ci(deps): bump the github-actions group with 11 updates

.github/dependabot.yml

@@ -7,95 +7,36 @@
 
 version: 2
 updates:
+  # All Rust/Cargo directories are grouped into a single entry so that
+  # when a dependency is updated, Dependabot creates ONE PR that bumps it
+  # across the root workspace AND every binding, preventing version skew.
   - package-ecosystem: "cargo"
-    directory: "/" # Location of package manifests
+    directories:
+      - "/"
+      - "/bindings/ffi"
+      - "/bindings/java"
+      - "/bindings/python"
+      - "/bindings/ruby"
+      - "/bindings/wasm"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
-      per-dependency:
+      rust-dependencies:
         patterns:
           - "*"
     # Ignore vendored mimalloc crates; updates are managed manually.
     ignore:
       - dependency-name: "regorus-mimalloc"
       - dependency-name: "regorus-mimalloc-sys"
 
-  - package-ecosystem: "cargo"
-    directory: "/bindings/ffi"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/java"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/python"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/ruby"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/ruby/ext/regorusrb"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/bindings/wasm"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/tests/ensure_no_std"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "cargo"
-    directory: "/xtask"
-    schedule:
-      interval: "weekly"
-    groups:
-      per-dependency:
-        patterns:
-          - "*"
-
   - package-ecosystem: "gomod"
     directory: "/bindings/go"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -105,6 +46,8 @@ updates:
     directory: "/bindings/java"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -114,6 +57,8 @@ updates:
     directory: "/bindings/csharp"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -123,6 +68,8 @@ updates:
     directory: "/bindings/python"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -132,6 +79,8 @@ updates:
     directory: "/bindings/ruby"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "build(deps)"
     groups:
       per-dependency:
         patterns:
@@ -141,7 +90,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    commit-message:
+      prefix: "ci(deps)"
     groups:
-      per-dependency:
+      github-actions:
         patterns:
           - "*"

.github/workflows/codeql.yml

@@ -69,7 +69,7 @@ jobs:
       uses: ./.github/actions/toolchains/rust
 
     - name: Cache cargo
-      uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       with:
         shared-key: ${{ runner.os }}-regorus
 
@@ -99,13 +99,13 @@ jobs:
 
     - name: Setup Go
       if: matrix.language == 'go'
-      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
       with:
         go-version: '1.21'
 
     - name: Setup .NET
       if: matrix.language == 'csharp'
-      uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
+      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
       with:
         global-json-file: ./bindings/csharp/global.json
 
@@ -115,12 +115,12 @@ jobs:
 
     - name: Setup Node.js
       if: matrix.language == 'javascript-typescript'
-      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version: '18'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+      uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -141,7 +141,7 @@ jobs:
 
     - name: Setup Ruby
       if: matrix.language == 'rust' && contains(matrix.working-directory, 'ruby')
-      uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.288.0
+      uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
       with:
         ruby-version: '3.4.2'
         bundler-cache: true
@@ -188,6 +188,6 @@ jobs:
       run: cargo xtask build-wasm --release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+      uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/dependabot-refresh-cargo-lockfiles.yml

@@ -0,0 +1,107 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+#
+name: dependabot/refresh-cargo-lockfiles
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches: ["main"]
+
+permissions:
+  contents: write
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  refresh-cargo-lockfiles:
+    if: >-
+      github.actor == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        repository: ${{ github.event.pull_request.head.repo.full_name }}
+        ref: ${{ github.event.pull_request.head.ref }}
+        fetch-depth: 0
+
+    - name: Setup Rust toolchain
+      run: |
+        rustup override set 1.92.0
+        cargo --version
+        rustc --version
+
+    - name: Refresh affected Cargo lockfiles
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        base_sha="${{ github.event.pull_request.base.sha }}"
+        head_sha="${{ github.event.pull_request.head.sha }}"
+
+        mapfile -t changed_files < <(git diff --name-only "$base_sha" "$head_sha" -- '**/Cargo.toml' '**/Cargo.lock')
+
+        if [ "${#changed_files[@]}" -eq 0 ]; then
+          echo "No Cargo manifest or lockfile changes detected."
+          exit 0
+        fi
+
+        declare -A manifests=()
+        for path in "${changed_files[@]}"; do
+          case "$path" in
+            bindings/ffi/*)
+              manifests["bindings/ffi/Cargo.toml"]=1
+              ;;
+            bindings/java/*)
+              manifests["bindings/java/Cargo.toml"]=1
+              ;;
+            bindings/python/*)
+              manifests["bindings/python/Cargo.toml"]=1
+              ;;
+            bindings/ruby/*)
+              manifests["bindings/ruby/Cargo.toml"]=1
+              ;;
+            bindings/wasm/*)
+              manifests["bindings/wasm/Cargo.toml"]=1
+              ;;
+            *)
+              manifests["Cargo.toml"]=1
+              ;;
+          esac
+        done
+
+        for manifest in "${!manifests[@]}"; do
+          echo "Refreshing lockfile for $manifest"
+          cargo metadata --format-version 1 --all-features --manifest-path "$manifest" > /dev/null
+        done
+
+        if [[ -n "${manifests[Cargo.toml]+x}" ]]; then
+          echo "Refreshing lockfile for tests/ensure_no_std/Cargo.toml (thumbv7m-none-eabi)"
+          cargo metadata --format-version 1 \
+            --manifest-path tests/ensure_no_std/Cargo.toml \
+            --filter-platform thumbv7m-none-eabi > /dev/null
+        fi
+
+    - name: Commit lockfile refresh
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        git add Cargo.lock \
+          bindings/ffi/Cargo.lock \
+          bindings/java/Cargo.lock \
+          bindings/python/Cargo.lock \
+          bindings/ruby/Cargo.lock \
+          bindings/wasm/Cargo.lock
+
+        if git diff --cached --quiet; then
+          echo "No Cargo lockfile changes required."
+          exit 0
+        fi
+
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git commit -m "build(deps): refresh Cargo lockfiles"
+        git push

.github/workflows/dependency-audit.yml

@@ -27,7 +27,7 @@ jobs:
           - bindings/wasm/Cargo.lock
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Run cargo audit
         uses: rustsec/audit-check@v2
@@ -53,7 +53,7 @@ jobs:
           - xtask/Cargo.toml
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: ./.github/actions/toolchains/rust