From 01a552b0e30f910a453da90c164e04a712b7280a Mon Sep 17 00:00:00 2001
From: Rajesh Vakkalagadda <vrj.dev@gmail.com>
Date: Tue, 27 Oct 2026 13:54:09 -0700
Subject: [PATCH 1/2] ci: update GitHub Actions to Node.js 24 versions

Actions still running on Node.js 20:
- actions/download-artifact v6 -> v8 (deploy_pkg.yml)
- github/codeql-action v3 -> v4 (codeql.yml; v3 is
  deprecated in Dec 2026)
- codecov/codecov-action v5 -> v7 (pytest.yml; v5 calls
  actions/github-script v7, which runs on Node.js 20)

Also align actions/checkout, actions/setup-python and
actions/upload-artifact to v7, matching doubleml-coverage
and the dev branch of doubleml-docs.
---
 .github/workflows/codeql.yml     |  8 ++++----
 .github/workflows/deploy_pkg.yml | 14 +++++++-------
 .github/workflows/pytest.yml     |  8 ++++----
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 47a484ef..f5c3dfd3 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,18 +24,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/deploy_pkg.yml b/.github/workflows/deploy_pkg.yml
index 74f51c84..d5a5671b 100644
--- a/.github/workflows/deploy_pkg.yml
+++ b/.github/workflows/deploy_pkg.yml
@@ -12,13 +12,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           fetch-depth: 0 # Required for dynamic versioning
 
       - name: Install python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -32,7 +32,7 @@ jobs:
       - name: Check package metadata
         run: twine check dist/*
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: DoubleML-pkg
           path: dist/
@@ -49,7 +49,7 @@ jobs:
 
     steps:
       - name: Download built package
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           name: DoubleML-pkg
           path: dist/
@@ -65,7 +65,7 @@ jobs:
     needs: publish-to-testpypi
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -98,7 +98,7 @@ jobs:
 
     steps:
       - name: Download built package
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           name: DoubleML-pkg
           path: dist/
@@ -112,7 +112,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
     steps:
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 8fcf8022..58e0d2cc 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -30,12 +30,12 @@ jobs:
           - {os: 'ubuntu-latest', python-version: '3.13'}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0  # allow version retrieval with setuptools_scm
 
     - name: Set up Python ${{ matrix.config.python-version }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.config.python-version }}
 
@@ -74,7 +74,7 @@ jobs:
       if: |
         matrix.config.os == 'ubuntu-latest' &&
         matrix.config.python-version == '3.12'
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: code-coverage-report
         path: |
@@ -86,7 +86,7 @@ jobs:
       if: |
         matrix.config.os == 'ubuntu-latest' &&
         matrix.config.python-version == '3.12'
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@v7
       with:
         fail_ci_if_error: false
         files: ./coverage.xml

From 3bbf37eac5953afb3e0bd5209ad105759651265c Mon Sep 17 00:00:00 2001
From: Sven Klaassen <47529404+SvenKlaassen@users.noreply.github.com>
Date: Wed, 28 Oct 2026 07:26:05 +0100
Subject: [PATCH 2/2] ci: add dependabot config for GitHub Actions

Monthly schedule matching doubleml-coverage; all action bumps are
---
 .github/dependabot.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..ee19b280
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"