build(deps): bump the actions group across 1 directory with 4 updates

.github/workflows/check-public-api.yaml

@@ -23,7 +23,7 @@ jobs:
   check-public-api:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/pr-autolabel.yml

@@ -60,7 +60,7 @@ jobs:
       # Checkout WITHOUT a ref: under pull_request_target this resolves to the
       # base repo's branch (trusted), never the PR head. We only need the
       # script and .github/pr-labels.json from it.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       # Single self-contained Python script (stdlib only, matching the repo's
       # other .github/scripts/*.py). The workflow picks the sub-command:

.github/workflows/security-audit.yml

@@ -53,7 +53,7 @@ jobs:
           ref: refs/pull/${{ inputs.pr_number }}/head
           fetch-depth: 0
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
 

.github/workflows/sign-old-builds.yaml

@@ -37,7 +37,7 @@ jobs:
           USER: runner
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
 
       # cosign-installer >= v4.1.1 requires envsubst (gettext), which is not
       # preinstalled on the custom runner images.

.github/workflows/vouch-check-pr.yaml

@@ -30,7 +30,7 @@ jobs:
 
       - name: Vouch check
         if: github.event.action == 'opened' || steps.maintainer.outputs.is_maintainer != 'true'
-        uses: mitchellh/vouch/action/check-pr@c6d80ead49839655b61b422700b7a3bc9d0804a9 # v1.4.2
+        uses: mitchellh/vouch/action/check-pr@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
         with:
           pr-number: ${{ github.event.pull_request.number }}
           auto-close: true