chore(deps): bump the actions-all group across 1 directory with 8 updates

.github/workflows/ci.yml

@@ -497,7 +497,7 @@ jobs:
           name: coverage
       - name: SonarCloud Scan
         if: env.SONAR_TOKEN != ''
-        uses: SonarSource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8
+        uses: SonarSource/sonarqube-scan-action@e805d875275f728fac1885b413934be6d7c63f65 # v8
         continue-on-error: true
         env:
           SONAR_HOST_URL: https://sonarcloud.io
@@ -551,7 +551,7 @@ jobs:
         with:
           path: ~/setup-pnpm
           key: pnpm-${{ runner.os }}-${{ steps.pnpm.outputs.spec }}
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
         if: steps.pnpm-cache.outputs.cache-hit != 'true'
         with:
           package_json_file: site/package.json
@@ -936,7 +936,7 @@ jobs:
         with:
           path: ~/setup-pnpm
           key: pnpm-${{ runner.os }}-${{ steps.pnpm.outputs.spec }}
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
         if: steps.pnpm-cache.outputs.cache-hit != 'true'
         with:
           package_json_file: site/package.json
@@ -1013,7 +1013,7 @@ jobs:
         with:
           path: ~/setup-pnpm
           key: pnpm-${{ runner.os }}-${{ steps.pnpm.outputs.spec }}
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
         if: steps.pnpm-cache.outputs.cache-hit != 'true'
         with:
           package_json_file: site/package.json

.github/workflows/codeql.yml

@@ -56,7 +56,7 @@ jobs:
         with:
           go-version-file: go.mod
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -69,6 +69,6 @@ jobs:
           go mod download
           go build ./...
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/image-vulns.yml

@@ -47,7 +47,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 

.github/workflows/pages.yml

@@ -70,7 +70,7 @@ jobs:
         with:
           path: ~/setup-pnpm
           key: pnpm-${{ runner.os }}-${{ steps.pnpm.outputs.spec }}
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
         if: steps.pnpm-cache.outputs.cache-hit != 'true'
         with:
           package_json_file: site/package.json

.github/workflows/release.yml

@@ -351,7 +351,7 @@ jobs:
       # nothing about why, which is what the 3.0.0 image looked like from a
       # machine running 2.5.3. Letting the installer's default float means the
       # release could change that behaviour without a commit here.
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
@@ -360,7 +360,7 @@ jobs:
       # rehearsal never needs a credential for either registry and is not
       # given one. The dispatched code runs in this job, and code that runs
       # without a login cannot push.
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
+      - uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
         if: env.REHEARSAL != 'true'
         with:
           registry: ${{ env.REGISTRY }}
@@ -381,7 +381,7 @@ jobs:
           fi
 
       - if: env.REHEARSAL != 'true' && steps.dockerhub-login.outputs.skip == 'false'
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
         with:
           registry: docker.io
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -855,20 +855,20 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
       # Nothing is signed or attested in a rehearsal, so nothing below runs and
       # this job needs no credential then either.
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
+      - uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
         if: env.REHEARSAL != 'true'
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
+      - uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
         if: env.REHEARSAL != 'true' && env.DOCKERHUB_SKIP == 'false'
         with:
           registry: docker.io
@@ -1270,7 +1270,7 @@ jobs:
           # coming from an Actions cache no signature covers.
           cache: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
@@ -1602,7 +1602,7 @@ jobs:
           go-version-file: go.mod
           cache: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
@@ -1643,7 +1643,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
@@ -1741,7 +1741,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
@@ -1824,7 +1824,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
@@ -1846,7 +1846,7 @@ jobs:
       # terminal and accepts --yes without needing it, which the docs rely
       # on), and the digest `make validate-nuget` pins is the container image
       # of this same SDK. Bump the two together.
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+      - uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0
         with:
           dotnet-version: "10.0.403"
 
@@ -1957,7 +1957,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
@@ -2034,7 +2034,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
@@ -2164,7 +2164,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 
@@ -2271,7 +2271,7 @@ jobs:
           ref: main
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: "v3.1.4"
 

.github/workflows/scorecard.yml

@@ -118,6 +118,6 @@ jobs:
             echo "::error file=results.sarif::a run is not Scorecard's supply-chain category, so it is not uploaded"
             exit 1
           }
-      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+      - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           sarif_file: results.sarif