: uv python install
 
       - name: Sync the locked environment
         run: uv sync --locked
 
       - name: Run the full CI gate sequence
         run: uv run python -m oaknational.python_repo_template.devtools check-ci
 
       # Derive a Cobertura report from the coverage data the check-ci `coverage`
       # gate already wrote (no second test run), then publish it to GitHub Code
@@ -53,11 +53,11 @@
       # nothing to generate for it either.
       - name: Generate the Cobertura coverage report
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         run: uv run coverage xml
 
       - name: Upload coverage to GitHub Code Quality
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/upload-code-coverage@abb5995db9e0199b0e2bb9dbd136fce4cb1ec4d3 # v1
+        uses: actions/upload-code-coverage@1c15be36fc3733ba839b1dd643bd9556e4426dc1 # v1
         with:
           file: coverage.xml
           language: Python
@@ -83,7 +83,7 @@
       contents: read
     steps:
       - name: Check out the repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install the pinned gitleaks binary
         run: |
@@ -94,8 +94,8 @@
           GITLEAKS_VERSION=v8.30.1
           GITLEAKS_SHA256=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
           ARCHIVE="gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz"
           curl -sSfL -o "$ARCHIVE" \
             "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/${ARCHIVE}"
           echo "${GITLEAKS_SHA256}  ${ARCHIVE}" | sha256sum --check --strict
           tar -xzf "$ARCHIVE" gitleaks
           sudo install gitleaks /usr/local/bin/gitleaks

.github/workflows/link-check.yml

@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check links in documentation
-        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2
         with:
           # Badges are decorative and shields.io rate-limits; exclude them.
           args: >-

.github/workflows/release.yml

@@ -48,21 +48,21 @@
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
       - name: Check out full history and tags
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # Keep the bot token in the git config so `git push` to protected main
           # is authenticated as the bypass actor.
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
 
       - name: Sync the locked environment
         run: uv sync --locked
 
       - name: Configure the bot git identity
         run: |
@@ -73,13 +73,13 @@
         id: increment
         run: |
           set -euo pipefail
           version=$(uv run python -c "import tomllib, pathlib; print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
           prev="v${version}"
           echo "previous=${prev}" >> "$GITHUB_OUTPUT"
           if git rev-parse -q --verify "refs/tags/${prev}" >/dev/null; then
             # cz_conventional_commits ignores [tool.commitizen].bump_map, so we
             # compute the increment from that single policy source ourselves.
             increment="$(git log "${prev}..HEAD" --pretty=format:'%B%x00' | uv run python tools/release_increment.py)"
           else
             # The committed version is not tagged yet (a fresh fork of this
             # template): release it as-is so the adopter's first version is the
@@ -119,10 +119,10 @@
         run: |
           set -euo pipefail
           if [ "${MODE}" = "bump" ]; then
             uv run cz bump --increment "${INCREMENT}" --changelog --files-only --yes
             # Regenerate the lock so its project version matches the bump.
             uv lock
             version=$(uv run python -c "import tomllib, pathlib; print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
             if [ -z "${version}" ]; then echo "could not read the bumped version"; exit 1; fi
             # `[skip ci]` stops the bump push re-triggering CI -> Release (a loop).
             git add pyproject.toml uv.lock CHANGELOG.md
@@ -132,7 +132,7 @@
             git push origin "v${version}"
           else
             # bootstrap: tag the committed version as-is (no bump, no commit).
             version=$(uv run python -c "import tomllib, pathlib; print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
             git tag -a "v${version}" -m "v${version}"
             git push origin "v${version}"
           fi
@@ -150,7 +150,7 @@
           tag="v${VERSION}"
           uv build
           notes="$(mktemp)"
           if uv run cz changelog --dry-run "${VERSION}" > "${notes}" 2>/dev/null && [ -s "${notes}" ]; then
             gh release create "${tag}" --title "${tag}" --notes-file "${notes}" ./dist/*
           else
             gh release create "${tag}" --title "${tag}" --generate-notes ./dist/*