build(deps): bump the github-actions group across 1 directory with 7 updates

.github/workflows/android-applinks-verify.yml

@@ -28,7 +28,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Verify assetlinks.json
         env:
@@ -51,7 +51,7 @@ jobs:
       # new one when none exists.
       - name: Alert on failure (scheduled run)
         if: failure() && github.event_name == 'schedule'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const title = "⚠️ assetlinks.json verification failed (scheduled check)";

.github/workflows/android-ci.yml

@@ -18,10 +18,10 @@ jobs:
   dependency-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -41,7 +41,7 @@ jobs:
       # fetch the incremental delta. Keyed by week so the cache still refreshes
       # regularly rather than growing stale indefinitely.
       - name: Cache OWASP dependency-check database
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: android/dependency-check-data
           key: dependency-check-data-${{ steps.date.outputs.week }}
@@ -74,10 +74,10 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -218,7 +218,7 @@ jobs:
 
       - name: Upload R8 mapping file
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-r8-mapping
           path: android/app/build/outputs/mapping/release/mapping.txt
@@ -241,31 +241,31 @@ jobs:
 
       - name: Upload test reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-unit-test-reports
           path: android/app/build/reports/tests/testDebugUnitTest
           if-no-files-found: ignore
 
       - name: Upload code coverage report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-coverage-report
           path: android/app/build/reports/jacoco/jacocoTestReport
           if-no-files-found: warn
 
       - name: Upload Paparazzi diff report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: paparazzi-diff-report
           path: android/app/build/paparazzi/failures
           if-no-files-found: ignore
 
       - name: Upload lint report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-lint-report
           path: android/app/build/reports/lint-results-debug.html
@@ -286,10 +286,10 @@ jobs:
   instrumented-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -328,7 +328,7 @@ jobs:
 
       - name: Upload instrumented test reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-instrumented-test-reports
           path: android/app/build/reports/androidTests/connected
@@ -345,10 +345,10 @@ jobs:
   accessibility-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -381,7 +381,7 @@ jobs:
 
       - name: Upload accessibility scan report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-accessibility-scan-report
           path: android/app/build/reports/androidTests/connected
@@ -395,10 +395,10 @@ jobs:
   startup-benchmark:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -463,7 +463,7 @@ jobs:
 
       - name: Upload benchmark report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-startup-benchmark-report
           path: android/app/build/outputs/androidTest-results/connected

.github/workflows/android-dependency-check.yml

@@ -44,10 +44,10 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -67,7 +67,7 @@ jobs:
       # fetch the incremental delta. Keyed by week so the cache still refreshes
       # regularly rather than growing stale indefinitely.
       - name: Cache OWASP dependency-check database
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: android/dependency-check-data
           key: dependency-check-data-${{ steps.date.outputs.week }}
@@ -101,7 +101,7 @@ jobs:
 
       - name: Alert on failure (scheduled run)
         if: failure() && github.event_name == 'schedule'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.issues.create({

.github/workflows/android-firebase-distribution.yml

@@ -74,7 +74,7 @@ jobs:
       tester_groups: ${{ steps.firebase.outputs.tester_groups }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Full history + tags: release notes are generated from commits since
           # the previous vX.Y.Z tag.
@@ -123,7 +123,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -181,7 +181,7 @@ jobs:
       # the Firebase upload fails or for manual sideloading in emergencies.
       - name: Upload APK artifact
         if: steps.options.outputs.dry_run != 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: beta-apk-${{ steps.options.outputs.build_type }}-${{ github.sha }}
           path: android/build/fastlane/firebase_beta/*.apk

.github/workflows/android-play-store-release.yml

@@ -93,7 +93,7 @@ jobs:
       promote: ${{ steps.options.outputs.promote }}
       rollout_fraction: ${{ steps.options.outputs.rollout_fraction }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Full history + tags: release notes cover the range since the previous tag.
           fetch-depth: 0
@@ -143,7 +143,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -214,7 +214,7 @@ jobs:
       run:
         working-directory: android
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Ruby and fastlane (cached)
         uses: ruby/setup-ruby@v1
@@ -240,7 +240,7 @@ jobs:
       run:
         working-directory: android
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Ruby and fastlane (cached)
         uses: ruby/setup-ruby@v1

.github/workflows/artifact-storage.yml

@@ -129,7 +129,7 @@ jobs:
       s3_prefix_mappings: ${{ steps.label.outputs.s3_prefix_mappings }}
       is_release: ${{ steps.label.outputs.is_release }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -206,7 +206,7 @@ jobs:
       run:
         working-directory: ios/EthosProtocol
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -335,7 +335,7 @@ jobs:
 
       - name: Upload .ipa as GitHub Actions artifact (fallback / inspection)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ios-ipa-${{ needs.version.outputs.label }}
           path: |
@@ -361,12 +361,12 @@ jobs:
       run:
         working-directory: android
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -540,7 +540,7 @@ jobs:
 
       - name: Upload Android artifacts as GitHub Actions artifact (fallback / inspection)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-release-${{ needs.version.outputs.label }}
           path: |
@@ -563,7 +563,7 @@ jobs:
        github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Apply lifecycle rules to S3 bucket
         if: ${{ inputs.dry_run != true }}

.github/workflows/cert-pin-expiry-monitor.yml

@@ -29,10 +29,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.12'
 
@@ -76,7 +76,7 @@ jobs:
       # even when the step above continues-on-error.
       - name: Upload expiry report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: cert-expiry-report-${{ github.run_id }}
           path: cert-expiry-report.json

.github/workflows/dependabot-auto-merge.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Check out pull request merge ref
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -56,7 +56,7 @@ jobs:
 
       - name: Skip non-patch updates
         if: steps.metadata.outputs.update-type != 'version-update:semver-patch'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const type = '${{ steps.metadata.outputs.update-type }}' || 'unknown';