Build: bump the actions-major group across 2 directories with 3 updates

.github/actions/package-toolchain/action.yml

@@ -32,7 +32,7 @@ runs:
         echo "toolchain-cache key: $KEY"
 
     - name: Cache musl sysroot + libc++
-      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       id: cache
       with:
         path: |

.github/workflows/abi-staging-merge-gate.yml

@@ -69,15 +69,15 @@ jobs:
       PR_HEAD_SHA: ${{ needs.capture-current-subject.outputs.exact-head }}
     steps:
       - name: Checkout captured protected ABI authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.capture-current-subject.outputs.protected-sha }}
           fetch-depth: 1
           persist-credentials: false
           path: abi-staging-authority
 
       - name: Checkout exact PR head for structural ABI check
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.capture-current-subject.outputs.exact-head }}
           fetch-depth: 1
@@ -235,15 +235,15 @@ jobs:
       PROTECTED_SHA: ${{ needs.capture-current-subject.outputs.protected-sha }}
     steps:
       - name: Checkout captured protected ABI gate authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.capture-current-subject.outputs.protected-sha }}
           fetch-depth: 1
           persist-credentials: false
           path: abi-staging-authority
 
       - name: Checkout inert exact PR head for ABI gate
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.capture-current-subject.outputs.exact-head }}
           fetch-depth: 1

.github/workflows/abi-staging-pages-canary.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
     steps:
       - name: Check out the exact protected source commit
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -47,7 +47,7 @@ jobs:
           submodules: libc/musl
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           package-manager-cache: false

.github/workflows/abi-staging-pr-check.yml

@@ -141,15 +141,15 @@ jobs:
       contents: read
     steps:
       - name: Checkout captured protected Kandelo authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.enumerate-open-prs.outputs.protected-sha }}
           fetch-depth: 1
           persist-credentials: false
           path: authority
 
       - name: Checkout captured protected tap authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: ${{ needs.enumerate-open-prs.outputs.tap-sha }}
@@ -158,7 +158,7 @@ jobs:
           path: tap
 
       - name: Checkout inert exact PR head
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ matrix.subject.head_repository }}
           ref: ${{ matrix.subject.head }}
@@ -323,7 +323,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout captured protected Kandelo authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.enumerate-open-prs.outputs.protected-sha }}
           fetch-depth: 1

.github/workflows/abi-staging-request-feed.yml

@@ -139,7 +139,7 @@ jobs:
           printf 'subjects-sha256=%s\n' "$subjects_sha256" >>"$GITHUB_OUTPUT"
 
       - name: Checkout captured protected authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.resolve.outputs.protected-sha }}
           fetch-depth: 1
@@ -295,7 +295,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout captured protected authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.classify-exact-head.outputs.protected-sha }}
           fetch-depth: 1
@@ -462,7 +462,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout captured protected authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.classify-exact-head.outputs.protected-sha }}
           fetch-depth: 1

.github/workflows/activate-merge-candidate.yml

@@ -51,7 +51,7 @@ jobs:
       # Always run the current default-branch protocol. A candidate may have
       # been prepared by a PR that changed these scripts; pre-merge code must
       # never activate canonical state.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 0

.github/workflows/browser-demos-ci.yml

@@ -39,8 +39,8 @@ jobs:
     name: COI smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"

.github/workflows/browser-demos-pages.yml

@@ -28,7 +28,7 @@ jobs:
       deploy: ${{ steps.shipping.outputs.ready == 'true' && steps.publish_freshness.outputs.publish == 'true' }}
     steps:
       - name: Check out the exact protected source commit
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.source_sha }}
           fetch-depth: 1
@@ -77,7 +77,7 @@ jobs:
           submodules: libc/musl
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           package-manager-cache: false

.github/workflows/force-rebuild.yml

@@ -199,7 +199,7 @@ jobs:
       target_tag: ${{ steps.compute.outputs.target_tag }}
       expected_ledger_artifact: ${{ steps.compute.outputs.expected_ledger_artifact }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 
@@ -228,7 +228,7 @@ jobs:
         run: bash scripts/dev-shell.sh true
 
       - name: Cache xtask build
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -340,7 +340,7 @@ jobs:
     needs: [gate]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 
@@ -372,7 +372,7 @@ jobs:
           echo "toolchain-cache key: $KEY"
 
       - name: Cache musl sysroot + libc++
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache
         with:
           path: |
@@ -439,7 +439,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_0_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -470,7 +470,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_1_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -501,7 +501,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_2_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -532,7 +532,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_3_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -563,7 +563,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_4_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -594,7 +594,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_5_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -625,7 +625,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_6_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -656,7 +656,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_7_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -698,7 +698,7 @@ jobs:
     env:
       WASM_POSIX_BINARY_INDEX_URL: https://github.com/${{ github.repository }}/releases/download/${{ needs.preflight.outputs.target_tag }}/index.toml
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 
@@ -892,7 +892,7 @@ jobs:
       SUITE: ${{ matrix.suite }}
       TEST_GROUP: ${{ matrix.group }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 
@@ -987,7 +987,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       PACKAGE_TARGET_TAG: ${{ needs.preflight.outputs.target_tag }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 

.github/workflows/homebrew-experimental-vfs-publish.yml

@@ -38,7 +38,7 @@ jobs:
       rootfs_bytes: ${{ steps.identify_candidate.outputs.rootfs_bytes }}
     steps:
       - name: Checkout exact Kandelo source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 1
@@ -55,15 +55,15 @@ jobs:
           test -d libc/musl/src
 
       - name: Checkout exact Homebrew tap source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: ${{ inputs.tap-revision }}
           path: tap
           fetch-depth: 1
           persist-credentials: false
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm
@@ -225,22 +225,22 @@ jobs:
       report_bytes: ${{ steps.identify.outputs.report_bytes }}
     steps:
       - name: Checkout exact Kandelo source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 1
           persist-credentials: false
 
       - name: Checkout exact Homebrew tap source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: ${{ inputs.tap-revision }}
           path: tap
           fetch-depth: 1
           persist-credentials: false
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm

.github/workflows/homebrew-main-shell-ci.yml

@@ -80,7 +80,7 @@ jobs:
       product_state: ${{ steps.product.outputs.state }}
       selection_ready: ${{ steps.product.outputs.selection_ready }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.pull_request_head_sha || github.sha }}
           fetch-depth: 0
@@ -143,7 +143,7 @@ jobs:
       # wrong artifact again.
       SHELL_ACTIVATION_MODE: bottles
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.pull_request_head_sha || github.sha }}
           persist-credentials: false
@@ -238,7 +238,7 @@ jobs:
         with:
           submodules: libc/musl
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm

.github/workflows/homebrew-native-publisher-compatibility.yml

@@ -22,14 +22,14 @@ jobs:
       contents: read
     steps:
       - name: Checkout exact PR head
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.sha }}
           submodules: false
 
       - name: Checkout exact reviewed Homebrew source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: Homebrew/brew