Bump the actions-manual-updates group across 1 directory with 6 updates

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
   workflow-lint:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - run: |
           curl --fail --location --retry 3 --output actionlint.tgz https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
           echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  actionlint.tgz" | sha256sum --check --strict
@@ -26,7 +26,7 @@ jobs:
       matrix:
         os: [ubuntu-22.04, ubuntu-24.04, windows-2025, macos-15-intel, macos-14]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: ./.github/actions/setup-native
       - if: runner.os != 'Windows'
         run: cmake --preset dev
@@ -42,7 +42,7 @@ jobs:
   sanitizers:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: ./.github/actions/setup-native
       - run: cmake --preset asan
       - run: cmake --build --preset asan --parallel 3

.github/workflows/pages.yml

@@ -46,14 +46,14 @@ jobs:
     if: github.event_name != 'release'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build and validate against the latest published release
         run: python3 scripts/build-site.py
         env:
           GH_TOKEN: ${{ github.token }}
       - name: Check JavaScript syntax
         run: node --check site/app.js
-      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         if: github.event_name != 'pull_request'
         with:
           path: build/pages
@@ -69,6 +69,6 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
-      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
         id: deployment

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - id: version
         run: echo "version=$(python3 scripts/version.py)" >> "$GITHUB_OUTPUT"
       - name: Create draft at this commit
@@ -48,7 +48,7 @@ jobs:
       VERSION: ${{ needs.stage.outputs.version }}
       QT_QPA_PLATFORM: offscreen
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: ./.github/actions/setup-native
       - if: runner.os != 'Windows'
         run: cmake --preset release -DTODOBENCH_BUILD_TESTS=ON
@@ -83,7 +83,7 @@ jobs:
         run: python scripts/verify-packages.py dist
       - name: Retain native startup diagnostics
         if: always() && runner.os == 'macOS'
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: startup-diagnostics-${{ matrix.platform }}
           path: build/package-diagnostics/
@@ -97,7 +97,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           RELEASE_PLATFORM: ${{ matrix.platform }}
         run: python scripts/upload-release.py dist
-      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: screenshots-${{ matrix.platform }}
           path: build/screenshots/
@@ -113,8 +113,8 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       VERSION: ${{ needs.stage.outputs.version }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.12'
       - name: Install runtime test tools (no Qt SDK)
@@ -128,7 +128,7 @@ jobs:
           python3 scripts/check-appimage-update.py candidates/*.AppImage
           xvfb-run -a python3 scripts/check-linux-package.py candidates
       - if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: linux-compatibility-${{ matrix.os }}
           path: build/linux-evidence/
@@ -143,13 +143,13 @@ jobs:
       IS_PULLREQUEST: 'true'
       STRICT: 'true'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Download exact candidate
         run: |
           gh release download "v$VERSION" --pattern '*AppImage' --dir candidates
           sha256sum candidates/* > candidate-sha256.txt
       - name: Check out pinned upstream catalog worker
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           repository: AppImage/appimage.github.io
           ref: f1249e9e1ff840dd53a6218aec3451ebd6bf476d
@@ -176,7 +176,7 @@ jobs:
           timeout --kill-after=30 600 bash -e code/worker.sh "$PWD/data/TodoBench" 2>&1 | tee ../catalog.log
           cmp BeingTested.AppImage "../candidates/TodoBench-$VERSION-x86_64.AppImage"
       - if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: appimage-catalog-evidence
           path: |
@@ -196,7 +196,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       VERSION: ${{ needs.stage.outputs.version }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Download and verify all staged artifacts
         run: |
           gh release download "v$VERSION" --dir release-assets

.github/workflows/verify-staged-release.yml

@@ -22,7 +22,7 @@ jobs:
       version: ${{ steps.build.outputs.version }}
       commit: ${{ steps.build.outputs.commit }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - id: build
         env:
           GH_TOKEN: ${{ github.token }}
@@ -40,8 +40,8 @@ jobs:
       VERSION: ${{ needs.stage.outputs.version }}
       SOURCE_COMMIT: ${{ needs.stage.outputs.commit }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.12'
       - name: Install runtime test tools (no Qt SDK)
@@ -55,7 +55,7 @@ jobs:
           python3 scripts/check-appimage-update.py candidates/*.AppImage
           xvfb-run -a python3 scripts/check-linux-package.py candidates
       - if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: linux-compatibility-${{ matrix.os }}
           path: build/linux-evidence/
@@ -71,13 +71,13 @@ jobs:
       IS_PULLREQUEST: 'true'
       STRICT: 'true'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Download exact candidate
         run: |
           gh release download "v$VERSION" --pattern '*AppImage' --dir candidates
           sha256sum candidates/* > candidate-sha256.txt
       - name: Check out pinned upstream catalog worker
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           repository: AppImage/appimage.github.io
           ref: f1249e9e1ff840dd53a6218aec3451ebd6bf476d
@@ -104,7 +104,7 @@ jobs:
           timeout --kill-after=30 600 bash -e code/worker.sh "$PWD/data/TodoBench" 2>&1 | tee ../catalog.log
           cmp BeingTested.AppImage "../candidates/TodoBench-$VERSION-x86_64.AppImage"
       - if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: appimage-catalog-evidence
           path: |
@@ -125,7 +125,7 @@ jobs:
       VERSION: ${{ needs.stage.outputs.version }}
       SOURCE_COMMIT: ${{ needs.stage.outputs.commit }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Download and verify all staged artifacts
         run: |
           gh release download "v$VERSION" --dir release-assets