merge queue: checking main (ead31cc), #431, #432, #434 and #433 together

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   # Install only the tools this job uses. Installing the full
@@ -66,7 +66,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   install_args: rust cargo:cargo-nextest
@@ -112,7 +112,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   install_args: rust cargo:cargo-nextest
@@ -131,7 +131,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   install_args: rust cargo:cargo-nextest cargo:cargo-llvm-cov

.github/workflows/compatibility.yml

@@ -41,7 +41,7 @@ jobs:
               with:
                   persist-credentials: false
 
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   # Only rust + just are needed here; avoid the full mise tool

.github/workflows/copilot-setup-steps.yml

@@ -28,7 +28,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   cache: true

.github/workflows/docs.yml

@@ -28,7 +28,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   cache: true

.github/workflows/release-plz.yml

@@ -31,7 +31,7 @@ jobs:
                   # use the App token so the pushed tag triggers release.yml
                   persist-credentials: true
                   token: ${{ steps.app-token.outputs.token }}
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   cache_key: "mise-v1-{{platform}}-{{install_args_hash}}-{{file_hash}}"
@@ -59,7 +59,7 @@ jobs:
               with:
                   fetch-depth: 0
                   persist-credentials: false
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   cache_key: "mise-v1-{{platform}}-{{install_args_hash}}-{{file_hash}}"

.github/workflows/release.yml

@@ -151,7 +151,7 @@ jobs:
           dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
           echo "dist ran successfully"
       - name: Attest
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6
         with:
           subject-path: "target/distrib/*${{ join(matrix.targets, ', ') }}*"
       - id: cargo-dist

.github/workflows/scorecard.yml

@@ -74,6 +74,6 @@ jobs:
             # Upload the results to GitHub's code scanning dashboard (optional).
             # Commenting out will disable upload of results to your repo's Code Scanning dashboard
             - name: "Upload to code-scanning"
-              uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+              uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
               with:
                   sarif_file: results.sarif

.github/workflows/security.yml

@@ -30,7 +30,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+            - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
               with:
                   install: true
                   install_args: just rust cargo:cargo-deny cargo:cargo-outdated cargo:cargo-audit