build(deps): bump the actions group with 8 updates

.github/workflows/codeql.yml

@@ -28,10 +28,10 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
       - name: Analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/desktop-backfill.yml

@@ -175,7 +175,7 @@ jobs:
       - uses: ./.github/actions/setup-bun
         if: steps.existing.outputs.found != 'true'
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: steps.existing.outputs.found != 'true'
         with:
           node-version: "24"

.github/workflows/e2e.yml

@@ -89,7 +89,7 @@ jobs:
 
       - name: Upload Playwright artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-${{ matrix.settings.name }}-${{ github.run_attempt }}
           if-no-files-found: ignore

.github/workflows/npm-test.yml

@@ -92,7 +92,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ needs.version.outputs.source }}
       - uses: ./.github/actions/setup-bun
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
       - name: Restore immutable npm test artifacts
@@ -160,7 +160,7 @@ jobs:
       # registry.npmjs.org, so the rehearsal never waits for the registry to
       # commit fifteen uploads. The real staging happens once, in publish.yml.
       - name: Share the packed candidate with the gate jobs
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: npm-candidate-${{ needs.version.outputs.version }}
           path: .release/npm-test/${{ needs.version.outputs.version }}
@@ -184,7 +184,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ needs.version.outputs.source }}
       - uses: ./.github/actions/setup-bun
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -214,7 +214,7 @@ jobs:
         with:
           ref: ${{ needs.version.outputs.source }}
       - uses: ./.github/actions/setup-bun
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
       - name: Set Playwright browser path
@@ -394,7 +394,7 @@ jobs:
           cat "$RUNNER_TEMP/openscience-fake-model.log" || true
       - name: Upload packaged E2E artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: npm-test-packaged-e2e-${{ github.run_attempt }}
           if-no-files-found: ignore
@@ -433,7 +433,7 @@ jobs:
       - uses: ./.github/actions/setup-bun
         with:
           install: "false"
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
       - uses: ./.github/actions/candidate-registry
@@ -481,7 +481,7 @@ jobs:
           bun --no-env-file backend/cli/script/smoke-darwin-launcher.ts "$native" "$RUNNER_TEMP/darwin-launcher-smoke"
       - name: Upload macOS worker startup evidence
         if: always() && runner.os == 'macOS'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: npm-test-darwin-launcher-${{ github.run_attempt }}
           if-no-files-found: error
@@ -537,7 +537,7 @@ jobs:
         shell: sh
         run: apk add --no-cache curl libstdc++
       - name: Download the packed candidate
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: npm-candidate-${{ needs.version.outputs.version }}
           path: ${{ runner.temp }}/npm-candidate
@@ -608,7 +608,7 @@ jobs:
       - uses: ./.github/actions/setup-bun
         with:
           install: "false"
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
       - uses: ./.github/actions/candidate-registry
@@ -690,7 +690,7 @@ jobs:
           NODE
       - name: Upload scientific capability evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: npm-test-scientific-capability-${{ matrix.os }}-${{ matrix.capability }}-${{ github.run_attempt }}
           if-no-files-found: ignore

.github/workflows/publish.yml

@@ -125,7 +125,7 @@ jobs:
                 "Run it from main with packaged E2E, OS smoke, and scientific canary enabled.",
             )
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -271,7 +271,7 @@ jobs:
           fail-on-cache-miss: true
       - name: Import Developer ID
         if: steps.signed.outputs.cache-hit != 'true'
-        uses: Apple-Actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7.0.0
+        uses: Apple-Actions/import-codesign-certs@77ba2a2a8f5cfc8c405ebf3159f767c323e238f9 # v7.1.0
         with:
           p12-file-base64: ${{ secrets.APPLE_DEVELOPER_ID_P12_BASE64 }}
           p12-password: ${{ secrets.APPLE_DEVELOPER_ID_P12_PASSWORD }}
@@ -409,7 +409,7 @@ jobs:
             git show "$WORKFLOW_SOURCE:$file" > "$file"
           done
       - uses: ./.github/actions/setup-bun
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -588,7 +588,7 @@ jobs:
               --trusted true
           fi
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: steps.existing.outputs.found != 'true'
         with:
           node-version: "24"
@@ -804,7 +804,7 @@ jobs:
       - uses: ./.github/actions/setup-bun
         if: steps.existing.outputs.found != 'true'
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: steps.existing.outputs.found != 'true'
         with:
           node-version: "24"
@@ -1175,7 +1175,7 @@ jobs:
           OPENSCIENCE_PREVIOUS_ZIP: ${{ steps.previous.outputs.zip }}
           OPENSCIENCE_ZIP: ${{ matrix.zip }}
         run: bun frontend/desktop/script/update-download-canary.mjs "$OPENSCIENCE_PREVIOUS_ZIP" "$OPENSCIENCE_ZIP" differential-download.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: differential-download-${{ matrix.arch }}
           path: differential-download.json
@@ -1224,7 +1224,7 @@ jobs:
             git show "$WORKFLOW_SOURCE:$file" > "$file"
           done
       - uses: ./.github/actions/setup-bun
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"

.github/workflows/runtime-conformance.yml

@@ -113,7 +113,7 @@ jobs:
             --execute
       - name: Retain native Harbor conformance evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-harbor-conformance-${{ github.run_attempt }}
           path: ${{ runner.temp }}/native-harbor-conformance

.github/workflows/scorecard.yml

@@ -21,18 +21,18 @@ jobs:
         with:
           persist-credentials: false
       - name: Run analysis
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
       - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: results.sarif