chore(deps): bump the actions group with 6 updates

.github/workflows/actions.lock

@@ -11,7 +11,7 @@ workflows:
         - 'goto-bus-stop/setup-zig@v2.2.1'
     '.github/workflows/codeql.yml':
         - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370'
+        - 'github/codeql-action@33d7b85da1a04171e211befe2c739303b9a4c066'
     '.github/workflows/container-build.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/dependabot-automerge.yml':
@@ -41,12 +41,12 @@ workflows:
     '.github/workflows/quality.yml':
         - 'actions/checkout@v7.0.1'
         - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
-        - 'trufflesecurity/trufflehog@v3.99.7'
+        - 'trufflesecurity/trufflehog@v3.99.8'
     '.github/workflows/release.yml':
         - 'actions/attest-build-provenance@v4.2.2'
         - 'actions/checkout@v7.0.1'
-        - 'actions/upload-artifact@v7.0.1'
-        - 'softprops/action-gh-release@v3.0.3'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'softprops/action-gh-release@v3.0.4'
     '.github/workflows/rhodibot.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/runtime-policy.yml':
@@ -58,7 +58,7 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/sonarqube.yml':
         - 'actions/checkout@v7.0.1'
-        - 'sonarsource/sonarqube-scan-action@v8.4.0'
+        - 'sonarsource/sonarqube-scan-action@v8.4.1'
     '.github/workflows/static-analysis-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/download-artifact@v8.0.1'
@@ -67,7 +67,7 @@ workflows:
     '.github/workflows/test-suite.yml':
         - 'actions/checkout@v7.0.1'
         - 'goto-bus-stop/setup-zig@v2.2.1'
-        - 'leanprover/lean-action@fe408643ea7367d8c0404a8be3975bb145f5fb64'
+        - 'leanprover/lean-action@ba3fdfe5c4476c925da13bf11a005ddb47e47aee'
     '.github/workflows/wellknown-enforcement.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/workflow-linter.yml':
@@ -128,6 +128,11 @@ dependencies:
         commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
         owner_id: 44036562
         repo_id: 192625955
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
     'actions/upload-pages-artifact@v5.0.0':
         ref: 'v5.0.0'
         commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
@@ -150,9 +155,9 @@ dependencies:
         commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
         owner_id: 47606891
         repo_id: 331103973
-    'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370':
-        ref: 'v4.39.1'
-        commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370'
+    'github/codeql-action@33d7b85da1a04171e211befe2c739303b9a4c066':
+        ref: 'v4.39.3'
+        commit: 'sha1-33d7b85da1a04171e211befe2c739303b9a4c066'
         owner_id: 9919
         repo_id: 259445878
     'goto-bus-stop/setup-zig@v2.2.1':
@@ -165,25 +170,25 @@ dependencies:
         commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
         owner_id: 75048950
         repo_id: 623796603
-    'leanprover/lean-action@fe408643ea7367d8c0404a8be3975bb145f5fb64':
-        ref: 'v1.7.0'
-        commit: 'sha1-fe408643ea7367d8c0404a8be3975bb145f5fb64'
+    'leanprover/lean-action@ba3fdfe5c4476c925da13bf11a005ddb47e47aee':
+        ref: 'v1.7.1'
+        commit: 'sha1-ba3fdfe5c4476c925da13bf11a005ddb47e47aee'
         owner_id: 7233018
         repo_id: 795738301
         uses:
             - 'actions/cache@caa296126883cff596d87d8935842f9db880ef25'
-    'softprops/action-gh-release@v3.0.3':
-        ref: 'v3.0.3'
-        commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
+    'softprops/action-gh-release@v3.0.4':
+        ref: 'v3.0.4'
+        commit: 'sha1-8a0cd651e5b2365bd640854a3fa5dfc70e4875f3'
         owner_id: 2242
         repo_id: 204253808
-    'sonarsource/sonarqube-scan-action@v8.4.0':
-        ref: 'v8.4.0'
-        commit: 'sha1-4d1dc0c91ee400dcf8a6dddf2f705ac36542e304'
+    'sonarsource/sonarqube-scan-action@v8.4.1':
+        ref: 'v8.4.1'
+        commit: 'sha1-e805d875275f728fac1885b413934be6d7c63f65'
         owner_id: 545988
         repo_id: 366408409
-    'trufflesecurity/trufflehog@v3.99.7':
-        ref: 'v3.99.7'
-        commit: 'sha1-31ce31ee1abbcc7dc8eee5764c17121c3044c8b2'
+    'trufflesecurity/trufflehog@v3.99.8':
+        ref: 'v3.99.8'
+        commit: 'sha1-ea68ca03c865c5f324e86e849ced20ed3cf9dbbb'
         owner_id: 79229934
         repo_id: 77726177

.github/workflows/codeql.yml

@@ -39,11 +39,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/quality.yml

@@ -30,7 +30,7 @@ jobs:
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@v3.99.7
+        uses: trufflesecurity/trufflehog@v3.99.8
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}

.github/workflows/release.yml

@@ -136,7 +136,7 @@ jobs:
       #     name: release-artifacts
       #     path: artifacts/
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3.0.3
+        uses: softprops/action-gh-release@v3.0.4
         with:
           body: ${{ needs.changelog.outputs.changelog }}
           draft: false

.github/workflows/sonarqube.yml

@@ -31,6 +31,6 @@ jobs:
         with:
           fetch-depth: 0   # full history for accurate new-code detection
       - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@v8.4.0
+        uses: SonarSource/sonarqube-scan-action@v8.4.1
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/test-suite.yml

@@ -140,7 +140,7 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Install elan (Lean version manager)
-        uses: leanprover/lean-action@fe408643ea7367d8c0404a8be3975bb145f5fb64 # v1.7.0
+        uses: leanprover/lean-action@ba3fdfe5c4476c925da13bf11a005ddb47e47aee # v1.7.1
         with:
           auto-config: false
           build: false