Chore(deps): Bump the actions group across 1 directory with 14 updates

.github/workflows/ci.yml

@@ -13,9 +13,9 @@ jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
           cache: npm

.github/workflows/docker-build-test-push.yml

@@ -69,13 +69,13 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
 
       - name: Build Docker image
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5.4.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: ${{ inputs.context }}
           load: true
@@ -93,7 +93,7 @@ jobs:
         run: docker save ${{ inputs.image-name }}:test | gzip > ${{ inputs.image-name }}.tar.gz
 
       - name: Upload image artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ inputs.image-name }}-image
           path: ${{ inputs.image-name }}.tar.gz
@@ -110,18 +110,18 @@ jobs:
       security-events: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Download image artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: ${{ inputs.image-name }}-image
 
       - name: Load Docker image
         run: docker load < ${{ inputs.image-name }}.tar.gz
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ inputs.python-version }}
 
@@ -149,7 +149,7 @@ jobs:
           output: 'trivy-results.sarif'
 
       - name: Upload Trivy results to GitHub Security
-        uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9  # v3.37.0
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
@@ -167,30 +167,30 @@ jobs:
       id-token: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       # The single-arch tar is consumed by the version report below; the
       # multi-arch push rebuilds from context (unavoidable for multi-platform).
       - name: Download image artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: ${{ inputs.image-name }}-image
 
       - name: Load Docker image
         run: docker load < ${{ inputs.image-name }}.tar.gz
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3.7.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           username: ${{ inputs.dockerhub-username }}
           password: ${{ secrets.dockerhub-token }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051  # v5.10.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6.2.0
         with:
           images: ${{ inputs.dockerhub-username }}/${{ inputs.image-name }}
           # Two tags only: the exact release version (v1.2.3 -> 1.2.3) and latest.
@@ -201,7 +201,7 @@ jobs:
 
       - name: Push multi-platform image
         id: push
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5.4.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: ${{ inputs.context }}
           platforms: ${{ inputs.platforms }}
@@ -214,7 +214,7 @@ jobs:
           provenance: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac  # v3.9.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
 
       # Keyless signature over the pushed manifest-list digest, recorded in the
       # Rekor transparency log. Verify with:
@@ -253,7 +253,7 @@ jobs:
           } > "$OUT"
 
       - name: Upload version report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: version-report-${{ inputs.image-name }}
           path: version-report-${{ inputs.image-name }}.md
@@ -267,7 +267,7 @@ jobs:
       - name: Sync README to Docker Hub
         if: ${{ inputs.image-description != '' }}
         continue-on-error: true
-        uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77  # v4.0.2
+        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa  # v5.0.0
         with:
           username: ${{ inputs.dockerhub-username }}
           password: ${{ secrets.dockerhub-token }}

.github/workflows/release.yml

@@ -16,7 +16,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Create GitHub Release
         env:

.github/workflows/salesforce-code-analyzer.yml

@@ -95,7 +95,7 @@ jobs:
       actions: read
     steps:
       - name: Check out files
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify workspace
         env:
@@ -113,18 +113,18 @@ jobs:
 
       # PREREQUISITES
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
 
       - name: Setup Java
-        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           java-version: ${{ inputs.java-version }}
           distribution: "zulu"
 
       - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ inputs.python-version }}
 

.github/workflows/sf-pr-validate.yml

@@ -35,7 +35,7 @@ jobs:
       contents: read
     steps:
       - name: Check out files
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           submodules: ${{ inputs.checkout-submodules }}
 
@@ -71,7 +71,7 @@ jobs:
       contents: read
     steps:
       - name: Check out files
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           submodules: ${{ inputs.checkout-submodules }}
 
@@ -131,7 +131,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: scratch-org-tests-${{ github.run_number }}
           path: scratch-org-tests.txt

.github/workflows/sf-release.yml

@@ -75,7 +75,7 @@ jobs:
       tests: ${{ steps.find-tests.outputs.tests }}
     steps:
       - name: Check out files
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: ${{ inputs.checkout-submodules }}
@@ -205,7 +205,7 @@ jobs:
 
       - name: Upload validation artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sf-release-${{ github.run_number }}
           path: |
@@ -236,7 +236,7 @@ jobs:
       quick-deployed: ${{ steps.deploy.outputs.quick-deployed }}
     steps:
       - name: Check out files
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: ${{ inputs.checkout-submodules }}
@@ -251,7 +251,7 @@ jobs:
       - name: Find quick-deploy candidate
         id: candidate
         if: ${{ !inputs.full-deploy }}
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             core.setOutput('found', 'false');
@@ -299,7 +299,7 @@ jobs:
       - name: Download validation artifact
         if: steps.candidate.outputs.found == 'true'
         continue-on-error: true
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ steps.candidate.outputs.artifact-name }}
           run-id: ${{ steps.candidate.outputs.run-id }}
@@ -517,7 +517,7 @@ jobs:
       # not used.
       - name: Upload deploy audit artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sf-deploy-${{ github.run_number }}
           path: |