ci(deps): bump the actions group across 1 directory with 6 updates

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
         with:
           # zizmor[artipacked]: the checkout's credentials are not needed past this step.
           persist-credentials: false
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
         with:
           enable-cache: true
       - name: Install workspace

.github/workflows/claude-code-review.yml

@@ -52,7 +52,7 @@ jobs:
       # landed on the default branch.
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@6b082c41935b4c8a3b8b0ef85ba4ba4d9eeb8975  # v1
+        uses: anthropics/claude-code-action@3f854a8fb5146b39d5cbf8b57f70d80810e1366f  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Post + maintain a managed PR comment with the review (the switch that makes

.github/workflows/claude.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@6b082c41935b4c8a3b8b0ef85ba4ba4d9eeb8975  # v1
+        uses: anthropics/claude-code-action@3f854a8fb5146b39d5cbf8b57f70d80810e1366f  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
         with:
           # zizmor[artipacked]: the checkout's credentials are not needed past this step.
           persist-credentials: false
-      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3  # v4
+      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4
         with:
           languages: python
-      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3  # v4
+      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4

.github/workflows/deps.yml

@@ -16,7 +16,7 @@ jobs:
         with:
           # zizmor[artipacked]: the checkout's credentials are not needed past this step.
           persist-credentials: false
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
       - name: Export resolved deps
         run: uv export --frozen --format requirements-txt --no-hashes --all-packages > requirements-audit.txt
       # Pinning the tool does not freeze what it knows: pip-audit fetches the advisory
@@ -43,7 +43,7 @@ jobs:
         with:
           # zizmor[artipacked]: the checkout's credentials are not needed past this step.
           persist-credentials: false
-      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48  # v4.9.0
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
         with:
           fail-on-severity: high
           comment-summary-in-pr: on-failure

.github/workflows/secret-scan.yml

@@ -38,7 +38,7 @@ jobs:
           fetch-depth: 0  # full history, same reasoning as gitleaks above
           # zizmor[artipacked]: the checkout's credentials are not needed past this step.
           persist-credentials: false
-      - uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11  # v3.96.0
+      - uses: trufflesecurity/trufflehog@bcfcf73aaf4759d4dadc2783177c245a02792318  # v3.97.0
         with:
           # The Lob detector pattern is `test_` plus exactly 35 more characters, so it
           # collides with ordinary pytest function names of that length. This repo has

.github/workflows/zizmor.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           # zizmor[artipacked]: the checkout's credentials are not needed past this step.
           persist-credentials: false
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
       # Version-pinned for the same reason the actions and the semgrep image are: this
       # is a blocking gate, and an unpinned `uvx zizmor` would let a new release change
       # what the gate enforces with no commit on this side. Dependabot cannot see inside