Bump the github-actions group with 6 updates

.github/workflows/repo-benchmarks.yml

@@ -23,7 +23,7 @@ jobs:
     # dormant until setup is complete and excludes pull requests from forks.
     # Caller code runs without credentials; a separate fresh runner publishes.
     if: vars.BENCHER_PROJECT != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-    uses: zemd/js/.github/workflows/shared-benchmarks.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-benchmarks.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read # checkout the repository for benchmarks
       checks: write # used only by the isolated Bencher publishing job

.github/workflows/repo-ci.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   ci:
     name: CI
-    uses: zemd/js/.github/workflows/shared-ci.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-ci.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read
     # Every input is optional. Node.js is fixed to lts/*, dependency review

.github/workflows/repo-codeql.yml

@@ -20,7 +20,7 @@ concurrency:
 jobs:
   codeql:
     name: CodeQL
-    uses: zemd/js/.github/workflows/shared-codeql.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-codeql.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read # checkout the repository for analysis
       actions: read # let CodeQL read workflow-run metadata

.github/workflows/repo-release.yml

@@ -18,7 +18,7 @@ concurrency:
 jobs:
   release:
     name: Release
-    uses: zemd/js/.github/workflows/shared-release.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-release.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     # Node.js lts/*, main, release/main, the release PR title, npmjs.org, and
     # the `build` and `lint-publish` scripts are fixed shared conventions.
     permissions:

.github/workflows/repo-scorecard.yml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   scorecard:
     name: Scorecard
-    uses: zemd/js/.github/workflows/shared-scorecard.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-scorecard.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read # checkout the repository for analysis
       actions: read # inspect workflow runs for dangerous patterns

.github/workflows/repo-zizmor.yml

@@ -21,7 +21,7 @@ concurrency:
 jobs:
   zizmor:
     name: zizmor
-    uses: zemd/js/.github/workflows/shared-zizmor.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-zizmor.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read # checkout and online audits
     # with: