chore(deps): bump the actions group across 1 directory with 5 updates

.github/workflows/bench-pr.yml

@@ -718,7 +718,7 @@ jobs:
 
       - name: Upload table
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: table-${{ env.LABEL }}
           path: out/table-${{ env.LABEL }}.md
@@ -764,7 +764,7 @@ jobs:
           build: false
           use-github-cache: false
       - name: Download tables
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: tables
           pattern: table-*
@@ -780,7 +780,7 @@ jobs:
             --head "$HEAD_SHA" \
             --repo-url "${{ github.server_url }}/${{ github.repository }}" \
             --run-id "${{ github.run_id }}" --out comment-body.md
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: comment-body
           path: comment-body.md
@@ -798,7 +798,7 @@ jobs:
       - name: Download comment body
         if: needs.assemble.result == 'success'
         continue-on-error: true
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: comment-body
       # A failed stage prepends a warning header to the report (quoting

.github/workflows/bencher-plots.yml

@@ -46,7 +46,7 @@ jobs:
           auto-config: false
           build: false
           use-github-cache: false
-      - uses: bencherdev/bencher@v0.6.8
+      - uses: bencherdev/bencher@v0.6.11
       # Plot create/delete needs those permissions on the ix project: a
       # user-scoped `bencher_user_*` key (the report-upload token the bench
       # workflows use may be run-scoped and unable to manage plots).

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Compile nataddcomm.ixe
         run: lake exe ix compile Ix.lean --consts Nat.add_comm --out nataddcomm.ixe
       - name: Upload nataddcomm.ixe
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: nataddcomm-ixe
           path: nataddcomm.ixe
@@ -147,7 +147,7 @@ jobs:
           # ELF embed accordingly, so this lints host code only.
           cargo clippy --release --workspace --all-targets -- -D warnings
       - name: Download nataddcomm.ixe
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: nataddcomm-ixe
           path: .
@@ -187,7 +187,7 @@ jobs:
           # ELFs its build scripts already produced).
           cargo clippy --release --workspace --all-targets -- -D warnings
       - name: Download nataddcomm.ixe
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: nataddcomm-ixe
           path: .

.github/workflows/codeql.yml

@@ -34,7 +34,7 @@ jobs:
     steps:
       # paths-filter diffs the PR via the API on pull_request events, but
       # needs a checkout to resolve the pushed commit range on push events.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: dorny/paths-filter@v4
@@ -60,14 +60,14 @@ jobs:
       security-events: write
       packages: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@v4.37.4
         with:
           languages: actions
           build-mode: none
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:actions"
 
@@ -81,14 +81,14 @@ jobs:
       security-events: write
       packages: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@v4.37.4
         with:
           languages: rust
           build-mode: none
           dependency-caching: true
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:rust"