build(deps): bump the all-actions group with 4 updates

.github/workflows/_backend.yml

@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22.x'
 
@@ -131,7 +131,7 @@ jobs:
 
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: test-results-backend
           path: |
@@ -229,7 +229,7 @@ jobs:
 
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: test-results-backend-features-${{ matrix.features }}
           path: |
@@ -277,7 +277,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup mise for repository toolchain
-        uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
 
       - name: Setup JDK 17 for registry contracts
         uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1

.github/workflows/_contract.yml

@@ -209,7 +209,7 @@ jobs:
 
       - name: Upload japicmp reports
         if: ${{ always() && steps.baseline_contracts.outputs.has_standalone_contracts == 'true' && steps.baseline_contracts.outputs.breaking_release != 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: japicmp-reports
           path: |

.github/workflows/_docker.yml

@@ -85,7 +85,7 @@ jobs:
 
       - name: Upload local Trivy report
         if: ${{ always() && steps.scan.outcome != 'skipped' && steps.scan.outcome != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: trivy-verify-${{ matrix.service.name }}
           path: ${{ runner.temp }}/${{ matrix.service.name }}.trivy.json

.github/workflows/_frontend.yml

@@ -37,7 +37,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -68,7 +68,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.should-run.outputs.run == 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
@@ -112,7 +112,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.should-run.outputs.run == 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
@@ -156,7 +156,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.should-run.outputs.run == 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
@@ -193,7 +193,7 @@ jobs:
         run: corepack enable && corepack prepare pnpm@${{ env.PNPM_VERSION }} --activate
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'
@@ -221,7 +221,7 @@ jobs:
         run: corepack enable && corepack prepare pnpm@${{ env.PNPM_VERSION }} --activate
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'pnpm'

.github/workflows/docker-publish.yml

@@ -113,7 +113,7 @@ jobs:
           version: v0.74.0
       - name: Upload candidate scan report
         if: ${{ always() && steps.scan.outcome != 'skipped' && steps.scan.outcome != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: trivy-${{ matrix.service.name }}
           path: ${{ runner.temp }}/${{ matrix.service.name }}.trivy.json
@@ -165,7 +165,7 @@ jobs:
           printf '%s\n' "$SOURCE_SHA" > "$out/$SERVICE.source-commit"
           jq -n --arg service "$SERVICE" --arg image "$IMAGE_REF" '{service:$service,image_ref:$image}' > "$out/$SERVICE.release.json"
       - name: Upload candidate evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: candidate-evidence-${{ matrix.service.name }}
           path: ${{ runner.temp }}/candidate-evidence-${{ matrix.service.name }}/
@@ -181,7 +181,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download this run's candidate evidence
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: candidate-evidence-*
           path: ${{ runner.temp }}/candidate-evidence
@@ -200,7 +200,7 @@ jobs:
       - name: Validate candidates and promote release tags
         run: scripts/runbooks/promote-release.sh "$RUNNER_TEMP/candidate-evidence" "${GITHUB_SHA}" ghcr.io/davidhlp/ulticode --execute
       - name: Upload complete release manifest and evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: release-manifest
           path: |

scripts/test/supply-chain-contract.sh

@@ -149,7 +149,7 @@ for service in owner_services:
     owner_properties = ET.parse(owner_pom).getroot().find('m:properties', ns)
     owner_version = owner_properties.findtext(f'm:{prop}', namespaces=ns)
     assert root_version == owner_version == '1.0.1', f'{service["name"]}: release version mismatch ({root_version!r} != {owner_version!r})'
-assert 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131' in workflow
+assert 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333' in workflow
 print('digest-only candidates, common normalized repo and all-service promote gate: PASS')
 scan = workflow.split('      - name: Scan pushed candidate\n', 1)[1].split('      - name:', 1)[0]
 assert "exit-code: '1'" in scan and 'continue-on-error' not in scan